skills.rest
takusaotome
takusaotomeCOMMUNITY
Explore all skills by this author →
GitHub

web-server-security-reviewer

Review nginx/apache web server configurations on Linux with read-only checks.

5|4|Updated Nov 9, 2025
Search Tags:#security audit#nginx#compliance reporting#apache#configuration review#evidence integrity#read-only guardrails
One-click install
npx skills add https://github.com/takusaotome/claude-skills-library --skill web-server-security-reviewer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-server-security-reviewer
Source: https://github.com/takusaotome/claude-skills-library/tree/main/skills/web-server-security-reviewer
Command: npx skills add https://github.com/takusaotome/claude-skills-library --skill web-server-security-reviewer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, yaml, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps you conduct a Phase 1 security review of nginx/apache web server configurations without performing risky changes, producing evidence-backed findings and a structured report suitable for compliance-style auditing.

Core Features & Use Cases

  • Read-only Phase 1 configuration review: Scans security-critical configuration areas for nginx/apache on Linux using an approved checklist approach.
  • Evidence integrity & provenance: Verifies integrity using MANIFEST.txt and manifest_attestation.txt, separating masked outputs from raw evidence storage.
  • 9-axis security coverage with role extensions: Produces severity-ranked findings across OS/resources/logging/network/services/authn-monitoring-backup-certs and supports role-specific checks.
  • Strict guardrails for safety: Enforces a 6-tier command execution policy (including conditional/exceptional read handling), forbids write/change commands, and records command logs with approvals.

Quick Start

Use the web-server-security-reviewer skill to run a Phase 1 configuration security audit for a target host using a provided target_profile.yaml input contract.

Frequently Asked Questions about web-server-security-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a read-only security audit of nginx or apache configuration files?▼

To perform a read-only security audit of nginx or apache configurations, use a checklist-driven approach that scans security-critical areas without executing write commands, producing evidence-backed findings across 9 security axes.

What is a Phase 1 web server configuration review and when do I need it?▼

A Phase 1 web server configuration review is an initial, non-invasive investigation of nginx/apache settings to identify document-root leaks, log-rotation issues, and runtime reconnaissance risks before deeper penetration testing.

Can I generate compliance reports for apache and nginx without modifying server configurations?▼

Yes, you can generate compliance reports without modifying server configurations by enforcing strict read-only guardrails and a 6-tier command execution policy that forbids write or change commands.

How do I verify evidence integrity during a web server security configuration check?▼

Verifying evidence integrity during a security configuration check involves validating files against MANIFEST.txt and manifest_attestation.txt, separating masked outputs from raw evidence storage.

Does the web server security audit require python3 to run configuration reviews?▼

Yes, the web server security audit requires python3 and yaml dependencies to process the target_profile.yaml input contract and organize severity-ranked findings.

What are the limitations of a Phase 1 security audit for nginx and apache?▼

A Phase 1 security audit for nginx and apache is limited to read-only reconnaissance and configuration compliance checks; it does not perform active exploitation or remediate detected vulnerabilities.

Related Skills

Explore More Legal & Compliance Skills→
understudylabsunderstudylabs
10

capture-evidence

Generate harness, metric, splits, and baseline artifacts from workloads.

Official
Advanced
GhostPWNGhostPWN
4

Vulnerability Scanning & Assessment

Audit Python, npm, and Go dependencies plus Nginx and SSHD configurations for known vulnerabilities.

Official
Advanced
sAkuraOfficialsAkuraOfficial

two-factor-authentication-best-practices

Configure TOTP, OTP, and backup codes for Better Auth two-factor authentication.

Community
Advanced
BrownFineSecurityBrownFineSecurity
811

nmap

Identify open ports and enumerate network services with Nmap.

Official
Advanced