Menu
DISA STIG (Security Technical Implementation Guide) audit + GPO remediation + keep-open justification advisory. Triggers on STIG, DISA, SCAP, OpenSCAP, Compliance Master, GPO, group policy hardening, keep-open justification, CKL.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Market and demand research procedures. Niche discovery, demand sizing, competitor/gap analysis, opportunity scoring, and pricing/positioning signals BEFORE building. Triggers on: market research, demand, niche, opportunity sizing, competitor analysis, TAM, positioning, pricing, go-to-market, validate idea, is there demand.
Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle identifier, package name, version, build number, version code.
Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin, plugin test, app.config plugin.
Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.
iOS and Android build profiles with EAS Build, credentials management, build cache, secrets, and monorepo support. Triggers on eas build, eas.json, build profile, credentials, provisioning profile, keystore, push certificate, service account, build cache, eas secret, monorepo, development build, preview build, production build.
App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production submit, release management.
| name | pentest-stig |
| description | DISA STIG (Security Technical Implementation Guide) audit + GPO remediation + keep-open justification advisory. Triggers on STIG, DISA, SCAP, OpenSCAP, Compliance Master, GPO, group policy hardening, keep-open justification, CKL. |
| license | MIT |
| compatibility | Works with Claude Code |
| allowed-tools | Read Write Edit Bash Grep |
| metadata | {"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-stig","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents stig-analyst"} |
DISA STIG audit + remediation advisory. Standard in government, finance, and critical-infrastructure engagements.
A security configuration baseline published by the US Department of Defense Defense Information Systems Agency (DISA). Specific rules for Linux, Windows, web servers, network devices, databases, and applications.
Format:
# OpenSCAP (Linux audit)
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig \
--results scan-results.xml \
--report scan-report.html \
--datastream-id ds-rhel8.xml \
ssg-rhel8-ds.xml
# Windows: SCC Tool (DISA) or the OpenSCAP Windows port
# Web: scap-security-guide / OpenSCAP web UI
An XML format opened with the DISA STIG Viewer. Per STIG ID:
| ID | Title | CAT |
|---|---|---|
| RHEL-08-010020 | Crypto Policy = FIPS | I |
| RHEL-08-010049 | Banner login warn message | III |
| RHEL-08-010130 | SSH PermitRootLogin no | II |
| RHEL-08-010140 | Disable USB mass storage | II |
| RHEL-08-010210 | /tmp nosuid mount | II |
| RHEL-08-010370 | sudo logging | II |
| RHEL-08-010460 | password complexity (pwquality) | II |
| RHEL-08-010620 | session timeout 15min | III |
| RHEL-08-020220 | account lockout 3 try | II |
| RHEL-08-040340 | firewalld enabled | II |
| ID | Title | CAT |
|---|---|---|
| WN22-00-000010 | Inactive accounts disable | III |
| WN22-AC-000010 | Lockout duration | II |
| WN22-AC-000020 | Lockout threshold | II |
| WN22-AU-000010 | Audit Account Logon | II |
| WN22-SO-000020 | Anonymous SID lookup | I |
| WN22-SO-000080 | LM hash storage off | I |
| WN22-SO-000100 | LMCompat Level 5 | I |
Some STIG rules are not applied for business-specific reasons. Writing a justification:
## STIG ID: RHEL-08-010130 (SSH PermitRootLogin)
### Status: Open (Mitigated)
### Justification
- **Risk**: Direct root SSH allows offline brute force, lateral movement
- **Compensating Control 1**: SSH bind only to management VLAN (192.168.99.0/24)
- **Compensating Control 2**: PubkeyAuth only (PasswordAuth off)
- **Compensating Control 3**: All sudo + root commands logged to remote syslog
- **Compensating Control 4**: 2FA via FreeIPA (TOTP)
- **Compensating Control 5**: Bastion host required (jump server with session record)
- **Business Need**: Legacy application requires root for service init
- **Remediation Roadmap**: Application refactor to sudo-only by Q4 2026
- **Approval**: Security Manager <name>, <date>
- **Review Frequency**: Every 6 months
# STIG WN22-SO-000080 (LM hash storage off)
# Manual GPO path:
# Computer Config -> Policies -> Windows Settings -> Security Settings
# -> Local Policies -> Security Options
# -> "Network security: Do not store LAN Manager hash value on next password change"
# Enable
# Via command (LGPO.exe or ADMX):
ntfrsutl ds # is there AD connectivity
# Add into the Group Policy Object:
# HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NoLMHash = 1
# STIG check across the whole system (cron / Ansible)
oscap xccdf eval --profile stig \
--results-arf /var/log/stig-arf.xml \
--report /var/log/stig-report.html \
ssg-rhel8-ds.xml
# Ansible STIG playbook
ansible-playbook -i inventory stig-rhel8-playbook.yml --check
# Result -> convert to CKL
sscap-to-checklist --input stig-arf.xml --output system.ckl
## STIG Audit — <system>
### Compliance Score
- Total: 250 STIG rules
- NotAFinding: 195 (78%)
- Open: 38 (15.2%)
- Not_Applicable: 12 (4.8%)
- Not_Reviewed: 5 (2%)
### CAT I Open (Critical — 5)
1. RHEL-08-010210 /tmp nosuid missing (remediation: 1-line mount opt)
2. WN22-SO-000080 LM hash storage on (GPO update)
3. ... (3 more)
### Keep-Open Justified (Mitigated)
1. RHEL-08-010130 SSH root login (5 compensating control)
2. ...
### Remediation Plan
| Priority | Count | Effort | Timeline |
|----------|-------|--------|----------|
| CAT I | 5 | 8h | 1 week |
| CAT II | 28 | 32h | 1 month |
| CAT III | 5 | 8h | 3 months |