inspect-cpanel

name	inspect-cpanel
description	OBSERVE (cPanel/WHM only): wrap the cPanel control plane read-only — cPHulk on?, EOL PHP per account, update cadence/tier, Exim outbound-spam queue, orphaned CSF, Imunify detections, altered cPanel RPMs. Self-gates to a no-op off cPanel boxes. Detect + propose; never edits cPanel config or applies a fix.
lane	coding
allowed-tools	Read, Glob, Grep, Bash

inspect-cpanel (Grammar / Observe)

A cPanel & WHM server rides on the RHEL family, so the rest of claude-watchman already covers its OS. This skill adds the control plane: it QUERIES cPanel's own tools (whmapi1, exim, cPHulk, CSF, Imunify, check_cpanel_rpms) read-only and journals what it finds. It does not re-implement them, and it self-gates — on a non-cPanel box it does nothing. Read-only security/config/integrity findings at review/manual tier.

PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.

Why everything here is review/manual, never safe-auto

cPanel rebuilds its own configs: a hand-edit to /etc/exim.conf is erased by buildeximconf, and Apache httpd.conf is regenerated by EasyApache4. The firewall is owned by CSF/LFD and cPHulk — a raw nftables rule fights them and can sever access. So claude-watchman never edits cPanel config or touches the firewall: it surfaces the finding and routes the fix back through the operator and the control panel's own UI. That is the Prime Directive expressed in cPanel's own vocabulary.

When to use

Every /watchman audit / /watchman loop, on a server profile. On a non-cPanel host the engine returns immediately — it is safe to run everywhere.

Workflow

1. Preflight. Run every claude-watchman function through the dispatcher — bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init. Determine the machine's family and profile by running bash lib/wm watchman_family and bash lib/wm watchman_profile and reading the printed values — you do NOT pass them to journal_upsert (it auto-resolves them; pass "" ""). Gate: if bash lib/wm control_panel_detect is not cpanel, journal nothing and stop — this is not a cPanel box. I/O courtesy: the RPM verification is a heavy disk read — IF bash lib/wm io_should_defer_heavy, journal a capacity/info/safe diagnostic_deferred (target=inspect-cpanel) and skip this pass.
2. Scan. Run bash lib/wm cpscan. Read-only — it calls whmapi1 GET functions, reads cPanel config, counts the Exim queue, and runs check_cpanel_rpms --list (never --fix). It emits one TSV finding-candidate per signal: category \t severity \t risk_tier \t check_id \t target \t title \t detail \t remediation. No output = the control plane looks healthy.
3. Journal each record through lib/journal.sh exactly as emitted (pass "" "" for family/profile — journal_upsert auto-resolves them): bash lib/wm journal_upsert "" "" <category> <severity> <risk_tier> <check_id> <target> <title> <detail> <remediation>. target is the subject (cphulk / an ea-php token / exim-queue / csf ...) so the fingerprint is stable and a regressed defense (cPHulk turned back off, EOL PHP reintroduced) surfaces loudly.
4. Tiers — never apply. Every cPanel finding is review or manual. NEVER edit a cPanel config file, touch the firewall, suspend an account, clear the mail queue, or run an update here — propose the control-panel action, the operator decides.
5. Summarize. Lead with the highest-severity finding (active malware, an Exim spam spike, cPHulk off) and the one-line control-panel action; if clean, say the control plane looks healthy.

Grounding

All claude-watchman functions below are reached via bash lib/wm <function> (never a direct source); the lib files are where they live.

• lib/cpanel.sh — cpscan (the read-only control-plane engine; thresholds WATCHMAN_EXIM_QUEUE_MAX / WATCHMAN_EXIM_FROZEN_MAX, EOL list WATCHMAN_EOL_PHP).
• lib/distro.sh — control_panel_detect, cpanel_version, cpanel_log_paths.
• lib/profile.sh — the cpanel_* check severities (server profile).
• lib/io-courtesy.sh — io_should_defer_heavy / io_run (defer + price the RPM scan).
• lib/journal.sh — journal_upsert (per-subject findings; regress over time).
• skills/rhetoric/fix-redflag — surfaces the proposed control-panel actions (review/manual).
• manifest.json — declared permissions.