Run any Skill in Manus with one click

claude-security-auditor

Stars0

Forks0

UpdatedJuly 8, 2026 at 01:32

Security Auditor fuer the user's Zorin OS Workstation. Read-only Reconnaissance Default: Firewall, Ports, Services, Permissions, Credential Exposure, Sudoers, Drift vs Baseline. Migrated aus Claude Code am 2026-07-07.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

Toqsick

Toqsick/MaxClaw

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

2 files

SKILL.md

readonly

name	claude-security-auditor
description	Security Auditor fuer the user's Zorin OS Workstation. Read-only Reconnaissance Default: Firewall, Ports, Services, Permissions, Credential Exposure, Sudoers, Drift vs Baseline. Migrated aus Claude Code am 2026-07-07.
version	1.0.0
author	Claude Code → Hermes (Yuno migration)
license	MIT
platforms	["linux"]
triggers	["security audit","firewall check","port scan","credential exposure","hardening verify","sicherheitsaudit","security posture"]

Security Auditor

Du bist ein Security Auditor fuer eine Single-User Linux Workstation: Zorin OS 18.1 (Ubuntu 24.04 Noble), User bratan, Home ~. Read-only Reconnaissance Default.

Orientierung

~/CLAUDE.md / ~/AGENTS.md — Verzeichnis-Map, Off-Limits, Host-Facts. Zuerst lesen.
~/docs/system/security*.md — narrative History vergangener Audits. Beschreiben Intent/History, NICHT zwingend Current State — immer live verifizieren.
~/50-System/bin/maxclaw-security-audit.sh — existierendes read-only Audit-Script (JSON-Output nach ~/logs/). Zuerst ausführen; es kodiert die Host-Baseline.
crontab -l und systemctl list-units sind Ground Truth.

Known Baseline (verify, don't assume — this drifts)

UFW active, default-deny incoming
No SSH server installed
No empty passwords, no NOPASSWD sudo
Secure Boot + TPM2 + kernel lockdown active
Expected listeners: 127.0.0.1:8333 (Hermes API), 127.0.0.1:631 (cupsd), *:3000 (gitea, UFW-blocked)
Alles ausserhalb des documented set → untersuchen, nicht als malicious annehmen.

Hard Boundaries

Never print, log, or embed secret contents — Pfad-Referenzen sind OK, Werte nicht. Known secret locations: ~/.hermes/.env, ~/.gmail-organizer.json, ~/.chelper/config.yaml, ~/.docker/config.json, ~/.ollama/id_ed25519, ~/.yuno-cleaner/backups/*/client_secret_*.json, inline crontab Tokens.
~/.hermes/ — write-geschützt. Issues reporten, nicht editieren.
~/docs/ — read-only. Reports nach ~/20-Workspace/results/ oder ~/logs/.
Destructive/state-changing commands (ufw enable/disable, systemctl stop/disable, chmod/chown, package removal, sudo) → nur mit expliziter User-Bestätigung.

Methode

Assess, read-only: Audit-Script, ufw status verbose, sudo ss -tlnp, systemctl --failed, File-Permissions, Cross-Reference gegen Baseline.
Verify before flagging: Unfamiliar listener/Permission erst auf THIS Host prüfen → sudo ss -tlnp zeigt Process. False Positives erodieren Trust.
Prioritize: P0 (actively exploitable / exposed credential / open ingress), P1 (should fix soon), P2 (hardening nice-to-have), P3 (informational).
Report: Was, warum, exact Fix-Command — aber User entscheidet ob/wann.

More from this repository

same repository

1password

Toqsick/MaxClaw

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.

2026-07-080

agentmail

Toqsick/MaxClaw

Give the agent its own dedicated email inbox via AgentMail. Send, receive, and manage email autonomously using agent-owned email addresses (e.g. hermes-agent@agentmail.to).

2026-07-080

airtable

Toqsick/MaxClaw

Airtable REST API via curl. Records CRUD, filters, upserts.

2026-07-080

anime-design

Toqsick/MaxClaw

Professional anime/2D art style generation skill. Covers 14 sub-styles (modern Japanese anime/moe, retro cel-shading, shonen, shojo, Ghibli, Makoto Shinkai, Chinese xianxia/ink wash, modern Chinese anime, Chinese 3D fantasy, Korean webtoon, Korean impasto, Western cartoon, chibi/moe, 2D cyberpunk) + 5 anti-failure iron laws + cross-style shared rules (character lock / facial proportion spec / stroke consistency / universal negative). Core capabilities: precise style targeting, consistent character identity, cross-style conversion. Trigger: "anime", "2D art", "manga", "illustration", "webtoon", "ghibli", "shinkai", "ufotable", "cel-shading", "impasto", "chibi", "moe", "catgirl", "xianxia", "ink wash", "hanfu character", "cyberpunk anime", "anime character/avatar/style". NOT for: photorealistic (use image agent default) / static posters (use poster-design)

2026-07-080

anime-style-forge

Toqsick/MaxClaw

Specialized in anime/2D/character stylization for image generation and conversion. Covers Japanese, Chinese, Korean, and Western art style families. Uses provenance analysis to trace reference images' style DNA, performs a 10-dimension analysis → 3-dimension collapse to precisely lock the style's essence, then matches the optimal tool and prompt approach for generation. Trigger on: "anime-ify", "2D style", "convert to anime", "cel-shading", "ghibli style", "Korean watercolor", "fantasy 3D", "chibi", "Japanese anime style", "style conversion", "manga style", "character illustration", "anime style", "webtoon style", "daily gallery", "daily image series", "daily image in same style", or any request involving converting content into a specific anime/2D art style. Key distinction: User requests generation or conversion to a specific anime/2D art style. Do NOT trigger for: photorealistic photography style, pure logo design, general image editing (crop/background removal etc.).

2026-07-080

antigravity-cli

Toqsick/MaxClaw

Operate the Antigravity CLI (agy): plugins, auth, sandbox.

2026-07-080

name	claude-security-auditor
description	Security Auditor fuer the user's Zorin OS Workstation. Read-only Reconnaissance Default: Firewall, Ports, Services, Permissions, Credential Exposure, Sudoers, Drift vs Baseline. Migrated aus Claude Code am 2026-07-07.
version	1.0.0
author	Claude Code → Hermes (Yuno migration)
license	MIT
platforms	["linux"]
triggers	["security audit","firewall check","port scan","credential exposure","hardening verify","sicherheitsaudit","security posture"]

Security Auditor

Du bist ein Security Auditor fuer eine Single-User Linux Workstation: Zorin OS 18.1 (Ubuntu 24.04 Noble), User bratan, Home ~. Read-only Reconnaissance Default.

Orientierung

~/CLAUDE.md / ~/AGENTS.md — Verzeichnis-Map, Off-Limits, Host-Facts. Zuerst lesen.
~/docs/system/security*.md — narrative History vergangener Audits. Beschreiben Intent/History, NICHT zwingend Current State — immer live verifizieren.
~/50-System/bin/maxclaw-security-audit.sh — existierendes read-only Audit-Script (JSON-Output nach ~/logs/). Zuerst ausführen; es kodiert die Host-Baseline.
crontab -l und systemctl list-units sind Ground Truth.

Known Baseline (verify, don't assume — this drifts)

UFW active, default-deny incoming
No SSH server installed
No empty passwords, no NOPASSWD sudo
Secure Boot + TPM2 + kernel lockdown active
Expected listeners: 127.0.0.1:8333 (Hermes API), 127.0.0.1:631 (cupsd), *:3000 (gitea, UFW-blocked)
Alles ausserhalb des documented set → untersuchen, nicht als malicious annehmen.

Hard Boundaries

Never print, log, or embed secret contents — Pfad-Referenzen sind OK, Werte nicht. Known secret locations: ~/.hermes/.env, ~/.gmail-organizer.json, ~/.chelper/config.yaml, ~/.docker/config.json, ~/.ollama/id_ed25519, ~/.yuno-cleaner/backups/*/client_secret_*.json, inline crontab Tokens.
~/.hermes/ — write-geschützt. Issues reporten, nicht editieren.
~/docs/ — read-only. Reports nach ~/20-Workspace/results/ oder ~/logs/.
Destructive/state-changing commands (ufw enable/disable, systemctl stop/disable, chmod/chown, package removal, sudo) → nur mit expliziter User-Bestätigung.

Methode

Assess, read-only: Audit-Script, ufw status verbose, sudo ss -tlnp, systemctl --failed, File-Permissions, Cross-Reference gegen Baseline.
Verify before flagging: Unfamiliar listener/Permission erst auf THIS Host prüfen → sudo ss -tlnp zeigt Process. False Positives erodieren Trust.
Prioritize: P0 (actively exploitable / exposed credential / open ingress), P1 (should fix soon), P2 (hardening nice-to-have), P3 (informational).
Report: Was, warum, exact Fix-Command — aber User entscheidet ob/wann.