security-audit

name	security-audit
description	Audit host security using built-in system tools (netstat, lsof, ss, ufw, systemctl, ps, who, last). Check open ports, running services, listening processes, firewall rules, and recent logins. No external CLI needed. Use when user says "security audit", "check open ports", "harden server", or "what's listening on my machine".
allowed-tools	["Bash","Read","Write"]
model	haiku
user-invocable	true
when_to_use	When user wants to audit host security, check for open ports, review running services, inspect firewall rules, or assess overall system risk. Triggers: "security audit", "open ports", "what's listening", "check firewall", "harden my server", "who's logged in", "suspicious processes", "security check".
argument-hint	<scope: full|ports|services|firewall|logins|processes>

Security Audit

Audit host security using built-in system tools. No external tools required — uses netstat, lsof, ss, ufw/iptables, systemctl, ps, who, and last.

Prerequisites

No install needed. All tools are standard on macOS and Linux.

For Linux firewall checks, ufw or iptables must be available. On macOS, pf is used.

Commands

Open Ports & Listening Processes

# All listening ports with process names (Linux)
ss -tlnp

# All listening ports (macOS / fallback)
netstat -an | grep LISTEN

# Identify which process owns each port
lsof -i -P -n | grep LISTEN

Running Services (Linux)

# List all active systemd services
systemctl list-units --type=service --state=running

# Check a specific service status
systemctl status sshd

Firewall Rules

# UFW status (Linux/Ubuntu)
sudo ufw status verbose

# iptables rules (Linux)
sudo iptables -L -n -v

# macOS pf status
sudo pfctl -s rules

Active Logins & Recent Access

# Currently logged-in users
who

# Recent login history
last -20

# Failed login attempts (Linux)
sudo grep "Failed password" /var/log/auth.log | tail -20

# Failed login attempts (macOS)
log show --predicate 'eventMessage contains "Failed password"' --last 1h

Running Processes

# All processes sorted by CPU
ps aux --=-%cpu |  -20


ps aux | grep -v grep | awk  |  -u