菜单
Workflow for 'Surgical Scrubbing' and hardening a used or fresh VPS to ensure a zero-trust environment before deployment.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Durable knowledge-vault reference for the Prismtek/Buddy talking-host lip-sync workflow.
Configure, extend, or contribute to Hermes Agent.
Use when reviewing betting-model pipelines, sports prediction datasets, backtests, expected value math, and model-risk controls without placing bets.
Use when planning, drafting, repurposing, and promoting content across YouTube, X, and Twitch while keeping posting, DMs, replies, deletions, and account changes approval-gated.
Use when turning approved bookmarks and linked articles into ranked research digests, summaries, and next actions using read-only browser or API adapters.
Use when preparing concise pre-call context briefs from approved notes, prior conversations, public signals, project status, and open questions.
| name | vps-setup-and-hardening |
| description | Workflow for 'Surgical Scrubbing' and hardening a used or fresh VPS to ensure a zero-trust environment before deployment. |
| version | 1.0.0 |
| author | Hermes Agent |
| license | MIT |
| platforms | ["linux"] |
| metadata | {"hermes":{"tags":["vps","linux","hardening","security","devops"]}} |
Use this skill when inheriting a VPS (e.g., from a friend or a repurposed instance) to ensure no legacy users, keys, or services compromise the new stack.
Identify and remove non-system users to ensure you are the only human operator.
grep -v "/sbin" /etc/passwd (Look for unexpected users in /home).userdel -r <username> for any ghost accounts.Prevent unauthorized access via legacy SSH keys.
echo "" > /root/.ssh/authorized_keys (Immediately removes all existing key-based access).authorized_keys.Establish a default-deny posture.
ufw allow 22/tcp (CRITICAL: do this before enabling).ufw --force enable.Ensure the OS is patched and clean.
apt update && apt upgrade -y.apt autoremove -y.When automating this via a remote agent, use sshpass for initial password-based entry until keys are rotated:
sshpass -p 'password' ssh -o StrictHostKeyChecking=no root@<ip> 'command'
When deploying from monorepos (like the automindlab-stack), the docker-compose.yaml is often NOT in the root.
find . -name "compose.yaml" to locate the specific deployment slice.docker compose -f path/to/compose.yaml up -d.netstat -tulpn or ss -tulpn.cut -d: -f1 /etc/passwd.