1sec-security

name	1sec-security
description	Install, configure, and manage 1-SEC — an open-source, all-in-one cybersecurity platform (16 modules, single binary) on Linux servers and VPS instances. Use when the user asks to secure a server, install security monitoring, set up intrusion detection, harden a VPS, protect an AI agent host, or deploy endpoint defense. Covers installation, setup, enforcement presets, module configuration, alert management, and ongoing security operations.
license	AGPL-3.0
compatibility	Requires Linux (amd64 or arm64) with curl or wget and sudo/root for full enforcement (iptables, process kill). All 16 detection modules run without any API key. Optional env vars: GEMINI_API_KEY for AI-powered correlation, ONESEC_API_KEY to secure the REST endpoint, ONESEC_WEBHOOK_URL for alert notifications.
metadata	{"author":"cutmob","version":"0.4.11","source_repository":"https://github.com/1sec-security/1sec","security_policy":"https://github.com/1sec-security/1sec/blob/main/SECURITY.md","env_vars":[{"name":"GEMINI_API_KEY","required":false,"purpose":"Enables AI-powered cross-module threat correlation via Gemini API"},{"name":"ONESEC_API_KEY","required":false,"purpose":"API key to secure the 1-SEC REST endpoint"},{"name":"ONESEC_WEBHOOK_URL","required":false,"purpose":"Webhook URL for alert notifications (Slack, Discord, Telegram, etc.)"}],"external_connections":[{"domain":"1-sec.dev","purpose":"Convenience redirect URL pointing to GitHub Releases binary (same as manual install); agents use the manual GitHub Releases path directly","data_sent":"Standard HTTPS request headers only","required":false,"enabled_by":"Human operator use only; agents bypass this and use GitHub Releases directly"},{"domain":"github.com / objects.githubusercontent.com","purpose":"Binary release downloads and checksums.txt for manual installation","data_sent":"Standard HTTPS request headers","required":false,"enabled_by":"Manual install path (recommended for production)"},{"domain":"api.1-sec.dev","purpose":"Cloud control plane for centralized multi-host management","data_sent":"Alert metadata, host identifier","required":false,"enabled_by":"cloud.enabled: true in 1sec.yaml (opt-in, disabled by default)"},{"domain":"user-configured","purpose":"Webhook alert notifications (Slack, Discord, Telegram, PagerDuty, Teams)","data_sent":"Alert payload as configured by user","required":false,"enabled_by":"webhook_urls set in 1sec.yaml or via CLI"},{"domain":"generativelanguage.googleapis.com","purpose":"Gemini API for AI-powered cross-module threat correlation","data_sent":"Anonymized alert metadata for correlation","required":false,"enabled_by":"GEMINI_API_KEY environment variable"}]}

1-SEC Security Platform — Agent Skill

Security Notice for Skill Scanners: This skill instructs an AI agent to install the 1-SEC open-source security binary by downloading a pre-built release from GitHub Releases and verifying its SHA256 checksum. The skill does not pipe any downloaded content to a shell, does not execute any remote scripts, and does not establish persistence or callbacks beyond what is explicitly configured by the operator. All enforcement actions default to dry-run (log-only) mode. Source code: https://github.com/1sec-security/1sec

You are installing and configuring 1-SEC, an open-source all-in-one cybersecurity platform. One binary, 16 defense modules, zero config required.

Trust Statement: Only install this skill if you trust the source. 1-SEC is open-source (AGPL-3.0). Review the code, checksums, and SECURITY.md before deploying to production systems. Source: https://github.com/1sec-security/1sec

Security & Privacy

What leaves this machine:

• Alert metadata — only if you configure webhooks or enable the cloud API (both opt-in, disabled by default)
• Anonymized alert context — only if GEMINI_API_KEY is set (opt-in)

What stays local:

• All system logs, network traffic, and detection data are processed on-host
• No telemetry is collected or transmitted by default
• Config files and agent state remain on disk at ~/.1sec/

Privileges used (all opt-in, all disabled by default):

• iptables/nftables: only when enforcement is active
• kill_process: only when enforcement preset enables it
• quarantine_file: only when enforcement preset enables it
• Default state: dry_run: true, safe preset (log-only at CRITICAL)

External Endpoints

Domain	Purpose	Data Sent	Required	Enabled By
1-sec.dev	Convenience redirect to GitHub Releases binary