name: security-auditor-tk version: 1.0.0 description: Run security audits on Linux servers, web applications, and cloud infrastructure. Checks SSH hardening, firewall rules, open ports, SSL/TLS config, file permissions, and common vulnerabilities. Produces actionable reports. author: TKDigital category: DevOps & Security tags: [security, audit, linux, hardening, vulnerability, devops, server]

Security Auditor Skill

Comprehensive security auditing for Linux servers, web apps, and cloud infrastructure.

What It Does

1. Server Hardening Audit — SSH config, firewall rules, user permissions, kernel parameters
2. Port & Service Scan — Open ports, running services, unnecessary exposure
3. SSL/TLS Analysis — Certificate validity, protocol versions, cipher suites
4. File Permission Check — World-readable configs, SUID binaries, sensitive file exposure
5. Update Status — Pending security patches, EOL software detection
6. Web App Security — Headers, CORS, cookie flags, common misconfigs
7. Report Generation — Prioritized findings with fix commands

Usage

Full Server Audit

Run a full security audit on this server.
Check: SSH, firewall, ports, users, file permissions, updates, SSL.
Output a prioritized report with fix commands.

Quick SSH Hardening Check

Audit SSH configuration:
- Is root login disabled?
- Is password auth disabled?
- What port is it on?
- Are there any weak ciphers?
Give me the exact commands to fix any issues.

Web Application Security Check

Check security headers and configuration for: [URL]
Look for:
- Missing security headers (CSP, HSTS, X-Frame-Options)
- SSL/TLS issues
- CORS misconfig
- Cookie security flags
- Information disclosure

Cloud Infrastructure Review

Review my cloud setup for security issues:
- Provider: [AWS/GCP/DO/Vultr]
- Services: [list running services]
- Access: [how you connect]
Focus on: IAM, network exposure, storage permissions, logging

Output Format

# Security Audit Report — [Target]
**Date**: [Audit date]
**Scope**: [What was audited]
**Risk Level**: [Critical/High/Medium/Low]

## 🔴 Critical Findings
### [Finding Title]
- **Risk**: [What could happen]
- **Current State**: [What's wrong]
- **Fix**: 
  ```bash
  [Exact command to fix]
  ```
- **Verification**: [How to confirm the fix worked]

## 🟡 Warnings
[Medium-risk findings]

## 🟢 Passed Checks
[What's already good]

## Summary
- Critical: [X]
- Warnings: [X]  
- Passed: [X]
- Overall Score: [X/100]

Checks Performed

SSH (12 checks)

• Root login status
• Password authentication
• Port configuration
• Key-based auth enforcement
• Protocol version
• Cipher suite strength
• MaxAuthTries setting
• LoginGraceTime
• AllowUsers/AllowGroups
• Banner configuration
• Idle timeout
• X11 forwarding

Firewall (8 checks)

• UFW/iptables active
• Default deny policy
• Unnecessary open ports
• Rate limiting rules
• ICMP handling
• IPv6 rules
• Logging enabled
• Fail2ban status

System (10 checks)

• Pending security updates
• EOL software
• SUID/SGID binaries
• World-writable files
• Unowned files
• Cron job permissions
• tmp/var/tmp permissions
• Kernel hardening (sysctl)
• Core dumps disabled
• Automatic updates configured

Web/SSL (8 checks)

• Certificate validity/expiry
• Protocol versions (TLS 1.2+)
• Cipher suite strength
• HSTS header
• Content Security Policy
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy

References

• references/hardening-checklist.md — Complete hardening checklist
• references/common-fixes.md — Copy-paste fix commands for common issues

这个 Skill 的文档编写质量不错，说明清晰、功能覆盖全面，配有详细的检查清单和修复命令参考。不过它本质上只是一个 Prompt 模板，并没有提供实际的安全检测工具或自动化脚本，主要依赖 AI 理解后执行命令。用户需要自己有一定的安全知识基础才能正确使用 AI 生成的建议。建议作者补充一些可直接运行的检测脚本或与现有安全工具的集成，提升实用性。