security-skills

Agent skills for non-destructive server security auditing — compatible with Claude Code, Cursor, Gemini CLI, and any agent supporting the agentskills.io spec.

Skills

server-security-scan

Dual-mode security audit:

Mode	Input	Tools
External	IP only	nmap, nikto, nuclei
Internal	IP + SSH credentials	ssh + built-in Linux commands, lynis

Prerequisites (install once):

macOS:

brew install nmap nikto nuclei

Debian/Ubuntu:

sudo apt install nmap nikto lynis
# nuclei has no apt package — install from release binary
curl -sL "https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip" \
  -o /tmp/nuclei.zip && sudo unzip -d /usr/local/bin /tmp/nuclei.zip nuclei

Docker (no local install required):

docker pull instrumentisto/nmap projectdiscovery/nuclei alpine/nikto
docker run --rm instrumentisto/nmap -Pn -sV -sC <IP>

Install skill:

# Global — available in all projects and Claude Code sessions
npx skills add tommasinigiovanni/security-skills@server-security-scan -g

# Project-level — available only in the current directory/project
npx skills add tommasinigiovanni/security-skills@server-security-scan

Usage: give Claude an IP address (external scan) or an IP + SSH access details (internal scan). The skill always asks for explicit authorization before starting.

Sample Report Output

# Security Report — 203.0.113.42
**Date:** 2025-05-19  **Type:** both  **Author:** Giovanni

## Executive Summary
3 findings (1 critical, 1 high, 1 medium). Docker daemon exposed on TCP 2375
with no auth — immediate remediation required. SSH allows password login with
no fail2ban. TLS 1.0 enabled on port 443.

## Findings

### 🔴 Critical
| # | Vulnerability | Service/Path | CVSS | Source | Remediation |
|---|---|---|---|---|---|
| 1 | Docker daemon exposed (no auth) | TCP 2375 | 9.8 | nuclei | Bind to 127.0.0.1 or disable TCP socket |

### 🟠 High
| # | Vulnerability | Service/Path | CVSS | Source | Remediation |
|---|---|---|---|---|---|
| 1 | SSH PasswordAuthentication enabled, no fail2ban | TCP 22 | 7.5 | sshd -T | Disable password auth; install fail2ban |

### 🟡 Medium
| # | Vulnerability | Service/Path | CVSS | Source | Remediation |
|---|---|---|---|---|---|
| 1 | TLS 1.0 enabled | TCP 443 | 5.3 | nmap ssl-enum-ciphers | Disable TLS <1.2 in nginx/apache config |

## Detected Ports and Services
| Port | State | Service | Version |
|------|-------|---------|---------|
| 22/tcp | open | ssh | OpenSSH 8.9p1 |
| 80/tcp | open | http | nginx 1.18.0 |
| 443/tcp | open | https | nginx 1.18.0 |
| 2375/tcp | open | docker | Docker 24.0.5 |

## Next Steps
1. Disable Docker TCP socket immediately (or add TLS + client cert auth)
2. Set `PasswordAuthentication no` in sshd + install fail2ban
3. Disable TLS 1.0/1.1 in nginx ssl_protocols

Contributing

PRs welcome. Please keep skills non-destructive and include an authorization gate.

License

MIT