Security audit
Security checks across malware telemetry and agentic risk
This GDPR audit skill is mostly purpose-aligned, but it asks an agent to perform broad sensitive system scans and privileged checks without tight scope or output protections.
Install or run this only on systems you are authorized to audit. Limit scans to approved directories and accounts, run privileged checks only when needed, and protect the generated report directory with restrictive permissions because it may contain PII locations, credential file paths, access-control details, and security weaknesses.
echo "--- TLS Verification ---"
for port in 443 8443 9443; do
echo "Port $port:"
result=$(curl -s -X POST "http://localhost:8765/aynops/ssl" \
-H "Content-Type: application/json" \
-d "{\"host\": \"$TARGET\", \"port\": $port}" 2>/dev/null)# World-readable sensitive files
echo ""
echo "--- World-Readable Sensitive Files ---"
find /home -type f \( -name "*.env" -o -name "*.pem" -o -name "id_*" -o -name "*.key" \) -perm /o+r 2>/dev/null | \
while IFS= read -r file; do
echo " ❌ WORLD-READABLE: $file"
done | tee "$AUDIT_DIR/world-readable-sensitive.txt"# PostgreSQL if systemctl is-active --quiet postgresql 2>/dev/null; then echo "PostgreSQL: RUNNING" | tee -a "$AUDIT_DIR/databases.txt" sudo -u postgres psql -c "\l" 2>/dev/null >> "$AUDIT_DIR/postgres-databases.txt" else echo "PostgreSQL: not running" | tee -a "$AUDIT_DIR/databases.txt" fi
# Firewall rules echo "" echo "--- Firewall Rules ---" sudo iptables -L -n -v 2>/dev/null | head -40 | tee "$AUDIT_DIR/firewall-rules.txt" # Open ports echo ""
# PostgreSQL table sizes and ages
if systemctl is-active --quiet postgresql 2>/dev/null; then
sudo -u postgres psql -c "
SELECT
schemaname || '.' || relname AS table_name,
n_live_tup AS estimated_rows,| Symptom | Likely Cause | Fix | |---------|-------------|-----| | Disk encryption not detected | Not using LUKS | Check with `sudo dmsetup ls` | | TLS check fails | Certificate expired | Renew via certbot or CA | | Firewall rules empty | iptables not configured | `sudo iptables -L -n` | | PostgreSQL access denied | No sudo/peer auth | Configure `~/.pgpass` or peer auth |
|---------|-------------|-----| | Disk encryption not detected | Not using LUKS | Check with `sudo dmsetup ls` | | TLS check fails | Certificate expired | Renew via certbot or CA | | Firewall rules empty | iptables not configured | `sudo iptables -L -n` | | PostgreSQL access denied | No sudo/peer auth | Configure `~/.pgpass` or peer auth | | PII scan too slow on large filesystems | Recursive find on /home | Limit with `-maxdepth 3` | | DPIA template questions unclear | Template designed for general case | Customize per processing activity |
echo "--- SSH Keys ---"
for user_home in /home/*; do
user=$(basename "$user_home")
if [ -f "$user_home/.ssh/authorized_keys" ]; then
key_count=$(wc -l < "$user_home/.ssh/authorized_keys")
echo " User $user: $key_count authorized keys"for user_home in /home/*; do
user=$(basename "$user_home")
if [ -f "$user_home/.ssh/authorized_keys" ]; then
key_count=$(wc -l < "$user_home/.ssh/authorized_keys")
echo " User $user: $key_count authorized keys"
# Check key types (ed25519 > rsa)echo " User $user: $key_count authorized keys"
# Check key types (ed25519 > rsa)
rsa_keys=$(grep -c "ssh-rsa" "$user_home/.ssh/authorized_keys" 2>/dev/null || echo 0)
ed25519_keys=$(grep -c "ssh-ed25519" "$user_home/.ssh/authorized_keys" 2>/dev/null || echo 0)
if [ "$rsa_keys" -gt 0 ]; then
echo " ⚠️ $rsa_keys RSA keys (deprecated — migrate to ed25519)"# Check key types (ed25519 > rsa)
rsa_keys=$(grep -c "ssh-rsa" "$user_home/.ssh/authorized_keys" 2>/dev/null || echo 0)
ed25519_keys=$(grep -c "ssh-ed25519" "$user_home/.ssh/authorized_keys" 2>/dev/null || echo 0)
if [ "$rsa_keys" -gt 0 ]; then
echo " ⚠️ $rsa_keys RSA keys (deprecated — migrate to ed25519)"
fiif grep -qiE "secret|password|token|key|credential" "$file" 2>/dev/null; then
echo " SENSITIVE: $file (contains credential patterns)"
fi
done | tee "$AUDIT_DIR/plaintext-secrets.txt"
# Check log files for PII leakage
echo ""# World-readable sensitive files
echo ""
echo "--- World-Readable Sensitive Files ---"
find /home -type f \( -name "*.env" -o -name "*.pem" -o -name "id_*" -o -name "*.key" \) -perm /o+r 2>/dev/null | \
while IFS= read -r file; do
echo " ❌ WORLD-READABLE: $file"
done | tee "$AUDIT_DIR/world-readable-sensitive.txt"VirusTotal findings are pending for this skill version.
No suspicious patterns detected.