NAS

Configure, secure, and optimize network attached storage with proper backup strategy, remote access, and media serving.

Security Scan

The skill is an instruction-only NAS administration guide whose required pieces align with its stated purpose and it does not request extra credentials or install code.

Purpose & Capability

The name/description (NAS administration, backup, remote access, media serving) matches the contents of SKILL.md and the bundled docs (apps.md, backup.md, media.md, security.md). All referenced services (WireGuard, Tailscale, B2/S3, LetsEncrypt, Plex/Jellyfin) are reasonable for the stated purpose.

Instruction Scope

All runtime instructions are guidance and config examples for NAS administration (YAML snippets, folder layouts, checklist items). The docs do not instruct the agent to read local files, access unrelated system credentials, exfiltrate data, or call hidden endpoints. They do recommend using third-party services (cloud backups, tunnels), which is expected for a NAS guide.

Install Mechanism

This is an instruction-only skill with no install spec and no code files to download or execute. That minimizes on-disk execution risk.

Credentials

The skill declares no required environment variables, credentials, or config paths. Mentions of cloud providers and VPNs are contextual recommendations, not requests for secrets or platform credentials.

Persistence & Privilege

The skill is not marked always:true and does not request persistent system privileges or to modify other skills. Model invocation is allowed (normal default) but there are no capabilities here that would leverage elevated persistent access.

Assessment

This skill is a set of written best-practices and configuration examples for NAS administration and appears internally consistent. However: the publisher and homepage are unknown — treat the content as unverified advice and cross-check against vendor documentation before applying changes. Because it references cloud services and remote-access tools, never paste live credentials into a skill prompt and verify any commands/configs in a safe test environment (or snapshot) before applying to production data. If you need automated actions (scripts, installers) prefer vetted packages or vendor tools rather than copying commands verbatim from an unverified source.

Quick Reference

Topic	File
Backup strategy, 3-2-1 rule	backup.md
Remote access, VPN, security	security.md
Docker, home lab, apps	apps.md
Media server, indexing	media.md

Scope

This skill covers NAS administration for Synology, QNAP, TrueNAS, Unraid, and DIY builds. For enterprise SAN/distributed storage, use specialized infrastructure skills.

Critical Rules

1. RAID is not backup — RAID protects against drive failure, not ransomware, fire, or accidental deletion. Always maintain off-site backup.

2. 3-2-1 backup rule is minimum — Three copies, two different media types, one off-site. Cloud sync to B2/S3/Glacier counts as off-site.

3. SMB for Windows/Mac, NFS for Linux — Wrong protocol = permission chaos. AFP deprecated. Enable only protocols you actually use.

4. Expose ZERO ports to internet — No DSM/QTS admin on public IP. Use VPN (WireGuard/Tailscale) or reverse proxy with auth.

5. Test your backups quarterly — Untested backup is not a backup. Actually restore files to verify integrity.

6. Disable admin account — Create named admin accounts. Default "admin" is first target for brute force.

7. UPS mandatory — Power loss during write = corrupted pool. Budget for battery backup that signals clean shutdown.

8. Snapshots are not backup — Same disks, same failure domain. Snapshots help with accidental delete, not disaster.

9. Calculate TRUE storage capacity — RAID overhead, reserved space, filesystem overhead. 4x8TB drives ≠ 32TB usable.

10. ARM NAS = limited Docker — Synology J-series, low-end QNAP run ARM. Many Docker images x86 only. Verify before buying.