How do I install the Vps Audit skill?

Run npx skillmds@latest add aibot88/vps-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Vps Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Vps Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Vps Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Vps Audit?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Vps Audit by aibot88 — Agent Skill

Name: Vps Audit
Rating: 4.2 (5 reviews)
Author: aibot88

Vps Audit

Deep audit of a remote VPS running Docker, Coolify, and Traefik. Use when the user wants to check what containers are running, inspect Coolify services, review Traefik routes, check disk/memory, review firewall rules, or get an eagle-eye view of their production server. Triggers on phrases like "audit the vps", "what's running on the server", "check production", "how's the vps doing", "what containers are up", or "check coolify".

aibot88 Updated Sep 9, 2026 3 repo stars

File contents

VPS Audit

All data collection runs in parallel via scripts/collect-vps.sh — SSH queries fire simultaneously. Your job is to synthesize the structured output. Do not re-run SSH commands yourself.

Setup: Add a vps alias to ~/.ssh/config pointing to your server, or edit scripts/collect-vps.sh to change the SSH target.

Step 1 — Collect

~/.claude/commands/vps-audit/scripts/collect-vps.sh

Step 2 — Synthesize

Container names in the output have Coolify UUID suffixes stripped already.

System Identity

From SYSTEM: hostname, OS, kernel, uptime, load average. From RECENT_LOGINS: flag any unfamiliar login sources.

Hardware / Resources

From RESOURCES: CPU model/cores, RAM total/used/available, disk used/total on /, swap pressure.

Docker Containers

From CONTAINERS and CONTAINER_STATS. Group containers by project (infer from container name prefixes).

For each container: status (healthy / unhealthy / up N days), CPU%, memory, exposed ports.

Flag any container that is: unhealthy, exited/stopped, >10% CPU sustained, >500MB memory.

Traefik Routing Table

From TRAEFIK_ROUTES — present as a table:

Domain	Upstream	TLS

Docker Storage

From DOCKER_STORAGE: images / containers / volumes / build cache totals. From VOLUMES dangling section: list any orphaned volumes explicitly.

Systemd Services (non-Docker)

From SYSTEMD_SERVICES: note status of key services — tailscaled, fail2ban, docker, containerd, cron, sshd. Flag any that are absent or failing.

Network & Firewall

From LISTEN_PORTS and FIREWALL, categorize by bind address:

Public (0.0.0.0): which ports and what serves them
Private/VPN (Tailscale or private IP): which ports
Loopback (127.0.0.1): internal-only

Tailscale

From TAILSCALE: server Tailscale IP, which devices are online.

Users & SSH

From FS_DIRS passwd lines: users with shell access. Flag any unfamiliar login source in RECENT_LOGINS.

Flags / Concerns

Unhealthy or stopped containers
Dangling volumes (list them)
Swap usage >50%
Disk >80% used
Public port that should be VPN-only
Unfamiliar logins
fail2ban or tailscaled not running

Keep the report dense. Flag anything that needs action.

---name: vps-auditdescription: Deep audit of a remote VPS running Docker, Coolify, and Traefik. Use when the user wants to check what containers are running, inspect Coolify services, review Traefik routes, check disk/memory, review firewall rules, or get an eagle-eye view of their production server. Triggers on phrases like "audit the vps", "what's running on the server", "check production", "how's the vps doing", "what containers are up", or "check coolify".--- # VPS Audit All data collection runs in parallel via `scripts/collect-vps.sh` — SSH queries fire simultaneously. Your job is to synthesize the structured output. Do not re-run SSH commands yourself. **Setup:** Add a `vps` alias to `~/.ssh/config` pointing to your server, or edit `scripts/collect-vps.sh` to change the SSH target. ## Step 1 — Collect ```bash ~/.claude/commands/vps-audit/scripts/collect-vps.sh ``` ## Step 2 — Synthesize Container names in the output have Coolify UUID suffixes stripped already. --- ### System Identity From SYSTEM: hostname, OS, kernel, uptime, load average. From RECENT_LOGINS: flag any unfamiliar login sources. ### Hardware / Resources From RESOURCES: CPU model/cores, RAM total/used/available, disk used/total on `/`, swap pressure. ### Docker Containers From CONTAINERS and CONTAINER_STATS. Group containers by project (infer from container name prefixes). For each container: status (healthy / unhealthy / up N days), CPU%, memory, exposed ports. Flag any container that is: unhealthy, exited/stopped, >10% CPU sustained, >500MB memory. ### Traefik Routing Table From TRAEFIK_ROUTES — present as a table: | Domain | Upstream | TLS | |--------|----------|-----| ### Docker Storage From DOCKER_STORAGE: images / containers / volumes / build cache totals. From VOLUMES dangling section: list any orphaned volumes explicitly. ### Systemd Services (non-Docker) From SYSTEMD_SERVICES: note status of key services — tailscaled, fail2ban, docker, containerd, cron, sshd. Flag any that are absent or failing. ### Network & Firewall From LISTEN_PORTS and FIREWALL, categorize by bind address: - **Public** (0.0.0.0): which ports and what serves them - **Private/VPN** (Tailscale or private IP): which ports - **Loopback** (127.0.0.1): internal-only ### Tailscale From TAILSCALE: server Tailscale IP, which devices are online. ### Users & SSH From FS_DIRS passwd lines: users with shell access. Flag any unfamiliar login source in RECENT_LOGINS. ### Flags / Concerns - Unhealthy or stopped containers - Dangling volumes (list them) - Swap usage >50% - Disk >80% used - Public port that should be VPN-only - Unfamiliar logins - fail2ban or tailscaled not running Keep the report dense. Flag anything that needs action.

Frequently asked questions