# Hermes Security Audit

> Free security audit for Linux servers — no API keys, no paid tools. Scans for viruses (ClamAV), rootkits (rkhunter + chkrootkit), SSH brute force, crypto miners, exposed credentials, and open ports. 12 detection methods, proven on production (11,000+ attacks found and blocked). Use when the user asks to audit or harden a Linux server, check for malware/rootkits/crypto miners, scan open ports, or detect SSH brute force — "security audit", "check for malware".

- Skill: `axelfreeman/hermes-security-audit` (Agent Skill, multi-file: 8 files)
- Install (CLI): `npx skillmds@latest add axelfreeman/hermes-security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/axelfreeman/hermes-security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: axelfreeman (https://skillmd.com/u/axelfreeman)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/axelfreeman/hermes-security-audit

---


# 🔒 Hermes Agent Security Audit — AI Agent Antivirus & Vulnerability Scanner

**Free. Open-source.** No API keys, no paid tools, no Docker. 12 battle-tested security checks for Linux servers running AI agents.

## When to Use

- The user asks to audit or harden a Linux server.
- Checking for malware, rootkits, crypto miners, or SSH brute force.
- After installing new tools or Docker containers.
- When CPU or memory usage looks unusual.
- Before exposing the agent to external platforms (Telegram, Discord).

## The 12 checks

1. **Open ports** — find hidden services (CUPS 631, SMTP 25, Zabbix 10050).
2. **Process audit** — spot crypto miners (xmrig, stratum) and orphaned proxies.
3. **SSH brute force** — count failed auth attempts, identify attacker IPs.
4. **SUID/SGID files** — privilege-escalation vectors.
5. **Cron jobs** — hidden miners and persistence across all users.
6. **Docker audit** — privileged containers, host network, unexpected images.
7. **chkrootkit** — signature-based rootkit scan.
8. **rkhunter** — behavioral rootkit + backdoor scan.
9. **ClamAV** — full antivirus over /tmp, /opt, /root.
10. **Lynis** — hardening score (0–100).
11. **Exposed credentials** — API keys, tokens, private keys in plain sight.
12. **Network connections** — who's calling home.

The exact commands for each method live in `AGENTS.md`.

## Procedure

1. Run the 12 checks in order.
2. Classify each finding by severity (critical / high / medium / low).
3. Apply safe fixes where automated (fail2ban, disable services, relocate keys).
4. Report results with severity, flagging known false positives.

## Pitfalls

- chkrootkit false-positives on modern kernels (`basename`, `date`, `dirname`) — expected, don't alarm.
- rkhunter flags snap users and hidden config files — benign.
- Never run destructive commands without user confirmation.

## Verification

- Each of the 12 checks produced a result.
- Findings are classified by severity and fixed or flagged.
- The final report lists what changed (ports closed, services disabled, keys moved).