# Security Auditor

> Use when the user wants to check system security posture, find misconfigurations, audit permissions, or verify hardening. Checks common security issues across platforms.

- Skill: `skyvanguard/security-auditor` (Agent Skill)
- Install (CLI): `npx skillmds@latest add skyvanguard/security-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/skyvanguard/security-auditor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: skyvanguard (https://skillmd.com/u/skyvanguard)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/skyvanguard/security-auditor

---


# Security Auditor

## Overview

Audit system security configuration by checking for common misconfigurations, exposed services, weak permissions, and missing patches. Produces a security posture report with severity ratings.

## Process

### Step 1: Scope the Audit

Determine what to audit based on user request:

| Scope | What to check |
|-------|---------------|
| Full system | All categories below |
| Network exposure | Open ports, listening services, firewall |
| User/permissions | Accounts, sudo, file permissions |
| Updates/patches | Missing security updates |
| Services | Running services, unnecessary daemons |
| SSH/Remote | SSH config, remote access |
| File system | World-writable, SUID, sensitive files |

### Step 2: Open Ports and Services

**Listening services:**
| Platform | Command |
|----------|---------|
| Windows | `Get-NetTCPConnection -State Listen \| Select LocalAddress, LocalPort, @{N='Process';E={(Get-Process -Id $_.OwningProcess).Name}} \| Sort LocalPort` |
| Linux | `ss -tlnp` |
| macOS | `lsof -iTCP -sTCP:LISTEN -n -P` |

**Firewall status:**
| Platform | Command |
|----------|---------|
| Windows | `Get-NetFirewallProfile \| Select Name, Enabled` |
| Linux | `ufw status 2>/dev/null \|\| iptables -L -n 2>/dev/null \|\| firewall-cmd --state 2>/dev/null` |
| macOS | `pfctl -s info 2>/dev/null \| head -5` |

**External exposure check:**
```bash
# Check if common dangerous ports are exposed
# 21 (FTP), 23 (Telnet), 3389 (RDP), 5900 (VNC), 6379 (Redis), 27017 (MongoDB)
```

### Step 3: User Accounts and Privileges

**User accounts:**
| Platform | Command |
|----------|---------|
| Windows | `Get-LocalUser \| Select Name, Enabled, LastLogon, PasswordRequired` |
| Linux | `awk -F: '$3 >= 1000 || $3 == 0 {print $1, $3, $7}' /etc/passwd` |
| macOS | `dscl . list /Users UniqueID \| awk '$2 >= 500 || $2 == 0'` |

**Privileged access:**
| Platform | Command |
|----------|---------|
| Windows | `Get-LocalGroupMember -Group "Administrators"` |
| Linux | `getent group sudo wheel 2>/dev/null` and `cat /etc/sudoers.d/* 2>/dev/null \| grep -v "^#"` |
| macOS | `dscl . -read /Groups/admin GroupMembership` |

**Password policy:**
| Platform | Command |
|----------|---------|
| Windows | `Get-ADDefaultDomainPasswordPolicy 2>/dev/null \|\| net accounts` |
| Linux | `cat /etc/login.defs \| grep -E "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_MIN_LEN"` |

### Step 4: SSH Configuration (Linux/macOS)

```bash
# SSH config issues
grep -E "^(PermitRootLogin|PasswordAuthentication|PermitEmptyPasswords|X11Forwarding|Protocol)" /etc/ssh/sshd_config 2>/dev/null

# Authorized keys (check for unexpected)
find /home -name "authorized_keys" -exec wc -l {} \; 2>/dev/null
cat ~/.ssh/authorized_keys 2>/dev/null | wc -l
```

**Security checks:**
| Setting | Secure Value | Risk if Wrong |
|---------|-------------|---------------|
| PermitRootLogin | no | Direct root access |
| PasswordAuthentication | no | Brute force attacks |
| PermitEmptyPasswords | no | No-password login |
| Protocol | 2 | Weak protocol |

### Step 5: System Updates

**Pending security updates:**
| Platform | Command |
|----------|---------|
| Windows | `Get-HotFix \| Sort-Object InstalledOn -Descending \| Select -First 5` |
| Ubuntu/Debian | `apt list --upgradable 2>/dev/null \| grep -i securi` |
| RHEL/CentOS | `yum check-update --security 2>/dev/null \|\| dnf check-update --security 2>/dev/null` |
| macOS | `softwareupdate -l 2>&1` |

**Last update date:**
| Platform | Command |
|----------|---------|
| Windows | `(Get-HotFix \| Sort InstalledOn -Desc \| Select -First 1).InstalledOn` |
| Linux | `stat /var/cache/apt/pkgcache.bin 2>/dev/null \|\| rpm -qa --last \| head -1` |

### Step 6: File System Security

**World-writable files (Linux/macOS):**
```bash
find / -type f -perm -o+w -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null | head -20
```

**SUID/SGID binaries (Linux/macOS):**
```bash
find / -type f \( -perm -4000 -o -perm -2000 \) -not -path "/proc/*" 2>/dev/null | head -20
```

**Sensitive file permissions:**
```bash
# Check critical file permissions
ls -la /etc/shadow /etc/passwd /etc/sudoers ~/.ssh/id_* 2>/dev/null
```

**Windows sensitive locations:**
```powershell
# Check for credentials in common locations
Get-ChildItem -Path $env:USERPROFILE -Include *.pem,*.key,*.pfx,id_rsa -Recurse -ErrorAction SilentlyContinue | Select FullName
```

### Step 7: Running Services Audit

**Unnecessary services check:**
| Platform | Command |
|----------|---------|
| Windows | `Get-Service \| Where-Object {$_.Status -eq 'Running'} \| Select Name, DisplayName \| Sort DisplayName` |
| Linux | `systemctl list-units --type=service --state=running` |

**Common risky services to flag:**
| Service | Risk | Recommendation |
|---------|------|----------------|
| telnet | HIGH | Replace with SSH |
| ftp | HIGH | Replace with SFTP |
| rsh/rlogin | HIGH | Remove immediately |
| unbound Redis | HIGH | Add auth, bind localhost |
| unbound MongoDB | HIGH | Add auth, bind localhost |
| SMBv1 | MEDIUM | Disable, use SMBv2+ |
| SNMP v1/v2 | MEDIUM | Upgrade to v3 |

### Step 8: Present Security Report

```
## Security Audit Report
**Host:** [hostname] | **OS:** [os] | **Date:** [timestamp]

### Security Score: [X/10]

### Findings by Severity

#### CRITICAL
- [ ] [finding with evidence]

#### HIGH
- [ ] [finding with evidence]

#### MEDIUM
- [ ] [finding with evidence]

#### LOW / Informational
- [ ] [finding]

### Summary
| Category | Status | Issues |
|----------|--------|--------|
| Network Exposure | [PASS/WARN/FAIL] | [count] |
| User Accounts | [PASS/WARN/FAIL] | [count] |
| SSH Config | [PASS/WARN/FAIL] | [count] |
| Updates | [PASS/WARN/FAIL] | [count] |
| File Permissions | [PASS/WARN/FAIL] | [count] |
| Services | [PASS/WARN/FAIL] | [count] |

### Remediation Priority
1. [Critical items first]
2. [High items]
3. [Medium items]
```

## Rules

- NEVER attempt to exploit any vulnerability found
- NEVER modify security settings without explicit user permission
- NEVER access or display password hashes or private keys content
- Report findings objectively with evidence
- Flag false positives when context suggests they're intentional (e.g., dev machine)
- If audit requires elevated privileges, ask user to run specific commands
- Do NOT install scanning tools; use only built-in OS commands