# Seatbelt

> Use for Windows host situational awareness and security posture enumeration during authorized pentests. Trigger on approved Windows host review, local configuration inspection, and identifying material privilege or credential exposure on a specific system.

- Skill: `timsonner/seatbelt` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/seatbelt`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/seatbelt/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/seatbelt

---


# Seatbelt

## Purpose

Use this skill for targeted Windows host posture enumeration when the engagement includes approved access to a specific system.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need structured situational awareness of Windows security-relevant settings.
- Need to support privilege, credential, or hardening analysis on a host.
- Need a repeatable host-local retest after remediation.

## Avoid When

- Host-local enumeration is not explicitly approved.
- Broad collection would exceed the current phase objective.

## Inputs

- Approved Windows host and user context
- Output handling requirements
- Specific posture question or host review goal

## Procedure

1. Run only within the approved host scope.
2. Focus on posture areas relevant to the current hypothesis.
3. Correlate material findings with privilege or credential exposure.
4. Record the exact host and collection scope used.
5. Preserve the same scope for retest.

## Command Syntax

Replace sample paths with the approved local binary path.

```cmd
:: Run all checks
Seatbelt.exe -group=all

:: User-focused checks
Seatbelt.exe -group=user

:: System-focused checks
Seatbelt.exe -group=system

:: Run specific individual checks
Seatbelt.exe DotNet PowerShell Env

:: Quiet mode, all checks, output to file
Seatbelt.exe -q -group=all > C:\temp\seatbelt_output.txt

:: Remote system check
Seatbelt.exe -computername=10.10.10.100 -username=contoso\auditor -password='<password>' -group=system
```

## Evidence to Capture

- Host posture issues that materially affect risk
- Exact host, user context, and collection scope used
- Minimal proof path needed for remediation

## Safety Boundaries

- Use only on approved hosts.
- Keep collection aligned to the current hypothesis and protect host evidence.