# Adaptive Enforcement Lab Claude Skills Self Hosted Runner Hardening > Self-Hosted Runner Hardening - Skill: `tomevault-io/adaptive-enforcement-lab-claude-skills-self-hosted-runner-ha` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/adaptive-enforcement-lab-claude-skills-self-hosted-runner-ha` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/adaptive-enforcement-lab-claude-skills-self-hosted-runner-ha/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/adaptive-enforcement-lab-claude-skills-self-hosted-runner-ha --- # Self-Hosted Runner Hardening ## When to Use This Skill Hardening is not optional. Every layer of defense you skip is an attack vector you gift to adversaries. Deploy runners defensively or accept the breach. > **The Default Is Insecure** > > > A default runner installation has root access, unrestricted network, cloud metadata endpoints, persistent filesystem, and ambient credentials. One malicious workflow means full infrastructure compromise. Apply every hardening layer. ## Implementation See the full implementation guide in the [source documentation](https://adaptive-enforcement-lab.com/secure/github-actions-security/). ## Examples See [examples.md](examples.md) for code examples. ## Full Reference See [reference.md](reference.md) for complete documentation. ## References - [Source Documentation](https://adaptive-enforcement-lab.com/secure/github-actions-security/) - [AEL Secure](https://adaptive-enforcement-lab.com/secure/) --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/adaptive-enforcement-lab) — claim your Tome and manage your conversions.