girste/chihuaudit/skill

Chihuaudit Claude Skill - Complete System Audit

Skill Type: Autonomous system security and health audit with zero user interaction required.

Compatibility: Tested with Claude Sonnet 4.5, Opus 4.5, and Haiku 4.5 models.

Purpose

Execute a comprehensive, read-only Linux system audit that replicates the functionality of the Chihuaudit binary tool through native shell commands. This skill enables Claude to perform professional-grade infrastructure assessments without requiring any binary installation or dependencies.

Key Features:

• 🔒 100% Read-Only - Zero system modifications, completely safe for production
• ⚡ Parallel Execution - Optimized batch commands for sub-60-second completion
• 🎯 Precise Detection - Intelligent command existence checks and graceful degradation
• 📊 Structured Output - Clear categorization with visual indicators (✅ ⚠️ ❌)
• 🔄 Consistent Results - Battle-tested across 1+ years of production use

What it checks

🔒 Security (Basic)

• Firewall status and rules (ufw/iptables)
• SSH configuration (port, auth methods, allowed users)
• Fail2ban status and active jails
• TLS/SSL certificates (Let's Encrypt, Caddy, Certbot)
• User accounts with shell access
• Recent authentication logs and failed logins
• Open ports and listening services

🔐 Security (Deep Dive)

• Listening services accessible from outside vs localhost-only
• Unusual listening ports (non-standard services)
• Users with UID 0 (root equivalent accounts)
• World-writable files in critical directories (/etc, /usr/bin, /usr/sbin)
• Failed SSH attempts in last 24 hours
• SUID/SGID binaries count
• Recent modifications to /etc files
• Active external network connections
• Process ownership and elevated privileges
• Detailed fail2ban jail statistics

🚀 Services

• All running systemd services
• Services enabled for auto-start
• Auto-restart configuration (Restart= policies)
• Failed services
• Service status for critical components:
• Web servers (nginx/apache/caddy)
• Databases (postgres/mysql/mariadb)
• Application servers (gunicorn/uwsgi/node)
• PHP-FPM
• Docker
• SSH
• Monitoring tools

💻 Resources

• CPU load (1/5/15 min averages)
• Memory usage (RAM + swap)
• Disk space usage
• System uptime
• Top memory-consuming processes
• Large recent log files (>10MB)

💾 Storage Health

• SMART status of physical disks
• Inode usage (can fill up independently of disk space)
• I/O statistics and wait times
• Filesystem errors from kernel logs
• Mount point health

🗄️ Database Health (PostgreSQL)

• List of databases with sizes
• Active connections per database
• Slow/blocked queries
• Connection count and limits
• Vacuum/analyze statistics
• WAL and replication status

🐳 Docker Containers

• Running and stopped containers
• Resource usage per container (CPU, memory, network)
• Container health checks
• Docker volumes usage
• Images list with sizes and age
• Orphaned or dangling resources

🔍 Configuration

• Listening ports summary
• Active network connections by state
• Scheduled tasks (cron, systemd timers)
• Recent system reboots
• Kernel version
• Pending security updates

🔧 System Tuning

• NTP/time synchronization status
• File descriptor limits (current and max)
• Open file handles
• Kernel parameters (sysctl):
• TCP syn backlog
• Socket connection queue
• Local port range
• Swappiness
• Network tuning parameters

📝 Logs & Monitoring

• Recent critical errors in syslog
• SSH authentication attempts
• Service restart history
• Backup status (if backup dirs found)
• Application-specific errors:
• Caddy errors
• PostgreSQL errors
• Systemd errors
• Error rates and patterns

🌐 Network & Connectivity

• DNS resolution speed test
• Latency tests to external hosts (8.8.8.8)
• Packet loss detection
• Network interfaces status (up/down, IPs)
• Routing table
• Network statistics summary
• Bandwidth usage (RX/TX)
• Connection states breakdown (ESTABLISHED, SYN-RECV, LISTEN)
• Top connected IPs
• Network interface I/O statistics

🎯 Application-Specific Health

• Gunicorn workers status and memory
• FileBrowser service status and HTTP health
• Caddy configuration validation
• Caddy admin API accessibility
• SSL certificate expiry dates (via openssl)
• Reverse proxy health checks
• Application response codes

📦 Backup & Disaster Recovery

• Backup directories existence
• Recent backup files (SQL dumps, tar archives)
• Last backup timestamp
• Backup size and trends
• Cron job backup schedules
• Remote storage connections (SFTP, S3, etc.)

⏰ Scheduled Tasks

• Root and user crontabs
• Systemd timers (active and inactive)
• Recent timer executions
• Timer logs and failures
• Next scheduled run times

Prerequisites

Required:

• Linux system with systemd (Ubuntu 20.04+, Debian 11+, RHEL 8+, CentOS 7+)
• Sudo access with NOPASSWD configured (for accessing protected system files)
• Claude Desktop or API with shell execution capabilities enabled
• Bash shell (v4.0+)

Sudo NOPASSWD Setup (required for automated execution):

# Add to /etc/sudoers.d/claude-audit
your_username ALL=(ALL) NOPASSWD: /usr/bin/systemctl, /usr/bin/journalctl, /usr/bin/ufw, /usr/sbin/iptables, /usr/bin/docker, /usr/bin/find, /bin/cat /etc/ssh/sshd_config, /usr/bin/fail2ban-client

Or for full sudo access (use with caution):

your_username ALL=(ALL) NOPASSWD: ALL

Usage Instructions for Claude

For Claude: When a user requests a system audit or mentions "chihuaudit", "system checkup", "security audit", or similar terms:

1. Acknowledge the audit request and inform the user about execution time (~30-90s)
2. Execute the commands in parallel batches using bash tool with appropriate initial_wait values
3. Parse the output and structure it into clear sections with visual indicators
4. Analyze the results and provide actionable insights with priority levels
5. Summarize critical findings at the end with specific remediation steps

Quick Start Examples

User request: "Run a chihuaudit system audit" User request: "Perform a security and health checkup" User request: "Check my server's status" User request: "Run the chihuaudit skill"

Execution Modes

Basic Audit (recommended for first run):

• Covers: Security, Services, Resources, Configuration
• Duration: ~30 seconds
• Command batches: 1-3

Full Deep Dive (comprehensive):

• Covers: All categories + Database, Docker, Storage, Network, Backups
• Duration: ~60-90 seconds
• Command batches: 1-6
• Use when: Issues detected in basic audit, or user explicitly requests "full" or "deep dive"

Output Format

The comprehensive report includes:

Basic Audit

1. Executive Summary - Quick health overview with uptime and overall status
2. Security Status - Firewall, SSH, fail2ban, certificates
3. Service Health - Running/failed services, auto-restart config
4. System Resources - CPU, RAM, disk usage with percentages
5. Recommendations - Prioritized improvements or concerns

Full Deep Dive (Advanced)

1. Backup & Disaster Recovery - Backup status, schedules, last run times
2. Database Health - Connection counts, database sizes, slow queries, vacuum status
3. Docker Containers - Running containers, resource usage, volumes, images
4. Storage Health - SMART status, inode usage, I/O wait, filesystem errors
5. Application Logs - Recent errors from all services with timestamps
6. Scheduled Tasks - All cron jobs and systemd timers with next run times
7. System Tuning - File descriptors, sysctl parameters, NTP sync
8. Security Deep Dive:

• Exposed vs internal services
• Unusual ports and connections
• Root-equivalent users
• SUID/SGID binaries
• Recent /etc modifications
• Failed login attempts
• Active external connections with process mapping

1. Network & Connectivity:

• DNS resolution speed
• Latency and packet loss tests
• Interface statistics (RX/TX bytes)
• Connection state breakdown
• Top connected IPs
• Routing table

1. Application-Specific Health:

• Gunicorn workers and memory usage
• FileBrowser HTTP health check
• Caddy config validation
• SSL certificate expiry dates
• Application response status

Requirements

Essential

• Linux system with systemd
• Root/sudo access for reading protected files
• Basic tools: ss, systemctl, grep, ps, df, free

Optional (for advanced checks)

• ufw or iptables - Firewall status
• fail2ban - Intrusion prevention stats
• smartctl (smartmontools) - Disk SMART health
• iostat (sysstat) - I/O statistics
• docker - Container inspection
• psql - PostgreSQL health checks
• certbot or Caddy - SSL certificate management
• timedatectl - Time synchronization
• openssl - Certificate validation
• whois - IP investigation
• curl - HTTP health checks

Execution Strategy for Claude

Optimized Command Batching

Execute checks in parallel batches using bash tool with mode="sync" and appropriate initial_wait values. Chain multiple commands with && for efficiency.

Batch 1 - System Overview & Security Basics (initial_wait: 30):

sudo bash -c '
echo "=== SYSTEM INFO ===";
echo "Hostname: $(hostname)";
echo "OS: $(cat /etc/os-release | grep PRETTY_NAME | cut -d= -f2 | tr -d \")";
echo "Kernel: $(uname -r)";
echo "Uptime: $(uptime -p)";
echo "";
echo "=== SECURITY ===";
echo "Firewall: $(sudo ufw status 2>/dev/null | grep Status | cut -d: -f2 | xargs || echo "unknown")";
echo "SSH Port: $(grep "^Port" /etc/ssh/sshd_config 2>/dev/null || echo "22 (default)")";
echo "SSH Password Auth: $(grep "^PasswordAuthentication" /etc/ssh/sshd_config 2>/dev/null | awk "{print \$2}" || echo "unknown")";
echo "SSH Root Login: $(grep "^PermitRootLogin" /etc/ssh/sshd_config 2>/dev/null | awk "{print \$2}" || echo "unknown")";
'

Batch 2 - Services & Resources (initial_wait: 20):

sudo bash -c '
echo "=== SERVICES ===";
echo "Running: $(systemctl list-units --type=service --state=running --no-pager --no-legend | wc -l)";
echo "Failed: $(systemctl list-units --type=service --state=failed --no-pager --no-legend | wc -l)";
systemctl is-active --quiet nginx && echo "Nginx: active" || true;
systemctl is-active --quiet caddy && echo "Caddy: active" || true;
systemctl is-active --quiet postgresql && echo "PostgreSQL: active" || true;
systemctl is-active --quiet docker && echo "Docker: active" || true;
echo "";
echo "=== RESOURCES ===";
echo "CPU Load: $(uptime | awk -F\"load average:\" \"{print \\\$2}\" | xargs)";
echo "Memory: $(free -h | awk \"/^Mem:/ {print \\\$3\\\"/\\\"\\\$2}\")";
echo "Disk: $(df -h / | awk \"NR==2 {print \\\$3\\\"/\\\"\\\$2\\\" (\\\"\\\$5\\\" used)}\")";
'

Batch 3 - Ports & Network (initial_wait: 20):

sudo bash -c '
echo "=== NETWORK ===";
echo "Listening Ports: $(ss -tuln 2>/dev/null | grep LISTEN | wc -l)";
echo "Established Connections: $(ss -tn state established 2>/dev/null | tail -n +2 | wc -l)";
echo "External Ports: $(ss -tuln 2>/dev/null | grep \"0.0.0.0:\" | awk \"{print \\\$5}\" | cut -d: -f2 | sort -nu | tr \"\\n\" \",\" | sed \"s/,$//\")";
echo "Localhost Ports: $(ss -tuln 2>/dev/null | grep \"127.0.0.1:\" | awk \"{print \\\$5}\" | cut -d: -f2 | sort -nu | tr \"\\n\" \",\" | sed \"s/,$//\")";
'