[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F3ZPWKBVXB4CTF22PTR21Y":3,"skill-same:01M6F3ZPWKBVXB4CTF22PTR21Y":50},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":23,"linkOnly":24,"markdownContent":25,"markdownBody":25,"frontMatter":26,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":32,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M6F3ZPWKBVXB4CTF22PTR21Y","healthcheck",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",66,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FelizaOS\u002Feliza\u002Fhealthcheck\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[5],"2026-11-10 10:12:30",false,"# Otto Host Hardening\n\n## Overview\n\nAssess and harden the host running Otto, then align it to a user-defined risk tolerance without breaking access. Use Otto security tooling as a first-class signal, but treat OS hardening as a separate, explicit set of steps.\n\n## Core rules\n\n- Recommend running this skill with a state-of-the-art model (e.g., Opus 4.5, GPT 5.2+). The agent should self-check the current model and suggest switching if below that level; do not block execution.\n- Require explicit approval before any state-changing action.\n- Do not modify remote access settings without confirming how the user connects.\n- Prefer reversible, staged changes with a rollback plan.\n- Never claim Otto changes the host firewall, SSH, or OS updates; it does not.\n- If role\u002Fidentity is unknown, provide recommendations only.\n- Formatting: every set of user choices must be numbered so the user can reply with a single digit.\n- System-level backups are recommended; try to verify status.\n\n## Workflow (follow in order)\n\n### 0) Model self-check (non-blocking)\n\nBefore starting, check the current model. If it is below state-of-the-art (e.g., Opus 4.5, GPT 5.2+), recommend switching. Do not block execution.\n\n### 1) Establish context (read-only)\n\nTry to infer 1–5 from the environment before asking. Prefer simple, non-technical questions if you need confirmation.\n\nDetermine (in order):\n\n1. OS and version (Linux\u002FmacOS\u002FWindows), container vs host.\n2. Privilege level (root\u002Fadmin vs user).\n3. Access path (local console, SSH, RDP, tailnet).\n4. Network exposure (public IP, reverse proxy, tunnel).\n5. Otto gateway status and bind address.\n6. Backup system and status (e.g., Time Machine, system images, snapshots).\n7. Deployment context (local mac app, headless gateway host, remote gateway, container\u002FCI).\n8. Disk encryption status (FileVault\u002FLUKS\u002FBitLocker).\n9. OS automatic security updates status.\n   Note: these are not blocking items, but are highly recommended, especially if Otto can access sensitive data.\n10. Usage mode for a personal assistant with full access (local workstation vs headless\u002Fremote vs other).\n\nFirst ask once for permission to run read-only checks. If granted, run them by default and only ask questions for items you cannot infer or verify. Do not ask for information already visible in runtime or command output. Keep the permission ask as a single sentence, and list follow-up info needed as an unordered list (not numbered) unless you are presenting selectable choices.\n\nIf you must ask, use non-technical prompts:\n\n- “Are you using a Mac, Windows PC, or Linux?”\n- “Are you logged in directly on the machine, or connecting from another computer?”\n- “Is this machine reachable from the public internet, or only on your home\u002Fnetwork?”\n- “Do you have backups enabled (e.g., Time Machine), and are they current?”\n- “Is disk encryption turned on (FileVault\u002FBitLocker\u002FLUKS)?”\n- “Are automatic security updates enabled?”\n- “How do you use this machine?”\n  Examples:\n  - Personal machine shared with the assistant\n  - Dedicated local machine for the assistant\n  - Dedicated remote machine\u002Fserver accessed remotely (always on)\n  - Something else?\n\nOnly ask for the risk profile after system context is known.\n\nIf the user grants read-only permission, run the OS-appropriate checks by default. If not, offer them (numbered). Examples:\n\n1. OS: `uname -a`, `sw_vers`, `cat \u002Fetc\u002Fos-release`.\n2. Listening ports:\n   - Linux: `ss -ltnup` (or `ss -ltnp` if `-u` unsupported).\n   - macOS: `lsof -nP -iTCP -sTCP:LISTEN`.\n3. Firewall status:\n   - Linux: `ufw status`, `firewall-cmd --state`, `nft list ruleset` (pick what is installed).\n   - macOS: `\u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --getglobalstate` and `pfctl -s info`.\n4. Backups (macOS): `tmutil status` (if Time Machine is used).\n\n### 2) Run Otto security audits (read-only)\n\nAs part of the default read-only checks, run `otto security audit --deep`. Only offer alternatives if the user requests them:\n\n1. `otto security audit` (faster, non-probing)\n2. `otto security audit --json` (structured output)\n\nOffer to apply Otto safe defaults (numbered):\n\n1. `otto security audit --fix`\n\nBe explicit that `--fix` only tightens Otto defaults and file permissions. It does not change host firewall, SSH, or OS update policies.\n\nIf browser control is enabled, recommend that 2FA be enabled on all important accounts, with hardware keys preferred and SMS not sufficient.\n\n### 3) Check Otto version\u002Fupdate status (read-only)\n\nAs part of the default read-only checks, run `otto update status`.\n\nReport the current channel and whether an update is available.\n\n### 4) Determine risk tolerance (after system context)\n\nAsk the user to pick or confirm a risk posture and any required open services\u002Fports (numbered choices below).\nDo not pigeonhole into fixed profiles; if the user prefers, capture requirements instead of choosing a profile.\nOffer suggested profiles as optional defaults (numbered). Note that most users pick Home\u002FWorkstation Balanced:\n\n1. Home\u002FWorkstation Balanced (most common): firewall on with reasonable defaults, remote access restricted to LAN or tailnet.\n2. VPS Hardened: deny-by-default inbound firewall, minimal open ports, key-only SSH, no root login, automatic security updates.\n3. Developer Convenience: more local services allowed, explicit exposure warnings, still audited.\n4. Custom: user-defined constraints (services, exposure, update cadence, access methods).\n\n### 5) Produce a remediation plan\n\nProvide a plan that includes:\n\n- Target profile\n- Current posture summary\n- Gaps vs target\n- Step-by-step remediation with exact commands\n- Access-preservation strategy and rollback\n- Risks and potential lockout scenarios\n- Least-privilege notes (e.g., avoid admin usage, tighten ownership\u002Fpermissions where safe)\n- Credential hygiene notes (location of Otto creds, prefer disk encryption)\n\nAlways show the plan before any changes.\n\n### 6) Offer execution options\n\nOffer one of these choices (numbered so users can reply with a single digit):\n\n1. Do it for me (guided, step-by-step approvals)\n2. Show plan only\n3. Fix only critical issues\n4. Export commands for later\n\n### 7) Execute with confirmations\n\nFor each step:\n\n- Show the exact command\n- Explain impact and rollback\n- Confirm access will remain available\n- Stop on unexpected output and ask for guidance\n\n### 8) Verify and report\n\nRe-check:\n\n- Firewall status\n- Listening ports\n- Remote access still works\n- Otto security audit (re-run)\n\nDeliver a final posture report and note any deferred items.\n\n## Required confirmations (always)\n\nRequire explicit approval for:\n\n- Firewall rule changes\n- Opening\u002Fclosing ports\n- SSH\u002FRDP configuration changes\n- Installing\u002Fremoving packages\n- Enabling\u002Fdisabling services\n- User\u002Fgroup modifications\n- Scheduling tasks or startup persistence\n- Update policy changes\n- Access to sensitive files or credentials\n\nIf unsure, ask.\n\n## Periodic checks\n\nAfter Otto install or first hardening pass, run at least one baseline audit and version check:\n\n- `otto security audit`\n- `otto security audit --deep`\n- `otto update status`\n\nOngoing monitoring is recommended. Use the Otto cron tool\u002FCLI to schedule periodic audits (Gateway scheduler). Do not create scheduled tasks without explicit approval. Store outputs in a user-approved location and avoid secrets in logs.\nWhen scheduling headless cron runs, include a note in the output that instructs the user to call `healthcheck` so issues can be fixed.\n\n### Required prompt to schedule (always)\n\nAfter any audit or hardening pass, explicitly offer scheduling and require a direct response. Use a short prompt like (numbered):\n\n1. “Do you want me to schedule periodic audits (e.g., daily\u002Fweekly) via `otto cron add`?”\n\nIf the user says yes, ask for:\n\n- cadence (daily\u002Fweekly), preferred time window, and output location\n- whether to also schedule `otto update status`\n\nUse a stable cron job name so updates are deterministic. Prefer exact names:\n\n- `healthcheck:security-audit`\n- `healthcheck:update-status`\n\nBefore creating, `otto cron list` and match on exact `name`. If found, `otto cron edit \u003Cid> ...`.\nIf not found, `otto cron add --name \u003Cname> ...`.\n\nAlso offer a periodic version check so the user can decide when to update (numbered):\n\n1. `otto update status` (preferred for source checkouts and channels)\n2. `npm view otto version` (published npm version)\n\n## Otto command accuracy\n\nUse only supported commands and flags:\n\n- `otto security audit [--deep] [--fix] [--json]`\n- `otto status` \u002F `otto status --deep`\n- `otto health --json`\n- `otto update status`\n- `otto cron add|list|runs|run`\n\nDo not invent CLI flags or imply Otto enforces host firewall\u002FSSH policies.\n\n## Logging and audit trail\n\nRecord:\n\n- Gateway identity and role\n- Plan ID and timestamp\n- Approved steps and exact commands\n- Exit codes and files modified (best effort)\n\nRedact secrets. Never log tokens or full credential contents.\n\n## Memory writes (conditional)\n\nOnly write to memory files when the user explicitly opts in and the session is a private\u002Flocal workspace\n(per `docs\u002Freference\u002Ftemplates\u002FAGENTS.md`). Otherwise provide a redacted, paste-ready summary the user can\ndecide to save elsewhere.\n\nFollow the durable-memory prompt format used by Otto compaction:\n\n- Write lasting notes to `memory\u002FYYYY-MM-DD.md`.\n\nAfter each audit\u002Fhardening run, if opted-in, append a short, dated summary to `memory\u002FYYYY-MM-DD.md`\n(what was checked, key findings, actions taken, any scheduled cron jobs, key decisions,\nand all commands executed). Append-only: never overwrite existing entries.\nRedact sensitive host details (usernames, hostnames, IPs, serials, service names, tokens).\nIf there are durable preferences or decisions (risk posture, allowed ports, update policy),\nalso update `MEMORY.md` (long-term memory is optional and only used in private sessions).\n\nIf the session cannot write to the workspace, ask for permission or provide exact entries\nthe user can paste into the memory files.\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002FelizaOS\u002Feliza\u002Fhealthcheck",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill healthcheck",{"tool":42,"command":43},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill healthcheck",{"tool":45,"command":46},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill healthcheck","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002FelizaOS\u002Feliza\u002Fhealthcheck\u002FSKILL.md",true,[],[51,61,71,80,86,93],{"skillNo":52,"name":53,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":57,"publishedAt":23},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[56],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[58,59,60],"model","model hierarchy","model hierarchy skill",{"skillNo":62,"name":63,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":67,"publishedAt":23},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[66],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[68,69,70],"MCP","zoom","zoom mcp",{"skillNo":72,"name":73,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":23},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[77,78,79,69],"sdk","zoom apps sdk","apps",{"skillNo":81,"name":82,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":23},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[82],{"skillNo":87,"name":88,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":92,"publishedAt":23},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[91],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[88],{"skillNo":94,"name":95,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":23},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[95]]