[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F8BYGJSZYN356A493F5R1G":3,"skill-same:01M6F8BYGJSZYN356A493F5R1G":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":29,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":59,"install":60,"resources":73},"01M6F8BYGJSZYN356A493F5R1G","linux-hardening",null,"Apply CIS benchmarks and secure Linux servers.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-linux-hardening\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"linux","hardening","linux hardening","apply","github","for","relevant","helper","scope","critical","active","main","community","benchmarks","agent-skills","cis","only","devops","vault","devops-security","license","assessment","2026-11-10 10:12:30",false,"---\nname: linux-hardening\ndescription: Apply CIS benchmarks and secure Linux servers.\ncategory: security\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# Linux Hardening\n\nSecure Linux servers following CIS benchmarks and security best practices.\n\n## When to Use This Skill\n\nUse this skill when:\n- Hardening production servers\n- Meeting compliance requirements\n- Implementing security baselines\n- Configuring secure SSH access\n\n## Target and recovery\n\nConfirm distribution\u002Fversion, selected CIS profile, current service config and user-authorized changes. Keep a known-working access session and out-of-band recovery, back up affected files privately, preview changes and validate before reload. These examples are fragments, not a universal CIS-compliance script. Do not apply firewall\u002Fdefault-deny rules before verifying management access and IPv4\u002FIPv6 requirements.\n\n## SSH Hardening\n\n```text\n# Example sshd configuration; merge with existing policy\nPermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\nMaxAuthTries 3\nClientAliveInterval 300\nClientAliveCountMax 2\nAllowUsers \u003Cconfirmed-management-users>\n```\n\n## User Security\n\n```bash\n# Debian\u002FUbuntu package example; review the transaction first\nsudo apt install libpam-pwquality\n```\n\nMerge these settings into `\u002Fetc\u002Fsecurity\u002Fpwquality.conf` after reviewing the distribution PAM policy; these are configuration entries, not shell commands:\n\n```text\nminlen = 14\ndcredit = -1\nucredit = -1\nocredit = -1\nlcredit = -1\n```\n\n```bash\n# Set the default for FUTURE accounts: inactivity after password expiry,\n# not 30 days since last login; review service-account consequences first.\nuseradd -D -f 30\n\n# Audit sudo usage\n# Edit a reviewed \u002Fetc\u002Fsudoers.d\u002F fragment with visudo and validate with visudo -c.\n# Do not append blindly to \u002Fetc\u002Fsudoers.\n```\n\n## Firewall Configuration\n\n```bash\n# UFW setup\nufw default deny incoming\nufw default allow outgoing\nufw allow ssh\nufw allow 443\u002Ftcp\nufw enable\n\n# Alternative iptables changes require an isolated validated ruleset,\n# management allow rules, conntrack, DNS\u002FIPv6 decisions and timed rollback.\n# Do not set INPUT DROP first on a live remote host.\n\n```\n\n## Kernel Hardening\n\n```text\n# \u002Fetc\u002Fsysctl.d\u002F99-security.conf\nnet.ipv4.conf.all.send_redirects = 0\nnet.ipv4.conf.all.accept_redirects = 0\nnet.ipv4.conf.all.accept_source_route = 0\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\nkernel.randomize_va_space = 2\nfs.suid_dumpable = 0\n\n# After reviewing a supported value set, apply the exact file separately:\n# sudo sysctl -p \u002Fetc\u002Fsysctl.d\u002F99-security.conf\n```\n\n## File Permissions\n\n```bash\n# Inspect distro-prescribed owner\u002Fgroup\u002Fmode before any authorized repair.\n# \u002Fetc\u002Fshadow group readability may be required; do not blanket chmod it.\n# Find world-writable files\nfind \u002F -xdev -type f -perm -0002 -ls\n\n# Find SUID files\nfind \u002F -xdev -perm -4000 -type f -ls\n```\n\n## Audit Configuration\n\nPackage installation and audit rules are separate steps. Validate and load the actual rules file through the installed audit tooling; execve auditing can capture secret command arguments and large volumes, so scope access and retention.\n\n```bash\n# Install auditd\napt install auditd\n\n```\n\nExample rule-file content for `\u002Fetc\u002Faudit\u002Frules.d\u002Faudit.rules` (not shell commands):\n\n```text\n-w \u002Fetc\u002Fpasswd -p wa -k identity\n-w \u002Fetc\u002Fshadow -p wa -k identity\n-w \u002Fetc\u002Fsudoers -p wa -k actions\n-a always,exit -F arch=b64 -S execve -k exec\n```\n\n## Best Practices\n\n- Disable unused services\n- Keep system updated\n- Use fail2ban for intrusion prevention\n- Enable SELinux\u002FAppArmor\n- Regular security audits\n- Monitor log files\n- Implement least privilege\n\n## Related Skills\n\n- cis-benchmarks (`cis-benchmarks`) - Compliance scanning\n- firewall-config (`firewall-config`) - Firewall rules\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# Linux Hardening\n\nSecure Linux servers following CIS benchmarks and security best practices.\n\n## When to Use This Skill\n\nUse this skill when:\n- Hardening production servers\n- Meeting compliance requirements\n- Implementing security baselines\n- Configuring secure SSH access\n\n## Target and recovery\n\nConfirm distribution\u002Fversion, selected CIS profile, current service config and user-authorized changes. Keep a known-working access session and out-of-band recovery, back up affected files privately, preview changes and validate before reload. These examples are fragments, not a universal CIS-compliance script. Do not apply firewall\u002Fdefault-deny rules before verifying management access and IPv4\u002FIPv6 requirements.\n\n## SSH Hardening\n\n```text\n# Example sshd configuration; merge with existing policy\nPermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\nMaxAuthTries 3\nClientAliveInterval 300\nClientAliveCountMax 2\nAllowUsers \u003Cconfirmed-management-users>\n```\n\n## User Security\n\n```bash\n# Debian\u002FUbuntu package example; review the transaction first\nsudo apt install libpam-pwquality\n```\n\nMerge these settings into `\u002Fetc\u002Fsecurity\u002Fpwquality.conf` after reviewing the distribution PAM policy; these are configuration entries, not shell commands:\n\n```text\nminlen = 14\ndcredit = -1\nucredit = -1\nocredit = -1\nlcredit = -1\n```\n\n```bash\n# Set the default for FUTURE accounts: inactivity after password expiry,\n# not 30 days since last login; review service-account consequences first.\nuseradd -D -f 30\n\n# Audit sudo usage\n# Edit a reviewed \u002Fetc\u002Fsudoers.d\u002F fragment with visudo and validate with visudo -c.\n# Do not append blindly to \u002Fetc\u002Fsudoers.\n```\n\n## Firewall Configuration\n\n```bash\n# UFW setup\nufw default deny incoming\nufw default allow outgoing\nufw allow ssh\nufw allow 443\u002Ftcp\nufw enable\n\n# Alternative iptables changes require an isolated validated ruleset,\n# management allow rules, conntrack, DNS\u002FIPv6 decisions and timed rollback.\n# Do not set INPUT DROP first on a live remote host.\n\n```\n\n## Kernel Hardening\n\n```text\n# \u002Fetc\u002Fsysctl.d\u002F99-security.conf\nnet.ipv4.conf.all.send_redirects = 0\nnet.ipv4.conf.all.accept_redirects = 0\nnet.ipv4.conf.all.accept_source_route = 0\nnet.ipv4.icmp_echo_ignore_broadcasts = 1\nkernel.randomize_va_space = 2\nfs.suid_dumpable = 0\n\n# After reviewing a supported value set, apply the exact file separately:\n# sudo sysctl -p \u002Fetc\u002Fsysctl.d\u002F99-security.conf\n```\n\n## File Permissions\n\n```bash\n# Inspect distro-prescribed owner\u002Fgroup\u002Fmode before any authorized repair.\n# \u002Fetc\u002Fshadow group readability may be required; do not blanket chmod it.\n# Find world-writable files\nfind \u002F -xdev -type f -perm -0002 -ls\n\n# Find SUID files\nfind \u002F -xdev -perm -4000 -type f -ls\n```\n\n## Audit Configuration\n\nPackage installation and audit rules are separate steps. Validate and load the actual rules file through the installed audit tooling; execve auditing can capture secret command arguments and large volumes, so scope access and retention.\n\n```bash\n# Install auditd\napt install auditd\n\n```\n\nExample rule-file content for `\u002Fetc\u002Faudit\u002Frules.d\u002Faudit.rules` (not shell commands):\n\n```text\n-w \u002Fetc\u002Fpasswd -p wa -k identity\n-w \u002Fetc\u002Fshadow -p wa -k identity\n-w \u002Fetc\u002Fsudoers -p wa -k actions\n-a always,exit -F arch=b64 -S execve -k exec\n```\n\n## Best Practices\n\n- Disable unused services\n- Keep system updated\n- Use fail2ban for intrusion prevention\n- Enable SELinux\u002FAppArmor\n- Regular security audits\n- Monitor log files\n- Implement least privilege\n\n## Related Skills\n\n- cis-benchmarks (`cis-benchmarks`) - Compliance scanning\n- firewall-config (`firewall-config`) - Firewall rules\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":27,"source":45,"license":14,"category":46,"metadata":47,"date_added":50,"description":7,"source_repo":51,"source_type":30,"compatibility":52,"license_source":53},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","security",{"author":48,"version":49},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-linux-hardening",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-11 14:20:43",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add boisenoise\u002Fskills-collections --skill linux-hardening",{"tool":66,"command":67},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill linux-hardening",{"tool":69,"command":70},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill linux-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-linux-hardening\u002FSKILL.md",true,[],[75,103,129,154,173,196],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":80,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":40},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[84,85,86,87,88,89,90,91,92,93,94,34,95,96,97,27,98,99,100,101,102],"web","access","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","platform","free","cover","normal","when","2026",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":107,"sourceHtmlUrl":108,"categories":109,"keywords":115,"publishedAt":40},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[110],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[105,116,117,22,87,88,38,92,118,119,120,121,122,123,124,27,125,126,127,128,102],"MCP","cli","Budget","credentials","team","catalog","use","call","discover","external tools","with","scoped","blob",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":133,"sourceHtmlUrl":134,"categories":135,"keywords":141,"publishedAt":40},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[136],{"categoryNo":137,"categoryName":138,"taxonomyType":139,"taxonomyTypeDesc":140},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[131,22,87,38,142,143,144,145,146,147,27,148,149,150,126,23,151,152,153,128,105,102],"https","email","enrichment","business","evidence","phone","ranking","post","job description","person","candidate","reason",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":158,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":40},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[162,163,164,22,87,38,165,166,142,167,118,168,169,170,146,27,171,172,128,105,102],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":177,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":40},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[181,182,22,183,87,184,38,185,186,187,188,189,27,190,191,192,193,194,195,128],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":79,"licenseFileUrl":200,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":40},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[204,205,206,22,87,38,207,208,145,209,210,27,211,212,213,214,215,216,217,128],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]