audit-system

Runs Lynis security audits and journals findings with hardening index tracking.

2|Updated Jun 14, 2026
One-click install
npx skills add https://github.com/odysseyalive/claude-watchman --skill audit-system-odysseyalive
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-system
Source: https://github.com/odysseyalive/claude-watchman/tree/main/skills/grammar/audit-system
Command: npx skills add https://github.com/odysseyalive/claude-watchman --skill audit-system-odysseyalive

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires lynis.

What problem does it solve? Manually running security audits produces one-off reports that are hard to compare over time and easy to forget. This Skill wraps Lynis to run profile-appropriate hardening scans, deduplicates findings into a persistent SQLite journal, and tracks the hardening index as a trend so regressions surface instead of getting lost. ## Core Features & Use Cases - Lynis audit orchestration: Runs lynis audit system through an I/O-aware wrapper that defers heavy scans when the host is under load and records the scan's own resource footprint. - Findings journaling and dedup: Folds every Lynis warning and suggestion into a SQLite journal with stable fingerprints, so re-runs update findings in place instead of creating duplicates. - Hardening index trending: Captures the Lynis hardening index as a tracked metric so drift and regressions are visible across audit passes. - Use Case: On a Debian web server, run a scheduled audit pass that skips the scan during peak load, journals new Lynis warnings with severity adjusted to the server profile, and charts the hardening index week over week. ## Quick Start Ask the AI to run a system security audit with Lynis and journal the findings and hardening index for this machine.

Frequently Asked Questions about audit-system

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Lynis security audit and track results over time?▼

Run the audit through the skill's dispatcher, which executes `lynis audit system` and parses the report file at the Lynis report path. Each warning and suggestion is journaled with a stable fingerprint, and the hardening index is recorded as a metric for trend tracking.

How does the audit avoid overloading a busy server?▼

An I/O courtesy gate checks system pressure before the scan. If the host is loaded, the heavy Lynis run is deferred to the next pass and an informational finding is journaled instead, so audits never pile I/O onto a busy box.

Does the audit skill work on Windows?▼

Lynis does not run on Windows, so the skill skips the Lynis workflow there and runs a native hardening scan covering Defender, BitLocker, UAC, firewall, SMBv1, RDP-NLA, and Windows Update, recording a windows_hardening_index metric instead.

Can the audit skill fix the security issues it finds?▼

No. The skill is strictly read-only: it scans and journals findings but never remediates. Fixes are handed to a separate fix-redflag skill, and a prime directive blocks any destructive action without explicit operator permission.

Why do repeated audits not create duplicate findings?▼

Each finding uses the Lynis test ID as a stable check_id with an empty target, producing an identical fingerprint across runs. Re-running updates the existing journal entry in place rather than inserting duplicates.