Audit and harden ErnOS host security with staged remediation and scheduled checks.
npx skills add https://github.com/Cyandex/ErnOS --skill healthcheck-cyandex
Please help me install this Agent Skill. Skill: healthcheck Source: https://github.com/Cyandex/ErnOS/tree/main/skills/healthcheck Command: npx skills add https://github.com/Cyandex/ErnOS --skill healthcheck-cyandex
ernos security audit --deep and ernos update status alongside OS-level checks (firewall, listening ports, backups, disk encryption) to build a complete posture picture. - Risk-Profile-Based Remediation: Aligns hardening to a chosen risk tolerance (Home/Workstation Balanced, VPS Hardened, Developer Convenience, or Custom) with staged, reversible steps and explicit approval before every change. - Scheduled Monitoring: Sets up recurring audits and version checks via ernos cron add with stable job names like healthcheck:security-audit. - Use Case: A user running ErnOS on a home server asks for a security review; the skill inventories the system, runs the ErnOS audit, proposes a hardening plan with exact commands, executes approved steps, and schedules weekly re-audits. ## Quick Start Ask the assistant to run a security healthcheck and hardening review on the machine running ErnOS.High-intent search queries and answers about installing and using this skill.
Run `ernos security audit --deep` for a thorough read-only assessment, or `ernos security audit` for a faster non-probing check. The skill combines these with OS-level checks like firewall status, listening ports, and backup verification.
Use staged, reversible changes with explicit approval before each step. The skill confirms how you connect (local, SSH, RDP, tailnet) first, shows exact commands with rollback plans, and verifies remote access still works after each change.
No. ErnOS itself never modifies host firewall, SSH, or OS update policies. The `ernos security audit --fix` command only tightens ErnOS defaults and file permissions; all OS-level hardening requires separate explicit user approval.
Yes, using `ernos cron add` with stable job names like `healthcheck:security-audit` and `healthcheck:update-status`. Scheduling always requires explicit approval, and you choose the cadence, time window, and output location.
Four suggested profiles: Home/Workstation Balanced (most common), VPS Hardened with deny-by-default firewall and key-only SSH, Developer Convenience with more local services, and Custom for user-defined constraints on ports, exposure, and update cadence.
MettaMazzaAudit and harden the host operating system running ErnOS.
drbobberMonitor Clawdbot systems for intrusions, unusual API calls, and credential patterns.
BagelHoleAudit and remediate systems against CIS benchmarks using OpenSCAP, Lynis, InSpec, and kube-bench.
otto-assistantReview changed files for reuse, quality, and efficiency issues.