What problem does it solve? A default 3x-ui panel is exposed to internet-wide scanners, relies on an all-powerful admin password, and may silently fail to enforce IP limits or backups. This Skill walks through a structured audit-and-harden sequence so the panel, its API tokens, and its credentials are secured without locking yourself out. ## Core Features & Use Cases - Security audit: Reads current settings, API tokens, fail2ban status, and update info to establish a baseline before changing anything. - Token-based authentication: Replaces admin password auth with scoped, revocable API tokens, and prunes unrecognized tokens safely by disabling before deleting. - Credential rotation and lockout prevention: Rotates admin credentials while keeping the MCP server's own access intact. - Enforcement verification: Confirms fail2ban is actually installed so per-client IP limits are enforced, not just recorded. - Backups and safe updates: Tests the Telegram backup bot, takes backups before updates or bulk deletions, and verifies panel updates after restart. - Use Case: Before handing panel access to a contractor, mint a scoped, expiring API token, disable stale tokens, verify fail2ban enforcement, and take a Telegram backup. ## Quick Start Ask the agent to audit and harden my 3x-ui panel, starting with current settings and API tokens, then move authentication to a scoped token and take a backup before any changes.
