feat: /security-audit skill — VPS and server security posture review

[josephfung]

Idea

Add a /security-audit skill that runs a structured security review of registered VPS deployments — checking for common server-level vulnerabilities, misconfigurations, and hygiene issues via SSH. Complements the sysops agent's operational focus with a security lens.

Goal

Catch security issues proactively before they become incidents: exposed ports, weak SSH config, unrotated keys, container attack surface, and more. Two tiers — a quick daily scan and a comprehensive monthly deep-dive.

Checks to include

Quick scan (daily, high-confidence findings only)

• SSH config: root login disabled? Password auth disabled? AllowUsers set?
• Open ports: anything unexpected listening on 0.0.0.0?
• Fail2ban or equivalent running?
• Unattended upgrades enabled?
• UFW/iptables rules sanity check
• Docker daemon not exposed on TCP (unix socket only)

Comprehensive scan (monthly)

• All of the above, plus:
• Secrets archaeology: .env files world-readable? Credentials in shell history?
• Container attack surface: privileged containers? Containers running as root?
• SSH authorized_keys audit: any unknown keys?
• Outdated package CVEs (cross-reference apt list --upgradable with known CVEs)
• World-writable directories
• SUID/SGID binaries outside expected set
• Cron jobs and systemd timers: any unknown entries?

Implementation approach

1. Add skills/security-audit/SKILL.md — skill prompt with two modes (quick/comprehensive), invoked via /security-audit or /security-audit comprehensive
2. Add bin/trimkit-security-scan — shell script with modular check functions, run remotely via SSH
3. Agent reads deployment registry from ~/.claude/sysops/deployments.json (same source as sysops)
4. Findings rated by severity (critical/high/medium/info) with a confidence gate for quick mode
5. Findings appended to ~/.claude/sysops/audit.jsonl alongside maintenance entries
6. Quick scan results summarised; critical/high findings block with a clear call-to-action

Notes

• Read-only — no auto-remediation, findings only
• Pair with the /careful skill when doing any remediation work
• Should run independently of the sysops agent but share the deployment registry