sjht-server-audit

远程服务器安全巡检和环境报告工具。 通过 SSH 免密登录远程主机，全面检查系统信息、运行服务、开放端口、 Web 服务器配置、数据库配置、安全设置（SSH/防火墙/SELinux）、可疑进程和定时任务， 生成结构化的巡检报告。Use when 用户需要检查服务器安全、排查服务器环境、 了解服务器上运行了什么服务...

This script is coherent for performing a remote server audit, but review and test it before running on production. Specifically: - Verify SSH key handling: the skill assumes passwordless SSH; ensure the private key is stored and used securely (or provide it via a known credential manager), and confirm which user/account will be used. - Expect the script to execute commands on the remote host and read config files (e.g., /etc/ssh/sshd_config, /etc/nginx/*, /etc/cron.d/*, site directories). These are necessary for auditing but may expose sensitive configuration—run on hosts you control or have explicit permission to audit. - Fix the documentation/implementation mismatch: SKILL.md claims reports are saved under ~/.openclaw/workspac/audits/... but the script currently writes to a temporary file and the trap removes it on exit. If you need persistent reports, modify the script to write the structured Markdown to the intended path (and ensure directory exists and permissions are correct). - The SKILL.md lists a dependency on an 'ssh-ops' skill; the package metadata does not declare this. Confirm how SSH keys/session management is expected to work in your agent environment. - Test on a non-production host first to confirm output, adjust parsing rules, and verify nothing is transmitted off your environment. If you want stronger guarantees, consider adding explicit logging/consent steps and avoid running on hosts without authorization.

Type: OpenClaw Skill Name: sjht-server-audit Version: 1.0.0 The skill is a legitimate server security auditing tool designed to collect system information, service statuses, and configuration details via SSH. The bash script (scripts/server-audit.sh) performs standard diagnostic commands (ss, systemctl, grep on config files) to identify common security misconfigurations like exposed database ports or weak SSH settings. The instructions in SKILL.md explicitly advise the agent to keep reports local and avoid uploading sensitive data to public repositories, demonstrating security-conscious design aligned with its stated purpose.