Infra Security Audit

Overview

This skill audits and hardens the host and network layer of a self-hosted Linux server (firewall, SSH, intrusion blocking, exposed ports, public-exposure posture). It is distinct from agent/application-layer security (skills, permissions, sandboxing). It is built for non-developer operators running a single VPS or home server, and it never makes a risky change on its own.

The single most important rule: audit reads, applying changes is gated. Diagnosis is automatic; anything that can sever a connection, lock the current session, or stop a service requires explicit human approval, a backup, and a self-lockout safeguard.

Workflow Decision Tree

Operate in three modes, always in this order. Never skip from audit straight to applying risky changes.

1. audit (default, read-only) — Diagnose and report. Safe to run anytime.
2. plan — For each finding, classify the fix as GREEN / YELLOW / RED and produce a concrete diff/command preview. No changes yet.
3. apply — Execute GREEN fixes automatically; for YELLOW/RED, show the diff, take a backup, get explicit approval, apply, then verify (and roll back on failure).

When the user only says "점검" or "audit", stop after mode 1 and report. Only proceed to plan/apply when the user asks to fix or harden.

Mode 1 — audit (read-only)