description

Security & System Audit -- read-only full-grid audit of the Hackintosh (Ubuntu 24.04). Live web threat-intel sweep, then patch/network/auth/persistence/supply-chain/dev-targeted checks. Reports ranked findings + exact remediation commands. Never remediates.

hint

allowed_tools

Bash

Read

Grep

Glob

Agent

WebSearch

WebFetch

Skill

model_invocable

false

/audit — Security & System Audit

Full read-only security and system audit of a Linux host (default target: the Hackintosh, Ubuntu 24.04 bare metal, 192.168.68.200). Starts with a live web sweep for current vulnerabilities and active campaigns, then audits the grid against what's actually being exploited right now.

Input

$ARGUMENTS — Optional. First token = target host (IP or hostname); default = local host. Optional focus:<area> narrows scope to one section (npm, network, auth, supply-chain, dev-threats) — default runs all sections.

HARD RULE — READ ONLY

AUDIT ONLY: gather, analyze, report. Zero changes. No installs, no upgrades, no service restarts, no kills, no config edits, no firewall changes, no file moves. Anything actionable goes in the report as a recommendation with exact commands; the User decides what executes. An audit that auto-remediates is how live services and live trades die (SCOPE LOCK, 2026-03-17 killall incident). This clause overrides any "helpful" impulse mid-run.

Section 5 and Section 7d are report-only on secrets — never move, rotate, or redact a credential during the audit. Report location + exposure, let the User act.

STEP 0 — LIVE THREAT-INTEL SWEEP (ALWAYS RUN FIRST)

The CVE numbers and campaign names baked into this skill below are SEED EXAMPLES and go stale within days. Do not trust them as current. Every invocation, before touching the host, dispatch research to pull what is actively being exploited today.

Spawn a research subagent (opus-worker or general-purpose) with WebSearch + WebFetch. Prompt it to sweep, most-recent-first, using today's date as the anchor:

CISA KEV — vulnerabilities added to the Known Exploited Vulnerabilities catalog in the last ~60 days.
Actively exploited CVEs for every component on this grid: Linux kernel + Ubuntu 24.04, OpenSSH, sudo, systemd, nginx, Samba/SMB, cloudflared, Tailscale, KVM/QEMU/libvirt, Electron, Node.js, Python/pip, Docker, Chromium/Brave.
npm / software supply-chain — current malicious-package campaigns, compromised popular packages + their bad version numbers, worm activity (Shai-Hulud lineage and successors), published IOC lists (pull the live Wiz/Socket/Unit42 lists, not a cached copy).
Developer-targeted social engineering — fake-recruiter / take-home / interview malware campaigns (Contagious Interview / DeceptiveDevelopment lineage). HIGH PRIORITY: the User actively job-searches and runs recruiter-provided take-home code. Pull current fake-recruiter package names, repo IOCs, and TTPs.
AI-tooling attack surface — malicious MCP servers, poisoned IDE/VS Code extensions (GlassWorm lineage), malicious agent skills/plugins, Claude Code prompt-injection / config-hijack CVEs.

Prefer primary sources: vendor advisories, Socket.dev, Snyk, Phylum, ReversingLabs, Wiz, Unit42, Microsoft/Google security blogs, CISA, GitHub Advisory DB, official incident reports. Cross-check each major claim across 2+ independent sources. Return a structured brief: CVE/campaign, affected component, exploitation status, fixed version, IOC pointers, source URLs, freshness/confidence.

Fold the fresh intel into the audit sections below — check installed versions against today's fixed versions and IOC lists, not the seed examples. If web access is unavailable, say so explicitly in the report and proceed on seed intel with an INFERRED/STALE label on every version-based finding.

THE AUDIT — 9 SECTIONS

Run in parallel where possible (subagents fine). All commands read-only. Where a CVE is named, report installed version vs fixed version AND whether the vulnerable feature is actually in use — never flag on version alone.

1. UPDATES & PATCH STATE

apt update (read-only refresh), then full list of upgradable packages; separate security updates (unattended-upgrades log + apt-get -s upgrade parse) from feature updates.
Kernel: running vs newest installed vs newest available; reboot-required flag. Check against the current live kernel-privesc set from Step 0. (Seed examples — refresh: CVE-2026-31431 Copy Fail, CVE-2026-43503 DirtyClone, CVE-2026-43284/43500 DirtyFrag, CVE-2026-46300 Fragnesia, CVE-2026-3888 snap-confine Ubuntu local root.)
ubuntu-advantage/Pro status, livepatch state.
Snap + flatpak pending updates.
EOL check: dead PPAs, orphaned/obsolete packages, held packages and why.
Non-apt tooling drift: conda base, npm -g, pipx, cargo, ~/Installed/ binaries — outdated + known-CVE versions (npm audit, pip-audit if present).

2. NETWORK EXPOSURE

ss -tulpn full map: every listening socket → owning process → bind iface (loopback vs br0 vs all). Flag anything on 0.0.0.0/:: that doesn't need to be.
Cross-reference against reference_hackintosh_infra.md port table; flag unknown listeners.
UFW/iptables/nftables: active rulesets, default policies, holes.
nginx (local + VPS VM, publicly reachable via CF tunnel): version vs current live nginx CVEs from Step 0. (Seed: CVE-2026-42945 NGINX Rift RCE 0.6.27–1.30.0; CVE-2026-33032 nginx-ui auth bypass.)
cloudflared: version, which services are reachable via public subdomains, anything exposed that shouldn't be. Integrity-check running binary vs package-manager install (abused post-compromise for persistence).
SMB: smbstatus, share defs, guest access, protocol min version. Samba version vs current CVEs (seed: CVE-2026-4480 authenticated RCE via print-job metacharacters — check spoolss/printing enabled).
Tailscale: status, exposed mesh services, key expiry.
KVM/libvirt: any management ports listening beyond loopback?

3. SSH & AUTH

sshd -T effective settings: root login, password auth, max auth tries, allowed users/groups.
OpenSSH version vs current live CVEs from Step 0. (Seed: CVE-2026-35414 SplitSSHell root via authorized_keys principals + CA certs, fixed 10.3; CVE-2026-35386 RCE via ssh_config metacharacters; CVE-2026-3497 GSSAPI single-packet DoS.) Report version + whether CA-cert principals / GSSAPI kex are in use.
~/.ssh/authorized_keys on all accounts — every key accounted for?
Failed auth: lastb summary, sshd auth failures by source IP/count over 30 days — brute-force patterns.
fail2ban present/absent.
sudoers + sudoers.d: NOPASSWD entries, anything unexpected. sudo version vs current CVEs (seed: CVE-2026-35535 privesc ≤1.9.17p2).
Accounts: /etc/passwd shells, UID 0 duplicates, locked vs active, empty passwords (shadow audit), last logins.

4. PERSISTENCE & INTEGRITY

All enabled systemd units (system + user) vs expected set from ~/.customizations.md; flag unknowns.
cron: all crontabs (root + users), /etc/cron.*, systemd timers — attribute every entry.
Shell init (.bashrc, .profile, /etc/profile.d) for unexpected exec/curl|bash patterns.
LD_PRELOAD, /etc/ld.so.preload, suspicious kernel modules (lsmod vs expected).
SUID/SGID sweep: find / -perm -4000 -o -perm -2000, diff against stock Ubuntu.
World-writable files/dirs in system paths; PATH-hijack candidates in ~/bin.
debsums or dpkg --verify on critical packages (openssh, sudo, systemd, pam).
If rkhunter/chkrootkit present, run them; if absent, recommend only — do NOT install.

5. SECRETS HYGIENE (report-only, no moves)

Plaintext creds in world-readable locations, ~/.bashrc exports, .env files under served/hosted paths (RAID/Hosted especially — anything secret reachable via nginx/CF tunnel?).
Git repos under portfolio/ with tracked .env or keys in HEAD (fast scan, not full history).
SSH private keys with wrong permissions.
~/.npmrc token exposure (top exfil target of every 2026 npm campaign); NPM_TOKEN/NODE_AUTH_TOKEN in env and shell init.
Note: creds-in-CLAUDE.md is a closed flag (User decision 2026-07-04) — do not re-propose moving them.

6. SYSTEM HEALTH

systemctl --failed, journalctl -p err..alert -b (and last boot) — cluster and explain recurring errors.
ZFS: zpool status -v (errors, scrub age, resilver state), capacity, snapshot health, SMART on all 7 RAID disks + NVMe (smartctl -a: reallocated, pending, CRC, wear).
Disk capacity all mounts, inode usage, memory pressure, zombie procs, top CPU/mem offenders.
Home Guardian: backup-status — timers firing, last snapshot ages, RAID→mpRAID mirror current?
Temps/sensors if available; dmesg for hardware errors (MCE, USB resets, PCIe).
VM host: libvirt domains state, anything crashed/paused. QEMU/KVM version vs current CVEs (seed: CVE-2026-53359 Januscape KVM guest→host escape; CVE-2026-48914 virtio-blk heap overflow).

7. NPM & SOFTWARE SUPPLY-CHAIN AUDIT

Context: 2025-2026 = open season on npm. Self-replicating worms (Shai-Hulud lineage), maintainer-account takeovers of top-100 packages, mass typosquat/dependency-confusion. Payloads steal npm/.npmrc tokens, GITHUB_TOKEN, AWS/GCP/Azure creds, SSH keys, crypto wallets — mostly via preinstall/postinstall scripts. This box has many node projects + global packages + runs recruiter take-home code = the exact hunted profile. READ ONLY.

a. Compromised-version check — scan every project lockfile + global installs against the live IOC list from Step 0 (pull current Wiz/Socket/Unit42 lists at runtime; do not trust seed versions). (Seed examples: axios 1.14.1 / 0.30.4; node-ipc 9.1.6/9.2.3/12.0.1; @bitwarden/cli 2026.4.0; hidden deps plain-crypto-js, @shadanai/openclaw, @qqbrowser/openclaw-qbot. Cross-check @ctrl/, @tanstack/, @antv/, @redhat-cloud-services/, debug, chalk.) b. Install-script surface (primary execution vector):

find ~ -name package.json -not -path '*/node_modules/*' -exec grep -l '"preinstall\|"postinstall\|"install"' {} \;
per active project: npm query ':attr(scripts,[postinstall])' etc. (npm 8.16+)
report npm config get ignore-scripts — recommend enabling globally. c. IOC file sweep across all node_modules + home:
filenames: setup_bun.js, bun_environment.js, truffleSecrets.json, cloud.json
unexpected Bun runtime in running procs (ps aux | grep -i bun) — worms deploy Bun to run stealers
malicious workflow files under .github/workflows/ (e.g. formatter_/discussion.yaml, SHA1HULUD strings)
Claude Code persistence: any ~/**/.claude/settings.json with injected SessionStart hook or hulud/SHA1HULUD strings (Shai-Hulud 2.0 backdoors Claude via SessionStart)
live C2 strings from Step 0 anywhere in node_modules/env (seed: sfrclak[.]com, aab.sportsontheweb[.]net, helloworm00/hello-world, X-Supply header, __DAEMONIZED). d. Token/credential exposure (ties to §5): ~/.npmrc + all project .npmrc for plaintext _authToken; env for NPM_TOKEN/NODE_AUTH_TOKEN; git fast-scan for committed .npmrc/.env. e. Tooling gap — report presence/absence, recommend not install: Socket CLI, osv-scanner, lockfile-lint, npm audit signatures (provenance/sigstore). Flag that npm audit alone covers CVEs only, NOT malicious packages. f. Other registries (brief): pip/PyPI compromised-package check against Step 0 intel (seed: litellm 1.82.7-1.82.8, pytorch-lightning 2.6.2-2.6.3, microsoft durabletask SDK May 2026); cargo/crates if used.

8. DEVELOPER-TARGETED & AI-TOOLING THREAT EXPOSURE (HIGHEST PRIORITY)

Matches the User's exact profile: active job search + runs take-home/interview code + heavy AI tooling.

a. Contagious Interview / DeceptiveDevelopment (Lazarus/DPRK, MITRE G1052) — fake recruiters send GitHub repos as "technical assessments"; payload auto-executes. #1 threat for a developer running recruiter code.

scan ALL cloned repos under portfolio/ and any job-search / take-home / interview dirs for .vscode/tasks.json containing URLs or auto-run commands (auto-executes on folder open in VS Code/Cursor)
repos with install scripts + obfuscated recruiter-supplied deps; "big"-prefix npm packages (Graphalgo); shortened Vercel/redirect URLs in setup steps
on-disk RAT artifacts (BeaverTail, InvisibleFerret, OtterCookie, FlexibleFerret) in /tmp, ~/.cache, launch agents
STANDING POLICY RECOMMENDATION: all recruiter/take-home code runs in a disposable KVM VM/container, never on the Hackintosh host. Flag any evidence take-home code ran on the host directly. b. IDE / extension supply chain — GlassWorm lineage (self-propagating malicious Open VSX extensions mimicking linters/formatters/AI assistants; VS Code silent auto-update). Enumerate installed VS Code / Cursor extensions; flag Open VSX or unknown-publisher sources; note whether auto-update is on. c. MCP / AI-agent attack surface:
enumerate configured MCP servers (claude mcp list + config files); flag untrusted sources (tool-poisoning + cross-server exfil are live).
Claude Code integrity: confirm ANTHROPIC_BASE_URL is NOT overridden in any project/global settings (token-hijack CVE), and no rogue hooks in settings.json beyond intentionally configured ones.
enumerate installed agent skills/plugins; flag non-first-party (ClawHavoc: ~1 in 5 third-party skills carried infostealers). d. Browser: Brave/Chromium version vs current live V8/Chromium 0-day from Step 0 (seed: CVE-2026-11645 V8 0-day, CISA KEV, hits all Chromium incl bundled Electron). Report version + whether any bundled-Electron apps ship a vulnerable Chromium.

9. REPORT

Single ranked report: CRITICAL / HIGH / MEDIUM / LOW / INFO. Every finding =

evidence (command + output excerpt)
why it matters
exact remediation command(s)
epistemic label (VERIFIED / INFERRED / ASSUMED). Version-based findings from stale seed intel when web was unreachable → mark STALE.

Where a CVE is named: installed version vs fixed version AND whether the vulnerable feature is in use. No flagging on version alone.

Final section: "Proposed Execution Plan" — ordered remediation batches for User approval, flagging anything requiring reboot or service restart so the User can schedule it. Nothing executes without the User's go.

Run /attack on the report before delivering — kill weak findings, verify the costliest claim has one independent derivation, confirm no false "all clear."

END OF LINE.

sanchez314c/audit.md

Select an option

No results found