infra-auditlisted

Server / infrastructure security audit of LIVE hosts over SSH (12 dimensions IS1-IS12: SSH hardening, accounts, network exposure, TLS, firewall, patch posture, logging, web services, Docker, databases, filesystem, host secrets). Deterministic collector + parallel LLM analysts; dual-vantage (internal SSH + external via proxy); per-target authorization gate; consent-gated tool installs; read-only with one consented exception. Flags: --host user@addr[:port] (single ad-hoc host), --quick (IS1+IS3+IS4, <3 min/host), --dimensions IS1,IS3,… (explicit subset), --no-install (hard read-only), --dry-run (print commands, no connections), --resume <run-dir> (continue interrupted run), --proxy <url> (external-scan proxy), --external direct (proxyless external scan, polite timing), --skip-external (internal vantage only), --deep-scan (nmap -p- full port sweep), --confirm-targets <sha256> (non-interactive authorization).
greglas75/zuvo · ★ 6 · DevOps & Infrastructure · score 78

Install: claude install-skill greglas75/zuvo

# zuvo:infra-audit > Audit the security of LIVE servers/infrastructure the user owns, over SSH, plus > external exposure verification through a proxy. This is the orthogonal companion > to `security-audit` (repo-resident IaC config), `db-audit` (DB as a data layer), > and `pentest` (app-code exploitability). Routing boundary: **"is my server > secure?" → infra-audit**. > > Architecture (DD-5): a **deterministic collector** (`scripts/infra-collect.sh`) > gathers everything per host into a normalized JSON bundle; **parallel LLM > analysts** each see only their layer's normalized findings; **deterministic** > dedup/scoring/report assembly. The LLM **interprets, never detects**. ## Argument Parsing | Argument | Meaning | |----------|---------| | `[path/to/hosts.yaml]` | Fleet audit from inventory (default: `zuvo/infra/hosts.yaml` if present) | | `--host user@addr[:port]` | Single ad-hoc host, no inventory file needed | | `--quick` | IS1 + IS3 (internal) + IS4 only; < 3 min/host target | | `--dimensions IS1,IS3,…` | Explicit dimension subset | | `--no-install` | Hard read-only: never offer tool installation (disables the DD-3 gate) | | `--dry-run` | Print every SSH/local command without executing; no connections beyond DNS | | `--resume <run-dir>` | Continue an interrupted run from `state.json` | | `--proxy <url>` | External-scan proxy override (else hosts.yaml `defaults.proxy`, else `$ZUVO_SCAN_PROXY`) | | `--scan-via <ssh-target>` | Run the external leg FROM this SSH host via