heinzel-security

# heinzel-security Security configuration audit for a server or the local machine. **Never run automatically** — only on explicit user request. The whole of the heinzel first-connection onboarding pipeline still applies before any of this runs. ## Workflow 1. **Load overrides.** Before running any check, apply the full heinzel rule-override chain (later wins): - `memory/custom-rules/heinzel-security.md` if present (global custom overrides for this skill — `## Add:`, `## Replace:`, `## Remove:` prefixes per `CLAUDE.md`). - `memory/servers/<hostname>/memory.md` for context (services, legitimate external bindings, VPN role). - `memory/servers/<hostname>/rules.md` if present (per-server rule overrides — same prefixes as above, highest precedence). Note: `memory/custom-rules/all.md` is already loaded by the CLAUDE.md session-start preflight — do not re-read it. 2. **Run checks in 2–3 parallel batches** for speed — not one massive batch. If a single parallel tool call errors, Claude Code cancels sibling calls, so grouping limits blast radius. Put commands with complex quoting (awk, sed) in their own batch so a quoting mistake does not cancel simple commands. 3. **SSH quoting warning:** avoid awk's `!~` operator — zsh interprets `!` as history expansion and mangles it even inside quotes. Use positive `~` match with `next` instead (see System Accounts check in `references/user-accounts.md`). 4. **Select checks** per the re...