heinzel-security

heinzel-security

Security configuration audit for a server or the local machine. Never run automatically — only on explicit user request. The whole of the heinzel first-connection onboarding pipeline still applies before any of this runs.

Workflow

1. Load overrides. Before running any check, apply the full heinzel rule-override chain (later wins):

   • memory/custom-rules/heinzel-security.md if present (global custom overrides for this skill — ## Add:, ## Replace:, ## Remove: prefixes per CLAUDE.md).
   • memory/servers/<hostname>/memory.md for context (services, legitimate external bindings, VPN role).
   • memory/servers/<hostname>/rules.md if present (per-server rule overrides — same prefixes as above, highest precedence). Note: memory/custom-rules/all.md is already loaded by the CLAUDE.md session-start preflight — do not re-read it.

2. Run checks in 2–3 parallel batches for speed — not one massive batch. If a single parallel tool call errors, Claude Code cancels sibling calls, so grouping limits blast radius. Put commands with complex quoting (awk, sed) in their own batch so a quoting mistake does not cancel simple commands.

3. SSH quoting warning: avoid awk's !~ operator — zsh interprets ! as history expansion and mangles it even inside quotes. Use positive ~ match with next instead (see System Accounts check in references/user-accounts.md).

4. Select checks per the references below. Use the preferred method when privileges allow; fall back to the unprivileged method otherwise.

5. Emit the report using the format in references/report-format.md.

6. Do NOT update memory.md. These are config observations, not state changes. Memory tracks what is installed and running, not security posture details.

7. Log the summary to the system journal and mirror to the local changelog per rules/changelog.md:

   logger -t heinzel "Security audit: 1 WARN, 1 INFO"