Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines.
Start a fresh conversation. Replace the highlighted placeholders.
Use cis-benchmarks to audit [system scope] against the applicable CIS baseline and produce a prioritized compliance report with documented exceptions; do not apply remediation without my confirmation.
Required inputs
[system scope]
User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗
SKILL.md
name: cis-benchmarksdescription: Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines.license: MITmetadata: author: devops-skills version: "1.0"
# Install
apt install lynis
# Run audit
lynis audit system
# Generate report
lynis audit system --report-file /tmp/lynis-report.dat
InSpec
# cis-profile/controls/ssh.rb
control 'cis-ssh-1' do
impact 1.0
title 'Ensure SSH root login is disabled'
describe sshd_config do
its('PermitRootLogin') { should eq 'no' }
end
end
control 'cis-ssh-2' do
impact 0.7
title 'Ensure SSH password authentication is disabled'
describe sshd_config do
its('PasswordAuthentication') { should eq 'no' }
end
end
# Run InSpec
inspec exec cis-profile -t ssh://user@target
Kubernetes CIS
# kube-bench
docker run --rm -v /etc:/etc:ro -v /var:/var:ro \
aquasec/kube-bench:latest run --targets node
# Check specific sections
kube-bench run --targets master --check 1.1,1.2