v1.1.1

The skill and its scripts behave exactly as in 1.1.0. This release changes the README, its images and the packaging.

Look

• A new visual identity. The mark is a pair of brackets around a square: every change is held open until a fresh login proves it, then committed or rolled back. The README banner, the replay, the charts and the social preview are redrawn in it, in light and dark versions, with IBM Plex Sans and Mono outlined so nothing depends on web fonts.
• A dead-man switch diagram above the step list: arm, change, verify from a new connection, disarm, and the path where the login is refused and the timer rolls everything back. It animates where the browser allows it and holds still under reduced motion. The recording of a real rollback stays below it, redrawn from the same recording in the new colours.
• The benchmark charts show the whole picture. The checks chart has every check that differs between the arms, one square per run, grouped into the skill's own defaults, the checks beyond them, and incidents. It says how many checks passed in every run. The per-distro grid lists each run under the mean.
• bench/report.py and bench/spot.py write their plain preview charts to bench/out/charts/ instead of docs/bench/, so a new report can't overwrite the README charts. results.md and results.json stay where they were.

Distribution

• A directory branch for Anthropic's plugin directory. It holds only the plugin: the manifest and icon, the skill without its evals, the license and a short README that says what the plugin runs and where data goes. A workflow rebuilds it on every release tag, so the benchmark harness and tests stay out of what people install from the directory. make directory builds the same folder locally.
• Plugin icon at .claude-plugin/icon.png.

Docs

• Before you start: the Quick start now says to take a snapshot and find the provider's web console first, and to try a throwaway box the first time.
• FAQ: which key the agent logs in with, what happens to root and to its temporary sudo grant, and how to keep the result from getting in your way (levels, narrow requests).
• Dead-man switch: the README says where a rollback is logged and that it sends a "Deadman fired" alert once alerts are set up.
• GLM-5.3 spot check. Four runs of GLM-5.3 in the ZCode desktop app, with and without the skill: 79 → 100 and 67 → 100, no lockouts. Results in docs/bench/glm-5.3.md, caveats in the README.
• Benchmark harness: BENCH_MANUAL lets a person drive a desktop agent while the harness boots, relays and judges the VM.

v1.1.0

Behaviour changes. The benchmark in the README ran before them; see its caveats.

Skill

• Narrow requests get only what was asked. "Move SSH and add fail2ban" no longer brings a firewall, new SSH crypto and a move off root with it. The skill does the request safely: the dead-man switch, and the admin's IP on fail2ban's ignore list before fail2ban starts. Then it offers the rest in one line, naming the gaps it found. The full hardened baseline still applies when the user asks for the whole server: set up, secure, harden or make production-ready. "I'm offline, decide yourself" no longer widens a narrow request.
• The temporary passwordless sudo grant has a deadline. A persistent systemd timer deletes /etc/sudoers.d/90-vps-forge-temp after 4 hours, even if the session drops or the server reboots. audit.sh shows the deadline, or says that a leftover grant has none.
• The restore drill restores the app's data and the newest database dump and compares them with the live files. Restoring /etc/hostname only proved that restic runs.
• Recon stops on Kubernetes nodes (k3s, kubeadm, rke2) and hypervisor hosts (Proxmox, libvirt, LXD/Incus). On RHEL-family systems it stops too, instead of following the same phases with different tools.
• The Caddyfile template starts HSTS at max-age=300. references/web.md describes raising it to a year once HTTPS works everywhere.
• Tailscale and CrowdSec come from their signed apt repositories, set up explicitly instead of through curl | sh.
• deadman.sh is installed through stdin, not through a file in a shared /tmp.
• New behaviour evals: a narrow request, a k3s node and a local nginx.conf question that must not trigger the skill.

Tests and tooling

• CI and make ci cover Ubuntu 26.04.
• GitHub Actions are pinned to commit SHAs.
• bench/demo.py records the dead-man switch demo in a systemd container and renders it as an animated SVG, and as frames for video.

v1.0.1

Text and documentation only. The scripts behave exactly as in 1.0.0.

Skill

• The skill's description now says when not to use it: RHEL/Fedora-family servers, Kubernetes nodes, Proxmox and other hypervisor hosts, managed hosting without root, and the user's own desktop. On Kubernetes nodes and hypervisor hosts, ufw default deny routed and strict rp_filter would break pod and VM networking.
• Safety rule 1 is now two rules: "never cut off access" (the dead-man switch, testing over a new connection, disarming, what the switch covers) and "never ban yourself" (the admin's IP on every exemption list before anything can count it). The content stays in SKILL.md, because the agent must not miss it.
• references/ssh.md no longer says a file created after arm can survive a rollback. The rollback deletes such files, and the tests check it. The temporary sudo grant survives only if it was created outside an armed window.
• The dead-man switch no longer claims to cover "VPN routing". It snapshots sshd, firewall, sudoers and PAM files, not WireGuard, Tailscale or netplan config. references/vpn.md now says so and warns against routing the server's own traffic into a tunnel.
• references/ssh.md notes that deadman snapshots hold root-only copies of the host keys. If you rotate the keys, delete the old snapshots too.

README

• Costs: a run with the skill cost a median $1.87 at API list prices, against $0.62 without it.
• New caveats:
  • the charts show a checklist score, not a general security index;
  • about 70% of the gap comes from three checks that match the skill's own defaults (ssh-audit, root login, login alerts), and results.md now has the scores without them;
  • the skill targets ssh-audit, and the judge checks ssh-audit;
  • there are three runs per cell, and the judge was written by the skill's author;
  • every prompt said the user was offline, so the intake questions and approvals were never tested.
• The no-agent audit.sh download is pinned to a release tag, and the check count reads 70+ (there are 76).
• The lockout section is reworded. No lockout is a design guarantee: the benchmark saw 0 lockouts in both arms. What it measured is the difference in self-bans.
• The replay moved above the install instructions, and the examples table is shorter.

How the skill was developed

• The public history starts at 1.0.0, but the skill was revised before that.
  • An earlier build scored 92, 100 and 89 on the first three benchmark scenarios.
  • In 12 of its 45 runs, the agent's own test logins tripped the fail2ban it had just installed.
• The revisions that followed are listed under 1.0.0:
  • fail2ban stays masked until the admin's IP is on its ignore list;
  • root moves to an admin user;
  • the hardened baseline applies to short checklists too.
• bench/README.md has both benchmark runs.

vps-forge 1.0.0

The first public release of vps-forge, an open Agent Skill that lets your AI coding agent set up, harden and audit a Debian or Ubuntu VPS without locking you out.

Install

npx skills add mountain-beaver/vps-forge

The README has the commands for Claude Code (plugin), Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode, gh skill, and others. For Claude.ai or Claude Desktop, upload vps-forge-skill.zip from this release under Settings → Capabilities → Skills.

What it does

• A phased workflow: recon, safety net, base, SSH, firewall, fail2ban, kernel, workload, backups, alerts, comfort, verify and document.
  • Three levels: baseline, hardened and paranoid.
  • Profiles: web, docker, vpn, db, worker and game.
• A dead-man switch around every SSH, firewall, sudo or PAM change. Each change is tested from a new connection. If that login fails, the change rolls back by itself after 5 minutes, and also at boot.
• audit.sh: a read-only audit with 40+ checks, a score and JSON output. external-check.sh: what the internet sees.
• Phone alerts through ntfy, Telegram or a webhook. restic backups with a restore test. A SERVER.md that explains every open port.

Benchmark

Claude Opus 5.5 ran the same four tasks with and without the skill. That was 120 runs on real Debian 12/13 and Ubuntu 22.04/24.04/26.04 VMs, scored from outside the server by a separate judge.

• Scores: 79–92 out of 100 without the skill, 99–100 with it.
• Lockouts: none.
• Self-bans: the agent banned its own admin IP in 7 of 60 runs without the skill, and in 0 of 60 with it.

The README lists every caveat:

• Opus is already good without the skill; the skill closes the last 8–20 points.
• The scenarios are not unseen: three of them were used while revising the skill.
• One check, root login, is a judgement call. Without it the scores are 85–93 vs 100.
• The skill does more than a short checklist asks, and that counts in its favour.
• Lynis barely moves.
• Runs take longer.
• Only one model was measured.

The full notes are in CHANGELOG.md.