Skip to content

v1.0.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 14:49
· 12 commits to main since this release
v1.0.1
0715a44

Text and documentation only. The scripts behave exactly as in 1.0.0.

Skill

  • The skill's description now says when not to use it: RHEL/Fedora-family servers, Kubernetes nodes, Proxmox and other hypervisor hosts, managed hosting without root, and the user's own desktop. On Kubernetes nodes and hypervisor hosts, ufw default deny routed and strict rp_filter would break pod and VM networking.
  • Safety rule 1 is now two rules: "never cut off access" (the dead-man switch, testing over a new connection, disarming, what the switch covers) and "never ban yourself" (the admin's IP on every exemption list before anything can count it). The content stays in SKILL.md, because the agent must not miss it.
  • references/ssh.md no longer says a file created after arm can survive a rollback. The rollback deletes such files, and the tests check it. The temporary sudo grant survives only if it was created outside an armed window.
  • The dead-man switch no longer claims to cover "VPN routing". It snapshots sshd, firewall, sudoers and PAM files, not WireGuard, Tailscale or netplan config. references/vpn.md now says so and warns against routing the server's own traffic into a tunnel.
  • references/ssh.md notes that deadman snapshots hold root-only copies of the host keys. If you rotate the keys, delete the old snapshots too.

README

  • Costs: a run with the skill cost a median $1.87 at API list prices, against $0.62 without it.
  • New caveats:
    • the charts show a checklist score, not a general security index;
    • about 70% of the gap comes from three checks that match the skill's own defaults (ssh-audit, root login, login alerts), and results.md now has the scores without them;
    • the skill targets ssh-audit, and the judge checks ssh-audit;
    • there are three runs per cell, and the judge was written by the skill's author;
    • every prompt said the user was offline, so the intake questions and approvals were never tested.
  • The no-agent audit.sh download is pinned to a release tag, and the check count reads 70+ (there are 76).
  • The lockout section is reworded. No lockout is a design guarantee: the benchmark saw 0 lockouts in both arms. What it measured is the difference in self-bans.
  • The replay moved above the install instructions, and the examples table is shorter.

How the skill was developed

  • The public history starts at 1.0.0, but the skill was revised before that.
    • An earlier build scored 92, 100 and 89 on the first three benchmark scenarios.
    • In 12 of its 45 runs, the agent's own test logins tripped the fail2ban it had just installed.
  • The revisions that followed are listed under 1.0.0:
    • fail2ban stays masked until the admin's IP is on its ignore list;
    • root moves to an admin user;
    • the hardened baseline applies to short checklists too.
  • bench/README.md has both benchmark runs.
Assets 3
Loading