Agent skill

Cis Benchmarks

by BagelHole in BagelHole/DevOps-Security-Agent-Skills

Audit and remediate CIS benchmark violations. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

Install Cis Benchmarks

skills CLI

$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install BagelHole/DevOps-Security-Agent-Skills cis-benchmarks --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/security/hardening/cis-benchmarks .claude/skills/cis-benchmarks && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "cis-benchmarks" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/hardening/cis-benchmarks into .claude/skills/cis-benchmarks/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cis-benchmarks", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/hardening/cis-benchmarks

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install BagelHole/DevOps-Security-Agent-Skills cis-benchmarks --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/security/hardening/cis-benchmarks .agents/skills/cis-benchmarks && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "cis-benchmarks" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/hardening/cis-benchmarks into .agents/skills/cis-benchmarks/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cis-benchmarks", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install BagelHole/DevOps-Security-Agent-Skills cis-benchmarks --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/security/hardening/cis-benchmarks .cursor/skills/cis-benchmarks && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "cis-benchmarks" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/hardening/cis-benchmarks into .cursor/skills/cis-benchmarks/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cis-benchmarks", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/BagelHole/DevOps-Security-Agent-Skills.git --path security/hardening/cis-benchmarks

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install BagelHole/DevOps-Security-Agent-Skills cis-benchmarks --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/security/hardening/cis-benchmarks .gemini/skills/cis-benchmarks && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "cis-benchmarks" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/hardening/cis-benchmarks into .gemini/skills/cis-benchmarks/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cis-benchmarks", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install BagelHole/DevOps-Security-Agent-Skills cis-benchmarks

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/security/hardening/cis-benchmarks .github/skills/cis-benchmarks && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "cis-benchmarks" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/hardening/cis-benchmarks into .github/skills/cis-benchmarks/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cis-benchmarks", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install BagelHole/DevOps-Security-Agent-Skills cis-benchmarks --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/security/hardening/cis-benchmarks .opencode/skills/cis-benchmarks && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "cis-benchmarks" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/security/hardening/cis-benchmarks into .opencode/skills/cis-benchmarks/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cis-benchmarks", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: cis-benchmarks
GitHub stars: 1.2k
Token cost: ~618 tokens
SKILL.md length: 65 words
Files: 1
Skills in repo: 44
Repo updated: May 22, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Audit and remediate CIS benchmark violations. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

Meeting compliance requirements
SKILL.md covers When to Use This Skill, Assessment Tools, Remediation Workflow and Best Practices, plus 1 more section
Calls apt and docker
Implementing security baselines

What it does

Cis Benchmarks is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines.

Its SKILL.md is about 620 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud. It works with Linux. The repository describes itself as: Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container… The licence is MIT.

When your agent uses it

Meeting compliance requirements
Implementing security baselines

Example prompts

“/cis-benchmarks”

Requirements

Docker

What it can do on your machine

Read from SKILL.md and the folder at commit 0365f57. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- apt
- docker
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use docker, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Cis Benchmarks loads about 618 tokens when it runs. Until then it costs about 55 tokens; SKILL.md has 65 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~55
When it runs · the whole SKILL.md, loaded when a task matches: ~618

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from BagelHole/DevOps-Security-Agent-Skills at commit 0365f57, republished under its MIT licence (© BagelHole). 65 words, ~618 tokens.

Download SKILL.mdSave it as .claude/skills/cis-benchmarks/SKILL.md (or your agent's skills folder).

name: cis-benchmarks
description: Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines.
license: MIT
metadata.author: devops-skills
metadata.version: 1.0

CIS Benchmarks

Implement and audit CIS security benchmarks.

When to Use This Skill

Use this skill when:

Assessing security compliance
Implementing security baselines
Meeting regulatory requirements
Hardening systems to standards

Assessment Tools

OpenSCAP

bash

# Install
apt install openscap-scanner scap-security-guide

# Run CIS benchmark scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results results.xml \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

Lynis

bash

# Install
apt install lynis

# Run audit
lynis audit system

# Generate report
lynis audit system --report-file /tmp/lynis-report.dat

InSpec

ruby

# cis-profile/controls/ssh.rb
control 'cis-ssh-1' do
  impact 1.0
  title 'Ensure SSH root login is disabled'
  
  describe sshd_config do
    its('PermitRootLogin') { should eq 'no' }
  end
end

control 'cis-ssh-2' do
  impact 0.7
  title 'Ensure SSH password authentication is disabled'
  
  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
  end
end

bash

# Run InSpec
inspec exec cis-profile -t ssh://user@target

Kubernetes CIS

bash

# kube-bench
docker run --rm -v /etc:/etc:ro -v /var:/var:ro \
  aquasec/kube-bench:latest run --targets node

# Check specific sections
kube-bench run --targets master --check 1.1,1.2

Remediation Workflow

yaml

workflow:
  1_scan:
    - Run automated assessment
    - Generate baseline report
    
  2_analyze:
    - Review findings
    - Identify false positives
    - Prioritize by risk
    
  3_remediate:
    - Apply fixes
    - Document exceptions
    - Verify changes
    
  4_validate:
    - Re-run assessment
    - Confirm remediation
    - Generate compliance report

Best Practices

Baseline before hardening
Document exceptions
Automate assessments
Track compliance over time
Regular re-assessment
Version control configurations

linux-hardening - Linux security
vulnerability-scanning - Security scanning

Files

Just SKILL.md in security/hardening/cis-benchmarks of BagelHole/DevOps-Security-Agent-Skills.

Open the folder on GitHubat commit 0365f57

Compare with similar skills

Cis Benchmarks next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Cis Benchmarks compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Cis Benchmarks this skillBagelHole/DevOps-Security-Agent-Skills	1.2k	—	~618	Automated safety check: Pass	MIT	4 mo ago
Openclaw Live Updateropenclaw/openclaw	392k	—	~3.7k	Automated safety check: Pass	MIT	today
Helm Chart ScaffoldingCybereason-Public/owLSM	280	13 repos	~381	Automated safety check: Pass	GPL-2.0	yesterday
Kubernetes ArchitectCybereason-Public/owLSM	280	9 repos	~2.6k	Automated safety check: Pass	GPL-2.0	yesterday
Swig CI Reproswig/swig	6.3k	—	~1.2k	Automated safety check: Pass	Custom licence	3 days ago
Youtubeeat-pray-ai/yutu	699	—	~1.1k	Automated safety check: Pass	MIT	2 days ago

Similar skills

Openclaw Live Updater
openclaw/openclaw
Maintain the canonical live OpenClaw main checkout, macOS LaunchAgent-managed Gateway, local macOS app, exact-head main CI, and recurring full release validation.
392k GitHub stars~3.7k tokensUpdated today
DevOps & CloudAuto-check passed
Helm Chart Scaffolding
Cybereason-Public/owLSM
Comprehensive guidance for creating, organizing, and managing Helm charts for packaging and deploying Kubernetes applications.
280 GitHub starsUsed in 13 repos~381 tokens
DevOps & CloudAuto-check passed
Kubernetes Architect
Cybereason-Public/owLSM
Expert Kubernetes architect specializing in cloud-native infrastructure, advanced GitOps workflows (ArgoCD/Flux), and enterprise container orchestration.
280 GitHub starsUsed in 9 repos~2.6k tokens
DevOps & CloudAuto-check passed
Swig CI Repro
swig/swig
Reproduce a GitHub Actions Linux CI failure locally when it does not happen on your machine: a podman/docker image that mirrors the ubuntu-22.04 runner by reusing the real Tools/CI-linux-.sh install…
6.3k GitHub stars~1.2k tokensUpdated 3 days ago
DevOps & CloudAuto-check passed
Youtube
eat-pray-ai/yutu
A skill your agent uses whenever the user mentions YouTube, video uploads, channel management, playlists, video SEO, or any YouTube Data API operation.
699 GitHub stars~1.1k tokensUpdated 2 days ago
DevOps & CloudAuto-check passed
.NET Crash Dump Collection
dotnet/skills
Official
Configures automatic crash dumps or captures dumps from running processes for modern .NET apps on Linux, macOS and Windows, including Docker and Kubernetes.
5.6k GitHub starsUsed in 2 repos~1.1k tokens
DevOps & CloudAuto-check passed

Questions about Cis Benchmarks

What does Cis Benchmarks do?

Audit and remediate CIS benchmark violations. An agent skill from BagelHole/DevOps-Security-Agent-Skills. Cis Benchmarks is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Audit and remediate CIS benchmark violations.

When should I use Cis Benchmarks?

Cis Benchmarks fits situations like: meeting compliance requirements; implementing security baselines.

How do I install Cis Benchmarks in Claude Code?

Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a claude-code`. Or copy the skill folder (security/hardening/cis-benchmarks in BagelHole/DevOps-Security-Agent-Skills) into .claude/skills/cis-benchmarks in your project. Claude Code loads it when a task matches its description.

How do I install Cis Benchmarks in Codex?

Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a codex`. Or copy the skill folder (security/hardening/cis-benchmarks in BagelHole/DevOps-Security-Agent-Skills) into .agents/skills/cis-benchmarks in your project. Codex loads it when a task matches its description.

Can I use Cis Benchmarks in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill cis-benchmarks -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cis-benchmarks, .gemini/skills/cis-benchmarks, .github/skills/cis-benchmarks and .opencode/skills/cis-benchmarks in your project.

What does Cis Benchmarks need to run?

Going by SKILL.md and its folder, Cis Benchmarks needs the command-line tools its instructions call (apt and docker). Our summary lists: Docker.

Does Cis Benchmarks access the network?

SKILL.md contains no URLs. Its commands use docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Cis Benchmarks safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Cis Benchmarks use?

Cis Benchmarks is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Cis Benchmarks use?

About 618 tokens (SKILL.md is roughly 2.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Cis Benchmarks?

Skills that share tags, products or a category with Cis Benchmarks: Openclaw Live Updater (openclaw/openclaw, 392k stars), Helm Chart Scaffolding (Cybereason-Public/owLSM, 280 stars), Kubernetes Architect (Cybereason-Public/owLSM, 280 stars) and Swig CI Repro (swig/swig, 6.3k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Cis Benchmarks?

BagelHole (a GitHub user) maintains it in BagelHole/DevOps-Security-Agent-Skills, which has 1,152 GitHub stars. The repository holds 44 skills in this directory. The repository was last updated on May 22, 2026.

Source: BagelHole/DevOps-Security-Agent-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Cis Benchmarks

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

CIS Benchmarks

When to Use This Skill

Assessment Tools

OpenSCAP

Lynis

InSpec

Kubernetes CIS

Remediation Workflow

Best Practices

Related Skills

Files

Compare with similar skills

Similar skills

More from BagelHole/DevOps-Security-Agent-Skills

Related

Questions about Cis Benchmarks