Skip to content
Get packs

Guide · Agent skill

How to use the Brigade Host Hardening agent skill (healthcheck)

Updated · written with AI from the project's own documentation and checked against our catalogue data

The healthcheck skill, published as Brigade Host Hardening, teaches an AI agent to review the security posture of the machine running the Brigade assistant. It covers open ports, firewall, SSH access, disk encryption, backups and update status, then proposes a numbered remediation plan matched to a risk level you choose. This guide is for people who have never used agent skills and want to install it, trigger it and understand what it will and will not do.

Brigade Host Hardeningspinabot/brigade · MIT

Quick start

  1. 1Install Brigade. Confirm Brigade is installed on the machine you want to review, since the skill depends on its security audit and update status commands.
  2. 2Download the skill ZIP. Download the ZIP for skills/healthcheck from the page.
  3. 3Unzip into a skills folder. Unzip into ~/.claude/skills/ for personal use or the project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  4. 4Ask for a security review. Describe what you want in plain language, for example asking for a security audit of the machine running Brigade.
  5. 5Approve read-only checks. Give one-sentence permission for the read-only checks so the agent can run OS, port, firewall, backup and Brigade audit commands.
  6. 6Pick a risk profile. Choose a numbered profile or describe custom requirements, then review the remediation plan.
  7. 7Approve steps one at a time. Choose an execution option and approve each command, confirming access and rollback before any change.

What is an agent skill and what does healthcheck do?

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a request matches the skill's description. The healthcheck skill is for hosts running Brigade, such as a laptop, workstation, Raspberry Pi or VPS.

When installed, the agent checks open ports, firewall, SSH access, disk encryption, backups and update status. It runs Brigade's own security audit and version check, then proposes a numbered plan. The skill states it will show every command and rollback step and wait for your approval before changing anything.

  • Read-only checks first, such as OS details, listening ports and firewall status
  • Runs brigade security audit --deep as a default read-only check
  • Runs brigade update status to report the current channel and whether an update is available
  • Offers optional fixes numbered for a single-digit reply

Install the healthcheck skill

Download the ZIP for skills/healthcheck from the page, then choose one of two routes. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

  • Personal: unzip into ~/.claude/skills/
  • Project only: unzip into the project's .claude/skills/ folder
  • Claude apps: Settings → Capabilities → Skills, then upload

What you need before you start

Brigade must already be installed on the host, because the skill uses the brigade security audit and brigade update status commands. The skill also relies on operating system tools that depend on your platform.

Scheduling periodic checks is optional and requires Brigade cron scheduling.

  • Brigade installed on the host
  • Linux: uname, ss or lsof, and one of ufw, firewall-cmd or nft
  • macOS: socketfilterfw, pfctl and tmutil
  • Optional: Brigade cron scheduling for periodic checks

How to trigger the skill with natural requests

You do not need a special command. Describe what you want in plain language on the machine running Brigade. Requests that match the skill's description include security audits, firewall, SSH or update hardening, risk posture, exposure review, scheduling periodic checks, and version status checks.

The agent will ask once for permission to run read-only checks. Answer with a single sentence of approval if you are comfortable with that. It will then ask only for information it could not infer.

  • "Run a security audit on this machine."
  • "Review what is exposed on this server to the internet."
  • "Check whether Brigade is up to date."
  • "Help me harden the firewall and SSH on my VPS for Brigade."
  • "Set up a periodic security check for my Brigade gateway."

Choose a risk profile and review the plan

After the system context is known, the agent asks you to pick a risk posture. You can choose one of four numbered profiles or describe your own requirements. Most users pick Home/Workstation Balanced.

The agent shows the full remediation plan before any change. Then it offers four numbered options: do it step by step with approvals, show the plan only, fix only critical issues, or export commands for later.

  • 1. Home/Workstation Balanced (most common): firewall on, remote access limited to LAN or tailnet
  • 2. VPS Hardened: deny-by-default inbound, minimal open ports, key-only SSH, no root login, automatic security updates
  • 3. Developer Convenience: more local services allowed, with explicit exposure warnings, still audited
  • 4. Custom: your own constraints for services, exposure, update cadence and access methods
brigade security audit --deep

Approve changes one step at a time

For each step the agent shows the exact command, explains the impact and rollback, and confirms access will remain available. It stops and asks for guidance if output is unexpected. Firewall rules, port changes, SSH changes, package installs, service changes, user changes, scheduled tasks and update policy changes all require your explicit approval.

Brigade's --fix option only tightens Brigade defaults and file permissions. It does not change host firewall, SSH or OS update policies, and those changes are made with separate commands.

  • Confirm how you connect before any remote access change
  • Keep an existing session open while testing SSH or firewall changes
  • After changes, the agent re-checks firewall, listening ports, remote access and the audit
brigade security audit --fix

Schedule periodic checks

Ongoing monitoring is optional. The skill recommends using the Brigade cron tool or CLI to schedule periodic audits through the Gateway scheduler. The agent will not create scheduled tasks without your explicit approval, and it aims to keep secrets out of logs.

When a scheduled run is headless, its output includes a note telling you to call healthcheck so issues can be fixed.

What people use it for

  • Reviewing a personal laptop or workstation running Brigade for open ports and firewall status
  • Hardening a VPS that hosts an always-on Brigade gateway with key-only SSH and deny-by-default inbound rules
  • Checking a Raspberry Pi running Brigade for disk encryption, backups and update status
  • Checking whether the installed Brigade version has an update available on its current channel
  • Setting up a periodic audit schedule for a headless Brigade gateway

Frequently asked questions

Is the healthcheck skill free and what is its licence?

The skill is published under the MIT licence, as listed on this page. The source does not mention pricing, so check the repository for any terms beyond the licence.

What do I need to install the healthcheck skill?

You need Brigade installed on the host, since the skill uses brigade security audit and brigade update status. You also need OS tools such as ss or lsof, and ufw, firewall-cmd or nft on Linux, or socketfilterfw, pfctl and tmutil on macOS.

Where do I put the healthcheck skill folder?

Unzip the downloaded ZIP into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can upload it under Settings → Capabilities → Skills.

Will the skill change my firewall or SSH settings automatically?

No. The skill says it shows every command and rollback step and waits for your approval before any state-changing action. Brigade itself does not change the host firewall, SSH or OS updates.

Does the healthcheck skill use the network?

The listing states it does not use the network, but it does run scripts. Review the files before installing if that matters to you.

Is this skill a good alternative to a managed security service?

The source does not compare it with other tools. It is best for reviewing a Brigade host and planning changes you approve, and it is not suited to shared or corporate machines where another administrator sets policy.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you run Brigade on a personal laptop, workstation, Raspberry Pi or VPS and want a reviewed, step-by-step security plan with your approval at each change. Skip it if you expect Brigade to manage your firewall, SSH or updates, if another administrator owns the machine's security policy, or if you want hardening applied automatically without reading the commands.

Download the skill