Hardening Python Packages

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

check-opencloud-security

Scanner for OpenCloud Security status

compose-lint

Security-focused linter for Docker Compose files. Catches dangerous misconfigurations before they reach production. Grounded in OWASP and CIS Docker Benchmark.

prowler-cloud

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

citellus

Automation Troubleshooting Framework to validate and report configuration, software installed, etc with bash, python, and your language of choice.

argus-security

Argus brings “a hundred eyes” to your project, combining leading open source security tools into a scalable, automated, continuous security pipeline.

gixy-next

Gixy-Next: NGINX Configuration Security Scanner & Performance Checker

vmware-harden

AI-native VMware compliance and baseline enforcement (CIS, vSphere SCG, 等保 2.0, PCI-DSS) — sibling to vmware-* skill family

presidio-hardened-x402

Security middleware for x402 agentic payments — PII redaction, spending policy, and replay detection before blockchain commit

graphenex

Automated System Hardening Framework

aws-gate

Better AWS SSM Session manager CLI client

presidio-hardened-x402-mcp

Pre-payment PII screener for x402 — MCP server wrapping presidio-hardened-x402

sshd-lint

Zero-dependency, offline static analyzer for OpenSSH sshd_config. Flags weak crypto, auth, and access-control settings for SSH hardening, referencing CIS, Mozilla, and NIST guidance, with CI-friendly exit codes.

risu

Automation Troubleshooting Framework to validate and report configuration, software installed, etc with bash, python, and your language of choice.

ohbs-image

CIS-hardened golden image builder for Tencent Cloud CVM — config-driven CLI, 13 OS profiles (Ubuntu/RHEL/TencentOS/Windows), bundled CIS engine, Packer + Ansible

ios-hardening-audit

Offline security hardening audit of Cisco IOS / IOS-XE running-configs

sshield

SSH server and client configuration hardening audit

stronghold

Easily configure macOS security settings from the terminal.

probolos

Deny-by-default USB gate for Linux. Unknown devices stay unauthorized until you approve them, after identity, consistency, behaviour and storage checks. Defends against BadUSB, rogue keyboards and suspicious sticks. Beta, research-stage.

drheaderplus

drHEADer helps with the audit of security headers received in response to a single request or a list of requests.

cvm-caspar

Quantitative, reproducible scoring of security configuration risk (CCSS / NISTIR 7502), with attack-chain detection. CASPAR is the reference implementation.

metabadger

Prevent SSRF attacks on AWS EC2 via automated upgrades to the more secure Instance Metadata Service v2 (IMDSv2).

presidio-hardened-angellist

Presidio security-hardened deal-flow triage & due-diligence toolkit for early-stage (pre-seed / seed) startups sourced via AngelList syndicates.

compose-harden

Automatically audit and harden Docker Compose files using security best practices.