cis-benchmarks

Q: How do I install cis-benchmarks?

Run npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill cis-benchmarks in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/cis-benchmarks/ (personal) or .claude/skills/cis-benchmarks/ (project).

by bagelholeSecurity

Audit and remediate CIS benchmark violations. Use automated tools to assess compliance and implement hardening recommendations. Use when meeting compliance requirements or implementing security baselines.

Installs: 370
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill cis-benchmarks

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads cis-benchmarks automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

CIS Benchmarks

Implement and audit CIS security benchmarks.

When to Use This Skill

Use this skill when:

Assessing security compliance
Implementing security baselines
Meeting regulatory requirements
Hardening systems to standards

Assessment Tools

OpenSCAP

# Install
apt install openscap-scanner scap-security-guide

# Run CIS benchmark scan
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results results.xml \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

Lynis

# Install
apt install lynis

# Run audit
lynis audit system

# Generate report
lynis audit system --report-file /tmp/lynis-report.dat

InSpec

# cis-profile/controls/ssh.rb
control 'cis-ssh-1' do
  impact 1.0
  title 'Ensure SSH root login is disabled'
  
  describe sshd_config do
    its('PermitRootLogin') { should eq 'no' }
  end
end

control 'cis-ssh-2' do
  impact 0.7
  title 'Ensure SSH password authentication is disabled'
  
  describe sshd_config do
    its('PasswordAuthentication') { should eq 'no' }
  end
end

# Run InSpec
inspec exec cis-profile -t ssh://user@target

Kubernetes CIS

# kube-bench
docker run --rm -v /etc:/etc:ro -v /var:/var:ro \
  aquasec/kube-bench:latest run --targets node

# Check specific sections
kube-bench run --targets master --check 1.1,1.2

Remediation Workflow

workflow:
  1_scan:
    - Run automated assessment
    - Generate baseline report
    
  2_analyze:
    - Review findings
    - Identify false positives
    - Prioritize by risk
    
  3_remediate:
    - Apply fixes
    - Document exceptions
    - Verify changes
    
  4_validate:
    - Re-run assessment
    - Confirm remediation
    - Generate compliance report

Best Practices

Baseline before hardening
Document exceptions
Automate assessments
Track compliance over time
Regular re-assessment
Version control configurations

Related Skills

linux-hardening - Linux security
vulnerability-scanning - Security scanning

FAQ

What does the cis-benchmarks skill do?

How do I install cis-benchmarks?

Run npx skills add https://github.com/bagelhole/devops-security-agent-skills --skill cis-benchmarks in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/cis-benchmarks/ (personal) or .claude/skills/cis-benchmarks/ (project).

Which AI agents can use cis-benchmarks?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is cis-benchmarks safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains cis-benchmarks?

It is published by bagelhole in bagelhole/devops-security-agent-skills. It has 370 recorded installs.