@shuyhere/takotako 0.0.1

package/skills/find-skills/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: find-skills
+description: Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
+---
+
+# Find Skills
+
+This skill helps you discover and install skills from the open agent skills ecosystem.
+
+## When to Use This Skill
+
+Use this skill when the user:
+
+- Asks "how do I do X" where X might be a common task with an existing skill
+- Says "find a skill for X" or "is there a skill for X"
+- Asks "can you do X" where X is a specialized capability
+- Expresses interest in extending agent capabilities
+- Wants to search for tools, templates, or workflows
+- Mentions they wish they had help with a specific domain (design, testing, deployment, etc.)
+
+## What is the Skills CLI?
+
+The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.
+
+**Key commands:**
+
+- `npx skills find [query]` - Search for skills interactively or by keyword
+- `npx skills add <package>` - Install a skill from GitHub or other sources
+- `npx skills check` - Check for skill updates
+- `npx skills update` - Update all installed skills
+
+**Browse skills at:** https://skills.sh/
+
+## How to Help Users Find Skills
+
+### Step 1: Understand What They Need
+
+When a user asks for help with something, identify:
+
+1. The domain (e.g., React, testing, design, deployment)
+2. The specific task (e.g., writing tests, creating animations, reviewing PRs)
+3. Whether this is a common enough task that a skill likely exists
+
+### Step 2: Search for Skills
+
+Run the find command with a relevant query:
+
+```bash
+npx skills find [query]
+```
+
+For example:
+
+- User asks "how do I make my React app faster?" → `npx skills find react performance`
+- User asks "can you help me with PR reviews?" → `npx skills find pr review`
+- User asks "I need to create a changelog" → `npx skills find changelog`
+
+The command will return results like:
+
+```
+Install with npx skills add <owner/repo@skill>
+
+vercel-labs/agent-skills@vercel-react-best-practices
+└ https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices
+```
+
+### Step 3: Present Options to the User
+
+When you find relevant skills, present them to the user with:
+
+1. The skill name and what it does
+2. The install command they can run
+3. A link to learn more at skills.sh
+
+Example response:
+
+```
+I found a skill that might help! The "vercel-react-best-practices" skill provides
+React and Next.js performance optimization guidelines from Vercel Engineering.
+
+To install it:
+npx skills add vercel-labs/agent-skills@vercel-react-best-practices
+
+Learn more: https://skills.sh/vercel-labs/agent-skills/vercel-react-best-practices
+```
+
+### Step 4: Offer to Install
+
+If the user wants to proceed, you can install the skill for them:
+
+```bash
+npx skills add <owner/repo@skill> -g -y
+```
+
+The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts.
+
+## Common Skill Categories
+
+When searching, consider these common categories:
+
+| Category        | Example Queries                          |
+| --------------- | ---------------------------------------- |
+| Web Development | react, nextjs, typescript, css, tailwind |
+| Testing         | testing, jest, playwright, e2e           |
+| DevOps          | deploy, docker, kubernetes, ci-cd        |
+| Documentation   | docs, readme, changelog, api-docs        |
+| Code Quality    | review, lint, refactor, best-practices   |
+| Design          | ui, ux, design-system, accessibility     |
+| Productivity    | workflow, automation, git                |
+
+## Tips for Effective Searches
+
+1. **Use specific keywords**: "react testing" is better than just "testing"
+2. **Try alternative terms**: If "deploy" doesn't work, try "deployment" or "ci-cd"
+3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills`
+
+## When No Skills Are Found
+
+If no relevant skills exist:
+
+1. Acknowledge that no existing skill was found
+2. Offer to help with the task directly using your general capabilities
+3. Suggest the user could create their own skill with `npx skills init`
+
+Example:
+
+```
+I searched for skills related to "xyz" but didn't find any matches.
+I can still help you with this task directly! Would you like me to proceed?
+
+If this is something you do often, you could create your own skill:
+npx skills init my-xyz-skill
+```

package/skills/security-audit/SKILL.md

@@ -0,0 +1,181 @@
+---
+name: security-audit
+description: Host security hardening and risk-tolerance audit for Tako deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, Docker security checks, or version status checks on a machine running Tako.
+---
+
+# Security Audit
+
+Host security hardening and risk-tolerance audit for Tako deployments.
+
+## Core Rules
+
+- **Require explicit approval** before any state-changing action
+- **Never modify remote access** without confirming how the user connects
+- **Prefer reversible, staged changes** — one thing at a time
+- **Every choice set must be numbered** for easy reply
+- **Recommend running with a powerful model** for best results (e.g. claude-opus-4-6)
+
+## Audit Flow
+
+### Step 1: Context Gathering (read-only)
+
+Before making any recommendations, gather the environment context. Run these checks silently and summarize the findings:
+
+1. **OS and version** — `cat /etc/os-release` or `sw_vers` (macOS)
+2. **Privilege level** — `whoami`, check if running as root vs regular user
+3. **Access path** — How is the user connected? (local terminal, SSH, tailnet, etc.)
+4. **Network exposure** — Check for public IP (`curl -s ifconfig.me`), reverse proxy, tunnels
+5. **Tako gateway status** — Read `~/.tako/tako.json` for bind address and port; check if the process is running
+6. **Docker status** — Is Docker installed? Running? What containers are active? Security options enabled?
+7. **Backup system** — Any backup tooling detected? (restic, borg, timeshift, etc.)
+
+Present findings as a summary table:
+
+```
+Environment Summary
+═══════════════════
+OS:           Ubuntu 24.04 LTS
+User:         shuyhere (non-root)
+Access:       SSH (key-based)
+Public IP:    203.0.113.42
+Tako bind:    127.0.0.1:18790 (localhost only) ✅
+Docker:       running, 2 containers
+Firewall:     ufw active
+Backups:      not detected ⚠️
+```
+
+### Step 2: Risk Tolerance Assessment
+
+Ask the user to pick their risk level. This determines the strictness of recommendations:
+
+```
+What's your risk tolerance for this machine?
+
+  1) Minimal   — Personal laptop, home network, low risk
+  2) Standard  — Shared network, some exposure, moderate risk
+  3) Hardened  — Production server, public-facing, high security
+  4) Maximum   — Critical infrastructure, zero trust
+```
+
+Default to **Standard** if the user doesn't specify.
+
+Risk level determines thresholds:
+- **Minimal**: Only flag critical issues (open root SSH, no firewall on public IP)
+- **Standard**: Flag important issues + suggest common hardening
+- **Hardened**: All checks strict, recommend fail2ban, audit logging, container scanning
+- **Maximum**: Zero trust posture, all ports closed except explicit, mandatory encryption, immutable containers
+
+### Step 3: Security Checks (automated)
+
+Run these checks and report pass/warn/fail for each:
+
+#### Network & Access
+- [ ] Tako gateway bind address (localhost vs LAN vs public)
+- [ ] Open ports scan (`ss -tlnp` or `netstat -tlnp`)
+- [ ] Firewall status (ufw/iptables/nftables/firewalld)
+- [ ] SSH configuration (key-only auth, no root login, non-default port)
+- [ ] SSL/TLS for any exposed endpoints
+
+#### Docker & Containers
+- [ ] Docker container security (non-root user, read-only rootfs, network isolation)
+- [ ] Docker socket permissions (`/var/run/docker.sock` group access)
+- [ ] Container image vulnerability scan (if `trivy` or `grype` is available)
+- [ ] Docker daemon configuration (`/etc/docker/daemon.json` — userns-remap, no-new-privileges)
+
+#### Tako-Specific
+- [ ] Auth token/API key exposure (env vars in process list, file permissions on `~/.tako/.env`)
+- [ ] Tako config file permissions (`~/.tako/` should be `700`, files `600`)
+- [ ] Sandbox configuration review (sandbox mode, workspace access level)
+- [ ] Gateway auth token set (should be enabled for non-localhost binds)
+
+#### System
+- [ ] System updates pending (`apt list --upgradable` / `dnf check-update`)
+- [ ] Unattended upgrades configured (for security patches)
+- [ ] Failed login attempts (`journalctl` or `/var/log/auth.log`)
+
+Present results as a checklist:
+
+```
+Security Checks
+═══════════════
+✅ Tako bind: localhost only
+✅ Firewall: ufw active, default deny
+⚠️  SSH: password authentication still enabled
+❌ Tako permissions: ~/.tako/ is 755, should be 700
+✅ Docker: non-root user in container
+⚠️  Updates: 12 packages upgradable (3 security)
+❌ Auth token: not set (required for non-localhost)
+✅ Sandbox: enabled for non-main sessions
+```
+
+### Step 4: Recommendations
+
+Based on the risk level and check results, provide **numbered actionable recommendations**.
+
+Each recommendation must include:
+
+1. **What to do** — Clear one-line description
+2. **Why it matters** — The risk if not addressed
+3. **How to do it** — Exact command(s) to run
+4. **How to undo it** — Rollback command if something goes wrong
+
+Format:
+
+```
+Recommendation 1: Lock down Tako config permissions
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Why:    ~/.tako/ contains API keys and auth tokens. World-readable
+        permissions expose credentials to other users on the system.
+Fix:    chmod 700 ~/.tako && chmod 600 ~/.tako/.env ~/.tako/tako.json
+Undo:   chmod 755 ~/.tako && chmod 644 ~/.tako/.env ~/.tako/tako.json
+Risk:   ❌ Critical (credential exposure)
+```
+
+**Always ask for approval before running any fix commands.**
+
+Present all recommendations at once, then ask:
+
+```
+Which recommendations should I apply? (e.g. "1,3,5" or "all" or "none")
+```
+
+### Step 5: Periodic Audit
+
+After the initial audit, suggest setting up recurring checks:
+
+#### Option A: Tako Heartbeat Integration
+If Tako's heartbeat system is configured, suggest adding a security check to the heartbeat prompt:
+
+```
+Add to your heartbeat prompt in tako.json:
+"During heartbeat, run a quick security check: verify Tako bind address,
+check for pending security updates, and confirm ~/.tako permissions."
+```
+
+#### Option B: Cron Job
+Suggest a lightweight cron job using the bundled audit script:
+
+```bash
+# Run security audit weekly, log results
+0 9 * * 1 /path/to/tako/skills/security-audit/audit.sh >> ~/.tako/security-audit.log 2>&1
+```
+
+#### Option C: Manual
+Remind the user they can re-run this skill anytime:
+```
+Just ask: "run a security audit" or "check my security posture"
+```
+
+## Quick Audit Mode
+
+If the user says "quick audit" or "quick security check", skip the risk assessment and run all checks at Standard level, presenting only warnings and failures (skip passes).
+
+## Tool: audit.sh
+
+A standalone bash script is available at `skills/security-audit/audit.sh` for quick command-line audits outside of Tako. Run it with:
+
+```bash
+bash skills/security-audit/audit.sh
+```
+
+This performs a subset of the automated checks and prints results to stdout.

package/skills/security-audit/audit.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Tako Security Audit — quick check script
+set -euo pipefail
+
+echo "🐙 Tako Security Audit"
+echo "======================"
+
+# Check Tako bind
+echo ""
+echo "## Tako Gateway"
+if [ -f ~/.tako/tako.json ]; then
+    echo "Config: $(grep -o '"bind"[^,}]*' ~/.tako/tako.json 2>/dev/null || echo 'default')"
+else
+    echo "Config: not found"
+fi
+
+# Check Docker
+echo ""
+echo "## Docker"
+if command -v docker &>/dev/null; then
+    echo "Docker: installed"
+    docker info --format '{{.SecurityOptions}}' 2>/dev/null || echo "Cannot read docker info"
+else
+    echo "Docker: not installed"
+fi
+
+# Check firewall
+echo ""
+echo "## Firewall"
+if command -v ufw &>/dev/null; then
+    sudo ufw status 2>/dev/null || echo "ufw: cannot check (need sudo)"
+elif command -v firewall-cmd &>/dev/null; then
+    sudo firewall-cmd --state 2>/dev/null || echo "firewalld: cannot check"
+else
+    echo "No firewall tool found"
+fi
+
+# Check SSH
+echo ""
+echo "## SSH"
+if [ -f /etc/ssh/sshd_config ]; then
+    echo "PermitRootLogin: $(grep -i '^PermitRootLogin' /etc/ssh/sshd_config 2>/dev/null || echo 'default')"
+    echo "PasswordAuth: $(grep -i '^PasswordAuthentication' /etc/ssh/sshd_config 2>/dev/null || echo 'default')"
+else
+    echo "sshd_config: not found"
+fi
+
+# Check open ports
+echo ""
+echo "## Open Ports"
+if command -v ss &>/dev/null; then
+    ss -tlnp 2>/dev/null | head -20
+elif command -v netstat &>/dev/null; then
+    netstat -tlnp 2>/dev/null | head -20
+fi
+
+# Check file permissions
+echo ""
+echo "## Tako File Permissions"
+if [ -d ~/.tako ]; then
+    ls -la ~/.tako/ 2>/dev/null
+else
+    echo "~/.tako not found"
+fi
+
+echo ""
+echo "Audit complete."