Skills it-operations

📦

it-operations

Name: it-operations
Author: davila7

Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Strengthen IT Operations and Service Reliability

IT teams need consistent methods for reliable services and incident response. This skill provides structured workflows, metrics, runbooks, automation guidance, and recovery practices.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "it-operations" from https://skillstore.io/skills/davila7-it-operations.md and its manifest at https://skillstore.io/api/skills/davila7-it-operations/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/davila7-it-operations.md Signed manifest GET /api/skills/davila7-it-operations/manifest Signed lockfile GET /api/skills/davila7-it-operations/lockfile

Test it

Using "it-operations". Create a P1 response plan for a customer-facing API outage.

Expected outcome:

Declare P1 and assign incident commander, operations lead, communications lead, and scribe.
Confirm impact, review recent changes, inspect dependencies, and prepare rollback.
Publish updates every 30 minutes and schedule a post-incident review.

Using "it-operations". Recommend monitoring for a PostgreSQL service.

Expected outcome:

Track availability, query latency, connection saturation, replication lag, storage growth, and backup freshness.
Page on sustained availability or data-risk conditions. Create tickets for capacity trends.
Link every alert to an owned dashboard and tested runbook.

Using "it-operations". Outline a quarterly disaster recovery exercise.

Expected outcome:

Confirm recovery objectives, owners, test scope, backups, dependencies, and communication channels.
Execute controlled failover, validate critical workflows, measure recovery, and return through an approved plan.
Record gaps, assign actions, and retest failed controls.

Security Audit

Critical

v9 • 7/23/2026 Open versioned report

Most detections are documentation syntax, placeholders, or authorized operations examples. Confirmed risks include destructive automation, weak access controls, unsafe credentials, and privileged infrastructure changes.

Files scanned

7,739

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (10)

Critical

reference/infrastructure.md:869

Disk destruction command

mkfs.ext4 /dev/data_vg/database_lv

The command formats a logical volume and destroys any filesystem data already present. No device identity check or explicit operator confirmation is required.

Critical

reference/infrastructure.md:870

Disk destruction command

mkfs.xfs /dev/data_vg/backups_lv

The command formats a logical volume and destroys any filesystem data already present. No device identity check or explicit operator confirmation is required.

Critical

reference/automation.md:1350-1391

Autonomous Process Termination

The continuous remediation loop kills the largest non-whitelisted process when memory exceeds 90 percent. It lacks workload identity checks and operator approval.

The code explicitly selects high-memory processes and calls kill every minute. Only three process names are excluded.

High

reference/automation.md:1210

System reconnaissance

hostname = command['text'] or 'all'

Unvalidated Slack command text is accepted as an Ansible host pattern. Inventory patterns can select more systems than the requester intended.

High

reference/automation.md:1216

System reconnaissance

['ansible', hostname, '-m', 'shell', '-a', '/opt/scripts/health_check.sh'],

Ansible runs a shell-based health script against the unvalidated host pattern. This creates remote command capability over managed inventory.

High

reference/infrastructure.md:212

Windows registry access

New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnec

The registry change enables Remote Desktop while the preceding firewall rule allows RDP broadly. This can expose administrative remote access.

High

reference/infrastructure.md:131

Systemd service enablement

systemctl enable node_exporter

The script persists a downloaded binary as a boot service without verifying its archive. Compromise of the download would become persistent privileged execution.

High

reference/automation.md:1171-1236

Missing ChatOps Authorization

Slack handlers restart services, target Ansible hosts, and approve deployments without checking caller roles or requiring a second approval.

The handlers accept command and action data, then perform privileged operations. No authorization or requester validation appears in the flow.

Show all 10 confirmed findings

High

reference/infrastructure.md:485-491 reference/monitoring.md:1274-1279

Insecure Default Credentials

Copy-ready examples configure HAProxy statistics with password123 and Grafana with admin. These defaults can expose operational dashboards when deployed unchanged.

Both examples contain explicit weak passwords in deployable configuration. Neither example requires secret injection or immediate rotation.

High

reference/infrastructure.md:378-423

Unsafe Firewall Replacement

The firewall script flushes active rules before establishing replacements. An interruption can remove protections or disconnect remote administrators without rollback.

The sequence visibly flushes all filter and NAT chains before saving new rules. No atomic loader, rollback timer, or access check is included.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

reference/infrastructure.md:869

Non-standard device file access

mkfs.ext4 /dev/data_vg/database_lv

mkfs.ext4 formats the named logical volume and irreversibly removes existing filesystem data. The copy-ready example lacks a verification gate.

Critical

reference/infrastructure.md:870

Non-standard device file access

mkfs.xfs /dev/data_vg/backups_lv

mkfs.xfs formats the named logical volume and irreversibly removes existing filesystem data. The copy-ready example lacks a verification gate.

High

reference/automation.md:1190

Python subprocess.run

result = subprocess.run(

A Slack command directly restarts production services through Ansible. The example checks service names but does not enforce operator authorization or approval.

High

reference/automation.md:1215

Python subprocess.run

result = subprocess.run(

User-supplied Slack text becomes the Ansible inventory target for a remote shell module. Missing target validation can broaden command execution across managed hosts.

High

reference/automation.md:1307

Python subprocess.run

subprocess.run(['find', '/var/log', '-name', '*.gz', '-mtime', '+30', '-delete'], check=False)

The autonomous remediation example deletes compressed logs older than 30 days across /var/log. It has no dry run, path boundary check, or approval.

High

reference/automation.md:1310

Python subprocess.run

subprocess.run(['find', '/tmp', '-mtime', '+7', '-delete'], check=False)

The autonomous remediation example deletes every item older than seven days under /tmp. It has no ownership check, exclusion list, or approval.

High

reference/automation.md:1342

Python subprocess.run

subprocess.run(['systemctl', 'restart', service_name], check=True, timeout=30)

The continuously running agent restarts services automatically when checks fail. A transient or incorrect check can cause repeated production disruption without approval.

High

reference/backup-recovery.md:278

AWS credential environment variables

export AWS_ACCESS_KEY_ID="your-access-key"

The backup script places a long-lived AWS access key directly in executable source. Replacing the placeholder would expose the credential through the script file.

High

reference/backup-recovery.md:279

AWS credential environment variables

export AWS_SECRET_ACCESS_KEY="your-secret-key"

The backup script places a long-lived AWS secret key directly in executable source. It does not direct users to a secret manager or workload identity.

High

reference/incident-management.md:1170

Generic API/secret keys

PAGERDUTY_API_KEY = "YOUR_API_KEY"

The PagerDuty example defines the API key in source code. Users who replace the placeholder can commit or disclose an incident-management credential.

High

reference/infrastructure.md:153

sudo privilege escalation

usermod -aG sudo opsuser

The baseline script grants the new operations account unrestricted sudo group membership. It provides no command scope, expiry, or separate approval.

High

reference/infrastructure.md:116

Hardcoded URL

wget -O /tmp/node_exporter.tar.gz https://github.com/prometheus/node_exporter/releases/download/v1.6

The root-level setup downloads a release archive and later enables its binary as a service without checksum or signature verification.

High

reference/infrastructure.md:202

Hardcoded URL

$nodeExporterUrl = "https://github.com/prometheus-community/windows_exporter/releases/download/v0.23

The PowerShell setup downloads an MSI and installs it without checksum or signature validation. A compromised download could execute with administrative privileges.

High

reference/infrastructure.md:943

Hardcoded IP address

--graphics vnc,listen=0.0.0.0 \

The VM example exposes its VNC console on every interface. No TLS, authentication requirement, or firewall restriction accompanies the setting.

High

reference/infrastructure.md:855

Non-standard device file access

pvcreate /dev/sdb

pvcreate writes LVM metadata to /dev/sdb and can overwrite existing disk metadata. The example omits device verification and a destructive-action warning.

High

reference/infrastructure.md:856

Non-standard device file access

pvcreate /dev/sdc

pvcreate writes LVM metadata to /dev/sdc and can overwrite existing disk metadata. The example omits device verification and a destructive-action warning.

High

reference/infrastructure.md:860

Non-standard device file access

vgcreate data_vg /dev/sdb /dev/sdc

vgcreate modifies both named block devices and can destroy existing storage metadata. No preflight validation or recovery instruction is provided.

High

reference/infrastructure.md:891

Non-standard device file access

lvremove /dev/data_vg/database_snap

lvremove deletes the named snapshot. The command has no explicit confirmation option, identifier check, or warning about selecting the wrong volume.

Risk Factors

⚙️ External commands (50)

🌐 Network access (50)

📁 Filesystem access (44)

🔑 Env variables (8)

reference/automation.md:1093 reference/automation.md:1094 reference/automation.md:1134 reference/automation.md:1135 reference/backup-recovery.md:278 reference/backup-recovery.md:279 reference/incident-management.md:1170 reference/incident-management.md:1178

Detected Patterns

System reconnaissance×2Windows registry accessDisk destruction command×2Systemd service enablement

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/davila7-it-operations/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/davila7-it-operations/security.svg)](https://skillstore.io/skills/davila7-it-operations?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/davila7-it-operations?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-it-operations/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/davila7-it-operations.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

davila7. (2026). it-operations security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-it-operations/audits/9

BibTeX citation

@techreport{davila7-davila7-it-operations-2026,
  author = {davila7},
  title = {it-operations security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/davila7-it-operations/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "it-operations security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-it-operations/audits/9"
identifiers:
  - type: other
    value: "skillstore:davila7-it-operations:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Establish Operations Foundations

Create monitoring, on-call, change, backup, and documentation practices for a growing technical organization.

Coordinate Service Incidents

Classify impact, assign response roles, communicate status, follow diagnostics, and prepare a blameless review.

Improve Platform Reliability

Evaluate alerts, capacity, toil, automation opportunities, recovery objectives, and infrastructure lifecycle practices.

Try These Prompts

Create an Operations Checklist

Create a weekly IT operations checklist for [systems]. Include monitoring, backups, access reviews, patching, and documentation.

Design an Incident Runbook

Draft a runbook for [incident]. Include severity, diagnostics, roles, communications, rollback, validation, and escalation.

Plan Monitoring Coverage

Design monitoring for [service]. Define SLIs, SLOs, golden signals, alert thresholds, dashboards, and ownership.

Assess an Automation Proposal

Review this automation plan: [plan]. Identify privileges, failure modes, approvals, safeguards, rollback, audit requirements, and measurable benefits.

Best Practices

Test commands in isolated environments and require approvals for privileged or destructive changes.
Define service ownership, measurable objectives, escalation paths, and tested rollback procedures.
Review alerts, runbooks, backups, access, capacity, and recovery results on a regular schedule.

Avoid

Do not copy example credentials, addresses, device names, or destructive commands into production.
Do not allow ChatOps or self-healing automation to act without authorization, boundaries, and audit logs.
Do not treat successful backups as proof of recovery without regular restoration tests.