feat: add host-sec-check

skills/host-sec-check/scripts/collect.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# 只采集，不修改。用法: collect.sh [user@]host
+# 输出写到 stdout；完整日志建议重定向到文件。
+set -euo pipefail
+HOST="${1:?usage: collect.sh user@host}"
+SSH=(ssh -o BatchMode=yes -o ConnectTimeout=15 "$HOST")
+
+echo "===== host-sec-check collect $(date -u +%Y-%m-%dT%H:%M:%SZ) host=$HOST ====="
+
+remote() {
+  "${SSH[@]}" bash -s <<'EOS'
+set +e
+echo "----- id / os / uptime -----"
+id; hostname; uname -a
+. /etc/os-release 2>/dev/null; echo "$PRETTY_NAME"
+uptime
+echo "----- mem / hugepage / disk -----"
+free -h
+grep -E "MemAvailable|HugePages_|Hugetlb|SwapTotal" /proc/meminfo
+df -h
+echo "----- addresses -----"
+ip -4 addr; ip -6 addr show scope global
+echo "----- listen (may miss pid without root) -----"
+ss -lntup 2>/dev/null || netstat -lntup 2>/dev/null
+echo "----- docker -----"
+docker ps -a --format "table {{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null || echo "no docker"
+echo "----- preload (host cat; may be hidden) -----"
+ls -la /etc/ld.so.preload 2>/dev/null
+echo "preload_host=[$(cat /etc/ld.so.preload 2>/dev/null)]"
+echo "----- cron files -----"
+ls -la /etc/cron.d /etc/cron.hourly /etc/cron.daily 2>/dev/null
+echo "----- systemd extras -----"
+ls /etc/systemd/system/*.service 2>/dev/null
+echo "----- users uid0 / human -----"
+awk -F: '$3==0 || ($3>=1000 && $3<65534) {print}' /etc/passwd
+echo "----- sshd -----"
+grep -E "^(Port|PermitRootLogin|PasswordAuthentication|PubkeyAuthentication)" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/* 2>/dev/null
+echo "----- last -----"
+last -a | head -15
+EOS
+}
+
+remote
+
+# docker 组：从容器读 preload 真值
+if "${SSH[@]}" "groups | grep -qw docker" 2>/dev/null; then
+  echo "----- preload via alpine (bypass host libc) -----"
+  "${SSH[@]}" "docker run --rm --privileged -v /:/host alpine:latest hexdump -C /host/etc/ld.so.preload" 2>/dev/null \
+    || echo "alpine hexdump failed"
+fi
+
+echo "===== collect done ====="
+echo "下一步: 按 SKILL.md 解读；不要把本输出里的密钥贴进聊天。"