Skip to content
Conduit

skill

linux-skills

A two-family Linux server management engine — 25 specialist skills, cross-distro shell library, and interactive sk-* scripts for Debian/Ubuntu and the RHEL family (Fedora, RHEL, Rocky, Alma).

peterbamuhigire/linux-skillscommunitylistedunreviewed
Use skill

Set up

Skills are installed by placing their folder where your agent loads skills.

Download ZIP from GitHub Open the repository

The download comes from github.com/peterbamuhigire/linux-skills itself, not from our server, so what you get is exactly what its author published.

Install instructions come from the README

Skills do not use an MCP config. Follow the steps in the README below.

README

synced Oct 25, 2026

Linux Skills

Linux Skills is an operations engine for administering Linux servers and the network equipment around them. Its 48 skills cover the working life of a host: provisioning and first boot, users and secrets, networking and DNS, web and mail services, systemd and virtualisation, storage, hardening, intrusion detection, observability, troubleshooting and disaster recovery, Bash automation, databases and caches, containers, backup and archiving, performance and kernel tuning, compliance auditing, and Cisco IOS/IOS-XE configuration review. A hub skill, linux-sysadmin, routes each request to the narrowest specialist. Every specialist carries a ## Distro support matrix covering both the Debian/Ubuntu and RHEL families (Fedora, RHEL, CentOS Stream, Rocky, Alma, Oracle). Every procedure declares its target, preconditions, a bounded change, a rollback route and a verification step. Mutating work is preview-first and needs explicit authority; evidence that is unavailable is recorded as NOT ASSESSED, never assumed.

The engine produces server provisioning plans and cloud-init, autoinstall and Kickstart files; Ansible desired-state playbooks; hardening and read-only security assessments; firewall, TLS and certificate configurations; site release and rollback runbooks; database backup, restore and point-in-time recovery procedures; container deployment specifications; observability and log-shipping configurations; incident diagnosis trees; recovery procedures; and 26 sk-* Bash scripts built on a shared common.sh contract. For network devices it produces bounded IOS change plans, Netmiko collection scripts and static configuration preflight reports. Its procedures follow the IETF RFCs for DNS, SMTP submission, TLS, HSTS, ACME, SPF, DKIM and DMARC. Compliance work uses CIS Benchmark and DISA STIG profiles through OpenSCAP and the SCAP Security Guide, and TLS work follows Mozilla's server-side TLS guidance. It is written for Linux administrators, infrastructure and network engineers, service owners and support teams, and for AI agents (Claude Code, Codex and others) acting on their behalf.

Installation

Prerequisites. Git. Node.js 18 or later for the clone installers and the plugin's destructive-command hook. Python 3.11 or later for the validators, tests and the Codex model-policy helper. Bash 4 on target servers for the sk-* scripts.

Claude Code plugin (recommended). The repository is its own marketplace (.claude-plugin/marketplace.json, marketplace chwezi-linux, plugin linux, version 1.1.0):

/plugin marketplace add https://github.com/peterbamuhigire/linux-skills
/plugin install linux@chwezi-linux

Clone installer. install.sh and install.ps1 delegate to scripts/install-engine.js. Scope is user (~/.claude, the default) or project (.claude under the current directory). Add --dry-run to preview.

git clone https://github.com/peterbamuhigire/linux-skills
cd linux-skills
./install.sh --scope project        # macOS, Linux or Git Bash
.\install.ps1 --scope project       # Windows PowerShell
node scripts/install-engine.js doctor --scope project

Server toolkit. On a managed Debian/Ubuntu or RHEL-family host, install the tier-1 sk-* scripts to /usr/local/bin and common.sh to /usr/local/lib/linux-skills/. Other skills' scripts install on first use (sudo scripts/install-skills-bin <skill-name>).

sudo scripts/install-skills-bin --dry-run core
sudo scripts/install-skills-bin core

scripts/setup-claude-code.sh is an optional, gated Claude Code bootstrap for a server. Review its --dry-run plan first. It needs explicit target, authority and recovery-file flags.

Codex. No installer is needed. Load AGENTS.md, then the selected SKILL.md. Before substantive work, check the Codex model policy with python .codex/ensure_model_policy.py --runtime codex --check. Claude skips this step.

Manual use. Clone the repository anywhere. Read CLAUDE.md (Claude Code) or AGENTS.md (any runner), then load linux-sysadmin/SKILL.md as the default route. Validate changes with python -X utf8 scripts/validate_skills.py and python -X utf8 -m pytest tests.

Capabilities

The engine has 48 active SKILL.md files: 44 specialists in 16 numbered categories, the linux-sysadmin hub and 3 meta skills. The authoring template in templates/ is excluded.

CategorySkillWhat it does
01 Provisioning and bootstrap (4)linux-cloud-initAuthors and debugs cloud-init user-data, Ubuntu autoinstall and RHEL Kickstart for first boot.
linux-config-managementKeeps repeatable server state with Ansible, etckeeper, check mode and drift remediation.
linux-package-managementInstalls, pins, upgrades and diagnoses packages and repositories with apt, dnf, snap and Flatpak.
linux-server-provisioningProvisions a fresh server interactively: identity, admin access, updates, firewall, services.
02 Users, access and secrets (2)linux-access-controlCreates, revokes and audits users, groups, SSH keys, sudo/wheel, PAM and permissions.
linux-secretsScans for leaked credentials, encrypts configuration with age, sops or GPG, and rotates secrets.
03 Networking and DNS (2)linux-dns-serverOperates BIND or Unbound: zones, validation, reloads, reverse zones and transfers.
linux-network-adminDiagnoses and configures interfaces, routes, client DNS, VLANs and time sync (Netplan, NetworkManager).
04 Web and mail services (3)linux-mail-serverOperates Postfix, Exim and Dovecot, mail queues, TLS and SPF/DKIM/DMARC.
linux-site-deploymentReleases one site from a pinned revision with vhost cutover, rollback and external verification.
linux-webstackInstalls, tunes and diagnoses Nginx, Apache/httpd, PHP-FPM and Node.js, including PHP security patching and staged branch upgrades.
05 Services and virtualisation (2)linux-service-managementOperates systemd units, timers, targets, journals, restart policy and cgroup limits.
linux-virtualizationRuns KVM/libvirt VMs and LXD system containers: lifecycle, snapshots, storage, networking.
06 Storage and filesystems (1)linux-disk-storageDiagnoses disk and inode pressure, cleans up measurably, manages swap and NFS/CIFS mounts.
07 Security and hardening (5)linux-firewall-sslChanges UFW/firewalld policy, issues and renews Certbot certificates, validates TLS exposure.
linux-intrusion-detectionOperates fail2ban and runs qualified rkhunter/chkrootkit checks.
linux-ngo-cyber-resilienceDesigns practical Linux security and incident resilience for NGOs and small mission-led teams.
linux-security-analysisPerforms a read-only, evidence-backed security assessment across all host layers.
linux-server-hardeningRemediates verified findings across SSH, firewall, MAC, services, permissions and updates.
08 Observability and logging (3)linux-log-managementAnalyses time-bounded journald and service logs and manages logrotate retention.
linux-observabilityAdds Prometheus/node_exporter metrics, central log shipping and health endpoints.
linux-system-monitoringTakes a read-only host-health snapshot of CPU, memory, I/O, network and backups.
09 Troubleshooting and recovery (2)linux-disaster-recoveryRecovers databases, files, configuration, boot state or filesystems from a verified backup.
linux-troubleshootingTriages a production incident across resources, services, web, database, TLS and deployments.
10 Automation and scripting (2)linux-bash-scriptingWrites and reviews portable sk-* scripts on the common.sh contract, with dry runs and gates.
linux-repo-syncRuns unattended or menu-driven Git updates that preserve local work.
11 Databases and caching (3)linux-inmemory-storesInstalls, secures, sizes and diagnoses Redis or Memcached.
linux-mysql-mariadbInstalls, secures, tunes, backs up and restores MySQL/MariaDB, including binlogs and PITR.
linux-postgresqlInstalls, authenticates, tunes, backs up and restores PostgreSQL, including WAL and PITR.
12 Containers and orchestration (3)linux-container-deploymentRuns, updates and supervises containers and Compose/Quadlet stacks under systemd.
linux-container-engineInstalls, hardens and diagnoses Docker or Podman engines, including rootless mode.
linux-image-hygieneMeasures and reclaims container storage and schedules safe pruning.
13 Backup and archiving (3)linux-archive-integrityCreates, signs, encrypts, verifies and restores metadata-preserving tar archives.
linux-filesystem-snapshotsCreates, replicates, mounts and rolls back LVM, Btrfs or ZFS snapshots.
linux-rsync-syncDesigns, previews, runs and verifies rsync mirrors, offsite copies and hard-linked backups.
14 Performance and kernel (3)linux-kernel-modulesInspects, loads, parameterises, persists and blacklists kernel modules.
linux-perf-profilingGathers read-only evidence of a regression with vmstat, iostat, pidstat, sar and perf.
linux-sysctl-tuningApplies measured, persistent network, writeback, swap and congestion-control sysctls.
15 Compliance and auditing (3)linux-auditd-rulesDesigns, tests, persists and queries auditd rules for forensic attribution.
linux-benchmark-scanningRuns read-only OpenSCAP or Lynis scans and drafts remediation.
linux-file-integrityEstablishes, checks and safely updates an AIDE baseline and triages drift.
16 Network equipment (3)cisco-ios-patternsReviews IOS/IOS-XE configuration and plans bounded router or switch changes.
netmiko-ssh-automationBuilds bounded, read-only-by-default Netmiko SSH collection for a named inventory.
network-config-validationPreflights device configuration for dangerous commands, overlaps and exposure.
Hub (1)linux-sysadminRoutes a server request to the right specialist across every category.
Meta (3)kaizen-improvement-systemAudits and improves this engine and the server products it produces.
skill-safety-auditReviews a new or changed skill for unsafe installers, credential capture or policy bypass.
skill-writingCreates or upgrades a skill under the canonical chwezi-dev-engine authoring standard.
Total48

References

Citations only. No book text is stored in this repository (see AGENTS.md, "Never store book extractions").

Books

Cited as grounding in skill references:

  • Atef, G. (2023) Mastering Ubuntu: A Comprehensive Guide to Linux's Favorite.
  • Blum, R. and Bresnahan, C. Linux Command Line and Shell Scripting Bible, 5th edn. Wiley.
  • Canonical. Ubuntu Server Guide Documentation (Linux 20.04 LTS, Focal).
  • Duguin, S. Cybersecurity for NGOs: Attack Prevention and Threat Response.
  • Gotangco, J. Red Hat Enterprise Linux 9 for System Administrators.
  • Gregg, B. Systems Performance: Enterprise and the Cloud, 2nd edn; and BPF Performance Tools.
  • Hitchcock, K. (2022) Linux System Administration for the 2020s: The Modern Sysadmin Leaving Behind the Culture of Build and Maintain. Apress.
  • Johnson, R. Fedora Linux Essentials Definitive Reference.
  • Kalsi, T. Practical Linux Security Cookbook. Packt.
  • Kerrisk, M. The Linux Programming Interface.
  • Kirch, O. and Dawson, T. (2000) Linux Network Administrator's Guide, 2nd edn. O'Reilly.
  • Taylor, D. and Perry, B. Wicked Cool Shell Scripts. No Starch Press.
  • Tevault, D. A. Mastering Linux Security and Hardening, 3rd edn. Packt.
  • van Vugt, S. Red Hat RHCSA 8 Cert Guide (EX200), 2nd edn.
  • Vickler. Linux Command Lines and Shell Scripting.
  • Beginner's Guide to the Unix Terminal (the repository gives no author).
  • Pro Bash (the repository gives no author).
  • RHEL 9 Recipes, recipes 37 and 39 (the repository gives no author).

Named in planning documents (docs/engine-upgrade-july-2026/05-reading-list.md, docs/evaluation/2026-04-13/suggested-reading.md) and "deepen with" notes for further grounding:

  • Beyer, B. et al. Site Reliability Engineering; and The Site Reliability Workbook.
  • Accelerate (the repository gives the title only).
  • Gregg, B. Linux Performance.
  • Hertzog and Mas. The Debian Administrator's Handbook.
  • Limoncelli, T. et al. The Practice of System and Network Administration.
  • Nemeth, E., Snyder, Hein, Whaley and Mackin. UNIX and Linux System Administration Handbook, 5th edn.
  • Rankin, K. Linux Hardening in Hostile Networks.
  • Riggs and Ciolli. PostgreSQL 16 Administration Cookbook. Packt.
  • Schwartz, B. et al. High Performance MySQL, 4th edn. O'Reilly.
  • Ward, B. How Linux Works, 3rd edn.
  • Redis in Action.
  • Terraform: Up & Running.

Repositories

Adapted into the engine:

  • Everything Claude Code (ECC): https://github.com/affaan-m/ECC. The three 16-network-equipment skills were adapted from ECC's cisco-ios-patterns, netmiko-ssh-automation and network-config-validation (imported 2026-09-20). The Pi-hole and VLAN references were adapted from homelab-pihole-dns and homelab-vlan-segmentation, and the OSI-layer network diagnostic workflow in linux-troubleshooting from agents/network-troubleshooter.md, and the Freeze Mode rule in rules/common/core.md from skills/safety-guard/SKILL.md. The installer's Git Bash path fix follows ECC's install.sh. docs/agent-runtime-safety.md draws on ECC's shortform, longform and security guides.
  • addyosmani/agent-skills: https://github.com/addyosmani/agent-skills (MIT, commit 2686b62). Four tier-1 lint rules in meta/skill-writing/scripts/quick_validate.py were paraphrased from scripts/lib/skill-lint.js (my-10-kaizen M10-03).
  • obra/superpowers: https://github.com/obra/superpowers (MIT, commit 8ca22db). The narrated-description check (SP-14) in quick_validate.py and the canonical skill-writing standard with a drift check (SP-04, M10-03/M10-04). The docs/superpowers/ plans use its planning format.
  • DietrichGebert/ponytail: https://github.com/DietrichGebert/ponytail (MIT). This is the thin CLAUDE.md → @AGENTS.md host-file bridge and single-source drift check (PT-01, PT-02, M10-02, commit 42b3c1b).
  • pbakaus/impeccable: https://github.com/pbakaus/impeccable (Apache-2.0). The PROJECT.md (project_schema: 1) read rule (IM-11, M10-12, commit 30ac859) and the "Impeccable-derived AS overlay" quality gate in AGENTS.md.
  • donvito/codex-astra-luna-orchestrator: https://github.com/donvito/codex-astra-luna-orchestrator. A concept reference for the .codex/ model-policy helper (inspected at commit 21f4561; implemented independently).
  • chwezi-dev-engine skill-writing standard: https://github.com/peterbamuhigire/chwezi-dev-engine/blob/main/skills/sdlc-meta/skill-writing/SKILL.md.

Tool projects documented by the skills:

Standards and official sources

Product documentation: Apache HTTP Server 2.4 (https://httpd.apache.org/docs/2.4/), nginx (https://nginx.org/en/docs/), PHP-FPM and OPcache (https://www.php.net/manual/), MySQL 8.0 Reference Manual (https://dev.mysql.com/doc/refman/8.0/), Podman (https://docs.podman.io/), Docker Engine, Compose and pruning (https://docs.docker.com/), cloud-init (https://cloudinit.readthedocs.io/), Certbot (https://eff-certbot.readthedocs.io/), Let's Encrypt documentation and rate limits (https://letsencrypt.org/docs/), Ansible (https://docs.ansible.com/), rclone (https://rclone.org/docs/), Fluent Bit (https://docs.fluentbit.io/), rsyslog (https://www.rsyslog.com/doc/), Postfix (https://www.postfix.org/documentation.html), netfilter (https://www.netfilter.org/documentation/), nftables wiki (https://wiki.nftables.org/), UFW (https://wiki.ubuntu.com/UncomplicatedFirewall), OpenSSL (https://www.openssl.org/docs/), Lynis (https://cisofy.com/lynis/), AIDE (https://aide.github.io/), rkhunter (https://rkhunter.sourceforge.net/), chkrootkit (https://www.chkrootkit.org/), sops (https://getsops.io), age (https://filippo.io/age), pre-commit (https://pre-commit.com), jq (https://stedolan.github.io/jq/manual/), GNU awk (https://www.gnu.org/software/gawk/manual/gawk.html), Debian manpages (https://manpages.debian.org/) and pytest cache (https://docs.pytest.org/en/stable/how-to/cache.html).

Websites and articles

↑↓ navigate openesc close