abzhaw/network-traffic-audit
meta/agents/security-agent/skills/02-network-traffic-audit/SKILL.md
Monitor active outbound connections from all services and flag unexpected destinations
testing
Updated Mar 27, 2026
$ install --global
skillsauthnpx skillsauth add abzhaw/juliaz_agents network-traffic-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 30, 2026, 12:35 PM56.6s1 file scanned
SKILL.md
- name:
- network-traffic-audit
- description:
- Monitor active outbound connections from all services and flag unexpected destinations
Skill: Network Traffic Audit
Purpose
Know exactly what this machine is talking to. Every outbound connection is either expected or suspicious. This skill makes that list visible every day.
What It Checks
- All active outbound connections from juliaz_agents processes
- Foreign IPs/domains vs. the known-good allowlist
- Any connection to unexpected countries or IP ranges
- WebSocket connections from the bridge
- OpenClaw's remote connections (if active)
Known-Good Destinations
api.openai.com — Julia's AI model
api.anthropic.com — Cowork MCP (Claude)
api.telegram.org — Telegram bot
smtp.gmail.com / imap.gmail.com — Email tools
medium.com — Julia medium agent
*.docker.com — Docker Hub pulls
localhost / 127.0.0.1 — Internal only
Commands
# Active outbound connections
lsof -i -n -P | grep ESTABLISHED
# DNS lookups (recent)
log show --predicate 'process == "mDNSResponder"' --last 1h 2>/dev/null | grep -i "query\|answer" | tail -50
Severity Rules
| Finding | Severity | |---------|----------| | Connection to unknown IP | 🟠 High | | Process making unexpected external call | 🟠 High | | High volume of outbound requests | 🟡 Medium | | Known-good connection | ⚪ Info |
Output Format
NETWORK AUDIT
✅ openai.com — orchestrator (expected)
✅ telegram.org — orchestrator (expected)
⚠️ Unknown: 185.220.101.x — process: node (PID 4521)
Related Skills
abzhaw/thesis-tracker
development
VerifiedTrustedCommunity
Fortschrittsverfolgung der Masterarbeit. Wortanzahl pro Kapitel, Fertigstellungsgrad, fehlende Elemente, Deadlines. Haelt den Ueberblick.
SKILL.mdUpdated Mar 27, 2026
abzhaw/thesis-structure
development
VerifiedTrustedCommunity
Kapitelarchitektur und Gliederung der Masterarbeit. Verwaltet die Struktur, schlaegt vor wo Inhalte hingehoeren, validiert den logischen Fluss zwischen Kapiteln.
SKILL.mdUpdated Mar 27, 2026
abzhaw/session-synthesizer
tools
VerifiedTrustedCommunity
Konvertiert Protokolleinträge und Session-Logs in thesis-fähiges deutsches Narrativ. Transformiert Entwicklungsdokumentation in akademische Prosa.
SKILL.mdUpdated Mar 27, 2026
abzhaw/research-scout
research
VerifiedTrustedCommunity
Sucht und analysiert akademische Literatur. Findet relevante Papers, erstellt strukturierte Zusammenfassungen. Zitiert NIEMALS — schlaegt nur vor.
SKILL.mdUpdated Mar 27, 2026