ariffazil/FORGE-infra-guardian
skills/_retired/ARCHIVE-dupe-2026-07-12/root_.agents_skills/FORGE-infra-guardian/SKILL.md
Validate Caddy reverse proxy configs, Cloudflare Origin CA SSL expiry, DNS parity, tunnel status, and Cloudflare tunnel exposure. USE WHEN: "check SSL", "Caddy config valid", "tunnel status", "DNS parity", "SSL expiry", "infra health", "Cloudflare check".
$ install --global
skillsauthnpx skillsauth add ariffazil/openclaw-workspace FORGE-infra-guardianInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 17, 2026, 3:30 AM26.2s1 file scanned
SKILL.md
- name:
- FORGE-infra-guardian
- description:
- >
- USE WHEN:
- check SSL", "Caddy config valid", "tunnel status",
Infra Guardian
Validates the infrastructure layer — SSL, DNS, reverse proxy, tunnels.
What It Checks
SSL Certificate
# Check SSL expiry for all managed domains
echo | openssl s_client -servername geox.arif-fazil.com -connect geox.arif-fazil.com:443 2>/dev/null | openssl x509 -noout -dates
# Origin CA check (Cloudflare Origin)
curl -s https://geox.arif-fazil.com/.well-known/agent-card.json | head -c 100
# All managed domains
for domain in geox.arif-fazil.com mcp.arif-fazil.com openclaw.arif-fazil.com; do
echo -n "$domain: "
echo | openssl s_client -servername "$domain" -connect "$domain:443" 2>/dev/null | openssl x509 -noout -enddate
done
Caddy Config
# Validate Caddyfile syntax
caddy validate --config /etc/caddy/Caddyfile 2>&1
# Test config reload
caddy reload --config /etc/caddy/Caddyfile 2>&1
Cloudflare Tunnel
# Check cloudflared tunnel status
cloudflared tunnel list 2>/dev/null
cloudflared tunnel run --token "$(cat /root/.cloudflared/tunnel-token 2>/dev/null)" 2>&1 | head -5 &
DNS Parity
# Compare Cloudflare DNS vs local Caddy config
# Should match for all exposed subdomains
dig +short geox.arif-fazil.com A
dig +short mcp.arif-fazil.com A
Alert Thresholds
| Check | Warning | Critical | |---|---|---| | SSL expiry | < 30 days | < 7 days | | Caddy config | syntax error | reload fails | | DNS mismatch | 1 record off | propagated wrong | | Tunnel down | > 5 min | > 30 sec |
Managed Domains
- geox.arif-fazil.com → GEOX MCP
- mcp.arif-fazil.com → arifOS MCP
- openclaw.arif-fazil.com → OpenClaw gateway
Related Skills
ariffazil/openclaw
testing
VerifiedTrustedCommunity
OpenClaw edge agent bridge — operational triage, doctor, restart, and A2A bridge routing for the federation edge (Telegram surface). USE WHEN: "openclaw unhealthy", "gateway down", "edge bot not responding", "a2a bridge disconnected", "watchdog tripped", "openclaw doctor", "openclaw restart". NOT for token/security audit — use FORGE-telegram-audit.
2SKILL.mdUpdated Aug 8, 2026
ariffazil/MiniMax Image Generation
tools
VerifiedTrustedCommunity
Generate images, videos, TTS, voice clone, and music via MiniMax MCP server. Use when user asks to "draw", "generate image", "create picture", "make a photo", "text to image", "image generation".
2SKILL.mdUpdated Aug 8, 2026
ariffazil/arifos-constitutional-judge
testing
VerifiedTrustedCommunity
Single load-bearing constitutional-judgment skill. Routes all F1–F13, verdict, hold, seal, scope, authority and floor-check calls through the live arif_judge surface. Replaces 7 overlapping predecessors (arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge, arifos-constitutional-judge).
2SKILL.mdUpdated Aug 8, 2026
ariffazil/FORGE-lsp-pre-edit-gate
development
VerifiedTrustedCommunity
MANDATORY LSP grounding gate BEFORE any code mutation on .ts, .py, .js, .tsx, .jsx files. Forces the agent to read real-time compiler diagnostics and structural project context before editing — eliminating blind guesses and anchoring every mutation in F2 (TRUTH). Routes through arifOS kernel (:8088) for centralized gate logic.
2SKILL.mdUpdated Aug 8, 2026