ariffazil/infra-guardian
skills/infra-guardian/SKILL.md
Validate Caddy reverse proxy configs, Cloudflare Origin CA SSL expiry, DNS parity, tunnel status, and Cloudflare tunnel exposure. USE WHEN: "check SSL", "Caddy config valid", "tunnel status", "DNS parity", "SSL expiry", "infra health", "Cloudflare check".
$ install --global
skillsauthnpx skillsauth add ariffazil/openclaw-workspace infra-guardianInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 13, 2026, 3:43 AM233.7s3 files scanned
SKILL.md
- name:
- infra-guardian
- description:
- >
- USE WHEN:
- check SSL", "Caddy config valid", "tunnel status",
Infra Guardian
Validates the infrastructure layer — SSL, DNS, reverse proxy, tunnels.
What It Checks
SSL Certificate
# Check SSL expiry for all managed domains
echo | openssl s_client -servername geox.arif-fazil.com -connect geox.arif-fazil.com:443 2>/dev/null | openssl x509 -noout -dates
# Origin CA check (Cloudflare Origin)
curl -s https://geox.arif-fazil.com/.well-known/agent-card.json | head -c 100
# All managed domains
for domain in geox.arif-fazil.com mcp.arif-fazil.com openclaw.arif-fazil.com; do
echo -n "$domain: "
echo | openssl s_client -servername "$domain" -connect "$domain:443" 2>/dev/null | openssl x509 -noout -enddate
done
Caddy Config
# Validate Caddyfile syntax
caddy validate --config /etc/caddy/Caddyfile 2>&1
# Test config reload
caddy reload --config /etc/caddy/Caddyfile 2>&1
Cloudflare Tunnel
# Check cloudflared tunnel status
cloudflared tunnel list 2>/dev/null
cloudflared tunnel run --token "$(cat /root/.cloudflared/tunnel-token 2>/dev/null)" 2>&1 | head -5 &
DNS Parity
# Compare Cloudflare DNS vs local Caddy config
# Should match for all exposed subdomains
dig +short geox.arif-fazil.com A
dig +short mcp.arif-fazil.com A
Alert Thresholds
| Check | Warning | Critical | |---|---|---| | SSL expiry | < 30 days | < 7 days | | Caddy config | syntax error | reload fails | | DNS mismatch | 1 record off | propagated wrong | | Tunnel down | > 5 min | > 30 sec |
Managed Domains
- geox.arif-fazil.com → GEOX MCP
- mcp.arif-fazil.com → arifOS MCP
- openclaw.arif-fazil.com → OpenClaw gateway
Related Skills
ariffazil/XAUUSD-trading-stack
development
VerifiedTrustedCommunity
Federation-wide gold (XAUUSD) trading capability. Python stack, OANDA broker, backtesting, macro signals, RSI strategy. Every organ has a role.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/wealth-claim-state
development
VerifiedTrustedCommunity
Capital claim state management — tracks claim lifecycle across WEALTH organ.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/warga-constitutional
development
VerifiedTrustedCommunity
Archived constitutional warga placeholder retained only for audit provenance. Do not use for active work; use the live arifOS governance and constitutional skills instead.
2SKILL.mdUpdated Jul 24, 2026
ariffazil/warga
testing
VerifiedTrustedCommunity
Warga (citizen) agent skills for AAA federation members. See subdirectories for specialized warga skills.
2SKILL.mdUpdated Jul 24, 2026