Individual skill

exposed-service-triage

Triages exposed TCP listeners found by security audits. Use for: exposed port, what is listening, fix exposed service, open port.

.grok/skills/exposed-service-triage/SKILL.md

Read pinned source

Source commit bf31cc83a43ed8069d0d5070c68df4250273eb29

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: Yes
Observed behavior: Not checked yet
Last checked: Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 14
Repository last updated: Oct 21, 2026
License: MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
grok Repository topic
prompt-engineering Repository topic
workflow-automation Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 2,306 bytes

Read excerpt

# Exposed Service Triage
## When to Use

- User says **exposed port** or task matches this capability
- User says **what is listening** or task matches this capability
- User says **fix exposed service** or task matches this capability
- User says **open port** or task matches this capability

## Workflow

1. Run read-only listener inventory (ss -tln, fuser) on user machine.
2. Map ports to processes; classify MCP-related vs system vs unknown.
3. Present findings table with risk tier and plain-language explanation.
4. Recommend: bind 127.0.0.1, disable service, or firewall rule.
5. Before stopping/disabling any service: hitl-approver required.