SME Security Checkup: Find & Fix Weak Spots
A security health check for small businesses that explains every problem in plain language and shows how to fix it. Audits your computers (firewall, antivirus, updates, encryption, admin accounts, remote desktop), your website (HTTPS, certificate, headers, exposed .git/.env files), email spoofing protection (SPF, DKIM, DMARC), your code (leaked keys, debug mode, vulnerable packages) and staff habits. Scored report plus fix scripts that ask before every change.
#Ingeniería#Comercio#Productividad
Valoración
Se necesitan más valoraciones
Vendidos
0
Cómo se usa
Descargar
A security check-up your business can actually act on
Most small companies have no security team. This Agent works like a consultant: it checks your own systems, explains each problem in plain language (what could happen to your business), and walks you through fixing it step by step.
What it checks
| Area | Examples |
|---|---|
| Computers (Windows, macOS, Linux) | firewall, antivirus, overdue updates, disk encryption, too many admin accounts, Remote Desktop exposure, old SMBv1 (WannaCry), weak password policy, auto-login, risky open services |
| Website | HTTPS and redirect, certificate expiry, outdated TLS 1.0/1.1, security headers (HSTS, CSP, clickjacking), cookie flags, version leaks, publicly downloadable .git, .env, database backups, phpinfo |
| SPF, DMARC and DKIM, the records that stop criminals sending invoices in your name | |
| Code | leaked API keys and passwords (AWS, Stripe, OpenAI, GitHub, database URLs…), private keys, debug mode, disabled certificate checks, SQL built from strings, packages with known CVEs (OSV.dev) |
| Habits | 15-question check based on CIS Controls IG1: MFA, offline backups, phishing training, payment-change call-back rule, offboarding, incident plan |
What you get
- Scored report (A–F) in Traditional Chinese or English with a "do these first" list
- For every finding: the evidence, why it matters, and exact fix steps
- Fix scripts for computer settings that ask yes/no before every change
- Claude can then fix your code with you (move secrets to environment variables, turn off debug, parameterise SQL, upgrade vulnerable packages) and give ready-to-paste DNS records and server configs
- Re-run after fixing to show the improvement
Safe by design
- Read-only: nothing is changed unless you approve it
- Only for systems you own or are authorised to test; website checks require explicit confirmation
- No exploitation, no password guessing, no network scanning
- Secrets are always masked in output
- What leaves your computer: code check sends only package names and versions to OSV.dev (optional,
--offlinedisables); email check makes public DNS lookups of your domain (Cloudflare / Google DNS-over-HTTPS if dnspython isn't installed); website check contacts only the site you confirm. Computer checks and reports stay fully local. - Scanned files and fetched pages are treated as data, never as instructions
- Python standard library only, no API key
Example
"Check our office laptop, our website and our email domain, then tell me the five most important things to fix this week."
A self-assessment, not a replacement for a professional penetration test or compliance audit.
Languages
Reports in Traditional Chinese and English; replies in Traditional Chinese, Simplified Chinese, English, Japanese, Korean, Vietnamese and Indonesian.
API externas
api.osv.dev · cloudflare-dns.com, dns.google
