System Health Check
A comprehensive scanner that analyzes your system for security risks, performance issues, and optimization opportunities — using parallel execution for maximum speed.
When to Use
- Setting up a new machine
- Periodic security audits
- Troubleshooting performance issues
- Before deploying to production
Options
Users may request a subset:
- Full check (default): All three categories
- Security only: Security checks only
- Performance only: Performance checks only
- Optimization only: Optimization suggestions only
Strict Execution Flow
Do NOT use any scripts. Do NOT skip or merge phases. Execute each phase in order.
Phase 1: Environment Detection (MANDATORY — must display results before proceeding)
Detect and explicitly display the following before doing anything else:
- Operating System: Run a command to detect the OS and version.
- Windows: [System.Environment]::OSVersion and (Get-CimInstance Win32_OperatingSystem).Caption - macOS: sw_vers - Linux: cat /etc/os-release | head -5
- Shell environment: Identify the current shell.
- PowerShell: $PSVersionTable.PSVersion - bash/zsh: echo $SHELL and version
- Agent identity: Identify which agent is running this skill (Claude Code, GitHub Copilot CLI, Cursor, etc.) based on the agent's own context/identity.
- Privilege level: Check if running as admin/root.
- Windows PowerShell: ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) - macOS/Linux: whoami (check if root) or id -u (0 = root)
- Hostname:
hostname
Display the detection results clearly, for example:
Environment Detection:
OS: Windows 11 Pro (10.0.22631)
Shell: PowerShell 7.4
Agent: GitHub Copilot CLI
Privilege: Standard user (not admin)
Hostname: DESKTOP-ABC123CRITICAL: All subsequent phases MUST use ONLY commands for the detected OS and shell. Never include commands from other platforms — not in execution, not in recommendations, not anywhere.
Phase 2: Plan (generate environment-specific execution plan)
Based on Phase 1 results:
- Select commands: From the reference tables below, pick ONLY the column matching the detected OS. Ignore all other columns entirely.
- Plan parallelism based on the detected agent:
| Agent | Parallel Strategy |
|---|---|
| GitHub Copilot CLI | Use three sub-agents (task tool with agent_type "task" or "general-purpose") — one for Security, one for Performance, one for Optimization. |
| Claude Code | Use Agent Teams — dispatch three sub-agents in parallel, one per category. |
| Other agents | Use whatever parallel execution mechanism is available. |
- Display the plan before executing, e.g.:
Plan:
Checks: Security + Performance + Optimization
Strategy: 3 parallel sub-agents (GitHub Copilot CLI)
Platform: All commands use PowerShell (Windows)Phase 3: Execute (parallel)
CRITICAL: The three check categories are COMPLETELY INDEPENDENT. Run them ALL in PARALLEL!
Launch three independent workstreams simultaneously. Each workstream uses ONLY the commands selected in Phase 2 for the detected platform.
Within each workstream, individual checks can also be parallelized for even more speed.
Phase 4: Report & Recommendations
Compile Report
After all parallel workstreams complete, compile a unified report:
================================================================================
SYSTEM HEALTH CHECK REPORT
================================================================================
Generated: <timestamp>
System: <OS and version>
Shell: <shell and version>
Agent: <agent identity>
Hostname: <hostname>
[Security Analysis results...]
[Performance Analysis results...]
[Optimization Suggestions...]Use severity indicators:
[✓]— Check passed / healthy[!]— Warning / needs attention[✗]— Critical issue / security risk
Focus on actionable findings — interpret results, don't dump raw output.
Recommendations
CRITICAL: ALL recommendations MUST be specific to the detected environment.
- If on Windows: only recommend PowerShell commands, Windows tools, Windows settings
- If on macOS: only recommend macOS commands and tools
- If on Linux: only recommend Linux commands and tools
- NEVER suggest
chmodon Windows. NEVER suggestGet-Aclon Linux. NEVER suggesticaclson macOS. NEVER mix platforms.
Command Reference Tables
The agent MUST only use commands from the column matching the detected OS. Ignore other columns.
🔒 Security Analysis
| Check | Windows (PowerShell) | macOS (bash/zsh) | Linux (bash) | ||
|---|---|---|---|---|---|
| Firewall | Get-NetFirewallProfile | defaults read /Library/Preferences/com.apple.alf globalstate | ufw status or iptables -L | ||
| Open ports | Get-NetTCPConnection -State Listen | `lsof -i -P -n \ | grep LISTEN` | ss -tlnp | |
| SSH config | Get-Content $env:ProgramData\ssh\sshd_config -ErrorAction SilentlyContinue | cat /etc/ssh/sshd_config 2>/dev/null | cat /etc/ssh/sshd_config 2>/dev/null | ||
| Updates | `Get-HotFix \ | Sort InstalledOn -Desc \ | Select -First 5` | softwareupdate -l | apt list --upgradable 2>/dev/null or yum check-update |
| AV status | Get-MpComputerStatus | *(skip — not standard)* | *(skip or check ClamAV)* | ||
| Users | `Get-LocalUser \ | Where-Object Enabled` | `dscl. -list /Users \ | grep -v '^_'` | awk -F: '$3>=1000{print $1}' /etc/passwd |
| File permissions | Get-Acl $env:USERPROFILE\.ssh\* -ErrorAction SilentlyContinue | ls -la ~/.ssh/ | ls -la ~/.ssh/ |
AI Agent Security Scanning
Scan these config directories for risky patterns (use the agent's file search capabilities or platform-appropriate grep):
User-level: ~/.claude/, ~/.copilot/, ~/.continue/, ~/.cursor/, ~/.aider/, ~/.agents/, ~/.codeium/, ~/.codeflow/
Project-level: .claude/, .continue/, .cursor/, .copilot/, .github/copilot/
| Category | Risk Level | Patterns |
|---|---|---|
| Network outbound | HIGH | curl.*POST, wget --post, Invoke-WebRequest.*POST |
| Credential access | HIGH | .ssh/, .aws/, API_KEY, SECRET, TOKEN, PASSWORD |
| Obfuscation | HIGH | base64 -d, base64 --decode, String.fromCharCode |
| Dynamic execution | MEDIUM | eval(, exec(, source <(, Function( |
| Package installation | MEDIUM | npx -y, pip install from URLs |
| Permission bypass | MEDIUM | bypassPermissions, skipVerify, dangerouslyAllow |
📊 Performance Analysis
| Check | Windows (PowerShell) | macOS (bash/zsh) | Linux (bash) | |||||||
|---|---|---|---|---|---|---|---|---|---|---|
| CPU | `Get-CimInstance Win32_Processor \ | Select LoadPercentage and Get-Process \ | Sort CPU -Desc \ | Select -First 5` | `top -l 1 -n 0 \ | grep "CPU usage" and ps aux --sort=-%cpu \ | head -6` | `top -bn1 \ | head -5 and ps aux --sort=-%cpu \ | head -6` |
| Memory | `Get-CimInstance Win32_OperatingSystem \ | Select TotalVisibleMemorySize,FreePhysicalMemory` | vm_stat and sysctl hw.memsize | free -h | ||||||
| Disk | `Get-PSDrive -PSProvider FileSystem \ | Select Name,Used,Free` | df -h | df -h | ||||||
| Network | (Get-NetTCPConnection).Count | `netstat -an \ | grep ESTABLISHED \ | wc -l` | ss -s | |||||
| Processes | (Get-Process).Count | `ps aux \ | wc -l` | `ps aux \ | wc -l` | |||||
| Startup | `Get-CimInstance Win32_StartupCommand \ | Select Name,Command` | `launchctl list \ | wc -l` | systemctl list-unit-files --state=enabled --no-pager |
🔧 Optimization Suggestions
| Check | Windows (PowerShell) | macOS (bash/zsh) | Linux (bash) | ||||
|---|---|---|---|---|---|---|---|
| Temp files | `Get-ChildItem $env:TEMP -Recurse -ErrorAction SilentlyContinue \ | Measure-Object -Property Length -Sum` | du -sh /tmp/ ~/Library/Caches/ 2>/dev/null | du -sh /tmp/ /var/tmp/ 2>/dev/null | |||
| Services | `Get-Service \ | Where-Object {$_.Status -eq 'Running'} \ | Measure-Object` | `launchctl list \ | wc -l` | `systemctl list-units --type=service --state=running --no-pager \ | wc -l` |
| Top CPU | `Get-Process \ | Sort CPU -Desc \ | Select -First 10 Name,CPU,WorkingSet64` | `ps aux --sort=-%cpu \ | head -11` | `ps aux --sort=-%cpu \ | head -11` |
| Top Memory | `Get-Process \ | Sort WorkingSet64 -Desc \ | Select -First 10 Name,@{N='MemMB';E={[math]::Round($_.WorkingSet64/1MB)}}` | `ps aux --sort=-%mem \ | head -11` | `ps aux --sort=-%mem \ | head -11` |
Notes
- Some checks may require elevated privileges — if a command fails due to permissions, note it in the report and continue
- Adapt commands based on what's actually installed (e.g., if
ufwis not available, tryiptables; if neither, skip and note) - The command reference tables are hints for the detected platform — the agent may use its knowledge to pick even better available commands, as long as they match the detected OS