A tutorial docker-compose.yml with xpack.security.enabled=false and ports "9200:9200" puts every index on the internet without a password, and Docker's published ports skip most host firewalls. Bots find clusters like that within hours and leave a ransom note where the data was. An OpenSearch container started without DISABLE_INSTALL_DEMO_CONFIG=true is just as open in a quieter way: it runs the demo certificates, whose private keys are public, and demo users with well-known passwords. This skill finds those and ten other Elasticsearch, Kibana and OpenSearch setting mistakes before the cluster goes live, and tells you how to fix each one.

Your agent runs a scanner on your project: elasticsearch.yml, kibana.yml, opensearch.yml and opensearch_dashboards.yml (and named variants such as elasticsearch-node1.yml), plus Docker Compose services that run the official Elasticsearch, Kibana, OpenSearch and OpenSearch Dashboards images. Flat dotted keys and nested YAML for the same setting are read the same way, and in Compose files it reads settings passed as environment variables (xpack.security.enabled=false, ES_SETTING_..., ELASTICSEARCH_PASSWORD) and the ports each service publishes. It works out whether a node can be reached from the network (network.host, http.host, transport.host, server.host, published ports) and judges the security rules from that, using the real defaults: Elasticsearch 8.0 and later turn security on and set up TLS on first start, 7.x and older leave security off, and the OpenSearch image installs the demo security setup unless told not to. So Elasticsearch 8's own auto-generated configuration is not flagged, and a local development node gets a review note instead of a block. It never connects to a cluster. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• E01: Elasticsearch security off on a reachable node: xpack.security.enabled: false, or a 7.x or older image that never turns it on, with a network address or a port published on every interface

• E02: the OpenSearch security plugin disabled (plugins.security.disabled, DISABLE_SECURITY_PLUGIN) on a reachable node

• E03: passwords, tokens and client secrets written in the files: elasticsearch.password, opensearch.password, serviceAccountToken, bind_password, keystore passwords, ELASTIC_PASSWORD, OPENSEARCH_INITIAL_ADMIN_PASSWORD and passwords inside host URLs

• E04: the OpenSearch demo security setup (allow_unsafe_democertificates: true, or the Docker image's default demo install) on a reachable node

REVIEW (check before release)

• E11: security turned off on a node that is not reachable yet

• E12: CORS open to any origin (http.cors.allow-origin: "*", Kibana server.cors with its default ["*"])

• E13: no HTTPS on a network address (xpack.security.http.ssl, plugins.security.ssl.http, server.ssl for Kibana and Dashboards)

• E14: certificate checks turned off (verification_mode: none, verificationMode: none)

• E15: Kibana encryption keys or the Dashboards cookie password written in the file

• E16: action.destructive_requires_name: false, which turns off Elasticsearch 8's guard against DELETE /*

• E17: anonymous access (anonymous roles, a Kibana anonymous provider, Dashboards anonymous_auth_enabled)

• E18: a node on a network address whose file never configures security, so it depends on the version

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (a Compose stack with Elasticsearch, Kibana and OpenSearch, a production elasticsearch.yml and kibana.yml, an OpenSearch node with the demo setup, OpenSearch Dashboards, an old 7.x node and a development node), and the real report the scanner produces on the risky one

Limits

It reads each file as written. Values from .env files, the keystores, -E command-line options, Helm charts and Kubernetes manifests (including ECK) are not read, Compose services built from other images (such as Bitnami) are skipped, and the OpenSearch security plugin's own files (internal_users.yml, roles.yml), users and roles inside the cluster, firewalls and hosted services are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 21 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (14 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.