Options Indexes lets visitors browse your backups and uploads; an open /server-status shows every URL your users request. This skill finds those and seven other Apache mistakes before you go live, and tells you how to fix each one.

Your agent runs a scanner on httpd.conf, apache2.conf, sites-available, conf.d and other Apache config folders, and every .htaccess file. It reads directives the way Apache does (case-insensitive, continuation lines, nested <VirtualHost>, <Directory> and <Location> blocks), knows the old Order/Allow syntax and the new Require syntax, and tells the stock Debian and Red Hat main-config default apart from a listing turned on for a site. It never connects to the server. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach.

What it checks

BLOCK (fix before shipping)

• H01: Options Indexes (directory listing) in a site, virtual host or .htaccess

• H02: /server-status or /server-info open to everyone

• H03: ProxyRequests On (open forward proxy)

REVIEW (check before release)

• H11: ServerTokens or ServerSignature that reveal the version

• H12: TraceEnable On

• H13: SSLv3, TLS 1.0 or 1.1, or weak ciphers (RC4, DES, 3DES, MD5, NULL, EXPORT)

• H14: ExecCGI or server-side includes outside cgi-bin

• H15: PHP display_errors on

• H16: Options Indexes in the main apache2.conf or httpd.conf (the stock default)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example config and .htaccess files, and the real report the scanner produces on the risky ones

Limits

It reads each file as written: Include files outside the scanned folder, modules' compiled defaults, the running server and firewalls are not seen. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 12 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (7 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.