The Complete Production SOP: How to Deploy and Run Lynis Linux System Hardening & Compliance Auditing in Autonomous AI Agents

---
name: "lynis-linux-security-auditing"
description: "Perform comprehensive security audits and compliance benchmarking on Linux systems."
metadata:
  author: "CISOfy"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run lynis security audit"
  - "check linux hardening score"
  - "fix lynis warnings linux"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: false
---

#!/usr/bin/env bash
set -euo pipefail

if ! command -v lynis &> /dev/null; then
  echo "ERROR: Lynis is not installed. Run 'sudo apt-get install lynis' or 'brew install lynis'." >&2
  exit 1
fi

echo "Lynis version: $(lynis --version)"
echo "Environment ready for deterministic security audit."

#!/usr/bin/env bash
# Execute Lynis in quick non-interactive mode with structured output
lynis audit system --quick --report-file ./reports/lynis/lynis-report.dat > ./reports/lynis/audit.txt

# Extract Hardening Index deterministically
grep -E "^hardening_index=" ./reports/lynis/lynis-report.dat

#!/usr/bin/env bash
set -euo pipefail

REPORT="./reports/lynis/lynis-report.dat"
if [ ! -f "$REPORT" ]; then
  echo "Audit report missing. Cannot gate quality." >&2
  exit 1
fi

SCORE=$(grep -E "^hardening_index=" "$REPORT" | cut -d'=' -f2)
echo "Current Hardening Score: $SCORE / 100"

# Verification threshold
if [ "$SCORE" -lt 70 ]; then
  echo "WARNING: Hardening score is below minimum policy (70)."
fi