Comprehensive guide to personal digital security covering password management strategies, two-factor authentication setup, VPN selection and usage, phishing recognition techniques, social engineering awareness, device security hardening, privacy settings for social media and browsers, data breach response procedures, and secure communication tools.
A skill is a written procedure a bot loads when a job calls for it. This one is a single file, SKILL.md, and the whole file is on this page.
Disclaimer: This skill provides general wellness and health information for educational purposes only. It does NOT constitute medical advice, diagnosis, or treatment recommendations. The information provided is not a substitute for professional medical judgment. Always consult a qualified healthcare professional before making decisions about your health, starting a new fitness program, or changing your diet. If you are experiencing a medical emergency, contact emergency services immediately.
Comprehensive guide to personal digital security covering password management strategies, two-factor authentication setup, VPN selection and usage, phishing recognition techniques, social engineering awareness, device security hardening, privacy settings for social media and browsers, data breach response procedures, and secure communication tools.
How much does it cost?+
Nothing. It ships with Murage, which is open source. Your bots run on the AI plan you already have.
Can I change it?+
Yes. Open it in Settings → Skills to read, edit or duplicate it. Skill Guard scans it again after every edit.
Give your first job to Murage.
Download the app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
User asks about cybersecurity personal techniques or best practices
User needs guidance on cybersecurity personal concepts
User wants to implement or improve their approach to cybersecurity personal
Do NOT use when:
The request falls outside the scope of cybersecurity personal
User needs a different specialized skill for their specific situation
The topic requires professional consultation beyond general guidance
Questions to Ask First
How many online accounts do you estimate you have (email, banking, social media, shopping)?
Do you currently use a password manager?
Do you have two-factor authentication enabled on your most important accounts?
Have you ever been a victim of a hack, phishing attack, or data breach?
What devices do you use daily (phone, laptop, tablet, smart home devices)?
Do you use public Wi-Fi frequently (coffee shops, airports, hotels)?
What is your comfort level with technology?
Do you handle sensitive information for work from personal devices?
How many people have access to your devices or accounts?
What is your biggest cybersecurity concern (identity theft, privacy, financial fraud)?
Phase 1: Password Management
Why Passwords Matter
Over 80% of data breaches involve compromised passwords. Reusing passwords across sites means one breach can compromise all your accounts.
Password Best Practices
Strong password characteristics:
Minimum 16 characters (longer is better)
Mix of uppercase, lowercase, numbers, and special characters
NOT based on personal information (birthdate, pet name, address)
NOT a common word or phrase
Unique for every account (no reuse)
Passphrase method (recommended): Create a memorable phrase with random words: Example: "correct-horse-battery-staple" (but use your own random words) Add complexity: "Correct-Horse-Battery-Staple-42!"
Password Managers
Why use a password manager:
Generates strong, unique passwords for every account
Remembers them all so you do not have to
Auto-fills login forms securely
Alerts you to compromised passwords
Works across all your devices
Recommended Password Managers:
Manager
Cost
Platforms
Key Features
Bitwarden
Free / $10/year premium
All platforms
Open source, excellent free tier
1Password
$36/year
All platforms
Travel mode, family sharing
Dashlane
$60/year
All platforms
VPN included, dark web monitoring
KeePassXC
Free
Desktop (cross-platform)
Offline, open source, full control
Setting up a password manager:
Choose a manager and create your account
Create a STRONG master password (this is the one password you must remember)
Write your master password on paper and store it in a secure physical location
Install the browser extension and mobile app
Start saving passwords as you log into sites
Gradually update weak or reused passwords with generated ones
Enable two-factor authentication on the password manager itself
Passwords to Change First (Priority Order)
Email accounts (email is the key to all other account recovery)
Two-factor authentication requires two different types of verification to access an account: something you know (password) plus something you have (phone, security key) or something you are (biometrics).
Types of 2FA (Ranked by Security)
Method
Security Level
Convenience
Notes
Hardware security key (YubiKey, Titan)
Highest
Medium
Physical device, phishing-resistant
Authenticator app (TOTP)
High
High
Time-based codes on your phone
Push notification
High
Very High
Approve/deny on phone app
SMS text message
Medium
Very High
Better than nothing, but vulnerable to SIM swap
Email code
Low-Medium
High
If email is compromised, 2FA is bypassed
Setting Up 2FA
Priority accounts for 2FA:
Email (Gmail, Outlook, etc.)
Financial accounts (banks, investment platforms)
Password manager
Social media
Cloud storage
Work accounts
Shopping accounts with stored payment info
Recommended authenticator apps:
Authy (cloud backup, multi-device sync)
Google Authenticator
Microsoft Authenticator
1Password (built into the password manager)
Setup process (typical):
Go to account security settings
Find "Two-Factor Authentication" or "Two-Step Verification"
Choose your 2FA method
Follow the setup wizard (usually scan a QR code with your authenticator app)
Save backup codes in your password manager or a secure location
Test the setup by logging out and back in
Backup Codes
When you enable 2FA, most services provide backup codes. These are one-time-use codes for when you cannot access your 2FA device. Store these securely in your password manager and/or a physical secure location. Without them, you may lose access to your account if your phone is lost or broken.
Phase 3: VPN Selection and Usage
What a VPN Does (and Does Not Do)
A VPN does:
Encrypt your internet traffic between your device and the VPN server
Hide your IP address from websites you visit
Protect data on public Wi-Fi from local eavesdropping
Allow access to geo-restricted content
Prevent your ISP from seeing which specific sites you visit
A VPN does NOT:
Make you anonymous (the VPN provider can see your traffic)
Protect against malware or phishing
Protect accounts with weak passwords
Make you invisible to law enforcement (with proper legal process)
Protect data after it leaves the VPN server
Choosing a VPN Provider
Look for:
No-logs policy (independently audited)
Strong encryption (WireGuard or OpenVPN protocols)
Kill switch feature (blocks internet if VPN disconnects)
Avoid: Free VPNs from unknown providers (your data is often the product).
When to Use a VPN
Always on public Wi-Fi (coffee shops, airports, hotels)
When accessing sensitive accounts on unfamiliar networks
When you want to prevent ISP tracking
When traveling internationally (access home services)
Phase 4: Phishing Recognition
What is Phishing?
Phishing is an attempt to trick you into revealing sensitive information (passwords, credit card numbers, personal data) by impersonating a legitimate entity through email, text, phone, or websites.
Common Phishing Indicators
Email phishing red flags:
☐To do:
Sender address does not match the claimed organization (hover over the "from" name)
☐To do:
Generic greeting ("Dear Customer" instead of your name)
☐To do:
Urgency or threat ("Your account will be closed in 24 hours!")
☐To do:
Spelling and grammar errors
☐To do:
Suspicious links (hover to see the actual URL before clicking)
☐To do:
Unexpected attachments
☐To do:
Requests for sensitive information (passwords, SSN, credit card)
Enable Find My Device (for remote tracking and wiping)
☐To do:
Enable automatic backup (encrypted)
☐To do:
Disable Bluetooth and Wi-Fi auto-connect when not needed
☐To do:
Use a VPN on public Wi-Fi
Computer Security
☐To do:
Enable full-disk encryption (BitLocker on Windows, FileVault on Mac)
☐To do:
Set a strong login password
☐To do:
Enable automatic operating system updates
☐To do:
Install and maintain antivirus/antimalware software
☐To do:
Enable firewall
☐To do:
Back up data regularly (3-2-1 rule: 3 copies, 2 media types, 1 offsite)
☐To do:
Lock screen when stepping away (Windows+L or Ctrl+Cmd+Q on Mac)
☐To do:
Be cautious with USB drives from unknown sources
Smart Home Device Security
Change default passwords on all IoT devices (cameras, speakers, routers)
Keep firmware updated
Use a separate Wi-Fi network for IoT devices (if your router supports it)
Disable features you do not use (remote access, voice purchasing)
Research device privacy policies before purchasing
Router Security
Change default admin password
Use WPA3 encryption (or WPA2 minimum)
Change default network name (SSID) -- do not include personal information
Enable automatic firmware updates
Disable WPS (Wi-Fi Protected Setup)
Consider a guest network for visitors
Phase 7: Privacy Settings
Social Media Privacy
Facebook:
Set profile to "Friends Only" (not Public)
Review who can see past posts (Limit Past Posts feature)
Disable face recognition
Review apps and websites connected to your account
Disable location history
Review tagged photos before they appear on your profile
Instagram:
Set account to Private (if not a public figure or business)
Disable activity status
Review tagged photos before they appear
Restrict who can message you
General Social Media:
Do not share your full birthdate, address, or phone number
Be cautious about check-ins and real-time location sharing
Do not post vacation photos until after returning home
Review friend/follower lists periodically
Be cautious about quizzes and personality tests (data harvesting)
Browser Privacy
Use a privacy-focused browser (Firefox, Brave) or harden your current browser
Install uBlock Origin (ad and tracker blocker)
Enable Do Not Track (limited effectiveness but worth enabling)
Clear cookies regularly or use containers (Firefox Multi-Account Containers)
Use private/incognito mode for sensitive searches
Consider a privacy-focused search engine (DuckDuckGo, Startpage)
Disable third-party cookies
Review and limit browser extensions (each extension can see your browsing)
Phase 8: Data Breach Response
If Your Data Has Been Breached
Immediate actions (first 24 hours):
Change passwords for the breached account immediately
If the password was reused anywhere, change those passwords too
Enable 2FA on the breached account (if not already active)
Check for unauthorized transactions on financial accounts
Monitor email for password reset requests you did not initiate
Within the first week:
Place a fraud alert with one of the three credit bureaus (Equifax, Experian, TransUnion -- they are required to notify the other two)
Review credit reports at AnnualCreditReport.com
Consider a credit freeze (prevents new accounts being opened in your name)
Check HaveIBeenPwned.com for other breaches involving your email
Update security questions (if the breach included personal information)
Monitor accounts closely for 6-12 months
Credit Freeze vs. Fraud Alert:
Feature
Credit Freeze
Fraud Alert
Duration
Until you lift it
1 year (initial) or 7 years (extended)
Effect
Blocks all new credit inquiries
Requires additional verification
Cost
Free
Free
Effort to set up
Must contact each bureau separately
Contact one bureau, others are notified
To lift
PIN or password required at each bureau
Expires automatically
Secure Communication Tools
Tool
Type
Key Feature
Signal
Messaging
End-to-end encrypted, open source, minimal metadata
ProtonMail
Email
End-to-end encrypted, Swiss jurisdiction
Tuta (formerly Tutanota)
Email
End-to-end encrypted, German jurisdiction
Wire
Messaging
End-to-end encrypted, business and personal
iMessage
Messaging
End-to-end encrypted (Apple to Apple only)
Personal Cybersecurity Checklist
Do This Today
☐To do:
Check HaveIBeenPwned.com for your email addresses
☐To do:
Install a password manager and start saving passwords
☐To do:
Enable 2FA on your email accounts
☐To do:
Update your phone's operating system to the latest version
Do This Week
☐To do:
Change your most critical passwords (email, banking, social media)
☐To do:
Enable 2FA on financial accounts
☐To do:
Review privacy settings on social media
☐To do:
Install uBlock Origin on your browser
☐To do:
Set up automatic backups for your phone and computer
Do This Month
☐To do:
Audit and update all account passwords (using password manager)
☐To do:
Enable 2FA on all accounts that support it
☐To do:
Review app permissions on your phone
☐To do:
Set up a VPN for use on public Wi-Fi
☐To do:
Check credit reports at AnnualCreditReport.com
☐To do:
Review and limit browser extensions
☐To do:
Change your router's default admin password
Cybersecurity is not about being perfectly secure -- that is impossible. It is about making yourself a harder target than the next person. Implement these measures in order of priority, and each step significantly reduces your risk.
Process
Gather information. Ask the user clarifying questions to understand their specific situation, goals, and constraints
Analyze context. Review the information provided and identify key factors relevant to cybersecurity personal
Develop recommendations. Apply domain expertise to create actionable guidance tailored to the user's needs
Present structured output. Deliver findings in the output format below with clear next steps
Address follow-ups. Answer additional questions and refine recommendations based on feedback