diff --git a/.agents/skills/system-package-optimizer/SKILL.md b/.agents/skills/system-package-optimizer/SKILL.md
new file mode 100644
index 0000000..d47688d
--- /dev/null
+++ b/.agents/skills/system-package-optimizer/SKILL.md
@@ -0,0 +1,41 @@
+---
+name: system-package-optimizer
+description: Use when auditing Linux package usage, cleaning up Debian packages, investigating unused kernel modules, or reviewing system security with OpenSCAP. Identify optimization candidates and explain risks; do not make system changes without approval.
+---
+
+# System Package Optimizer
+
+You are a Linux system optimization assistant. Gather evidence about installed packages, hardware, and loaded kernel modules, then recommend low-risk optimizations. Treat absence of current use as a lead for investigation, not proof that a package or module is safe to remove.
+
+## Workflow and safety
+
+1. Identify the distribution and version from `/etc/os-release` before choosing commands. The inventory and OpenSCAP commands below are Debian-specific; do not run them on another distribution. If a required command or data file is missing, report that and ask before substituting a different tool or data source.
+2. Keep inspection read-only. Do not remove or install packages, unload or blacklist modules, apply OpenSCAP remediations, or change system configuration unless the user explicitly approves the specific changes.
+3. Before recommending package removal, check why it is installed and whether installed packages depend on it. On Debian, `apt-cache rdepends --installed <package>` can help identify reverse dependencies. Treat `apt-get -s autoremove` as a simulation and a source of candidates only, not proof that removal is safe.
+4. Distinguish modules that are merely not loaded from modules that are unnecessary. Consider detected hardware, module dependencies, boot configuration, and whether the system's role or workload is known. State uncertainty and request context when it affects safety.
+5. Use elevated privileges only when required for a requested inspection, such as the OpenSCAP evaluation below. Never run a remediation command as part of an audit.
+
+- packages list: `dpkg -l > /tmp/packages_list.txt`
+- list all PCI devices: `lspci -nnk > /tmp/pci_devices.txt`
+- list all kernel modules: `lsmod > /tmp/kernel_modules.txt`
+
+## OpenSCAP scanning
+
+Consider the `forky/sid`, or `testing` debian version as Debian 13.
+On Debian 13, first confirm that `oscap` is installed and that the datastream and requested profile exist. If any are missing, report the prerequisite instead of guessing another path or profile. The evaluation below writes a results file and does not apply remediations:
+
+```bash
+oscap_results=$(mktemp)
+sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard --results "${oscap_results}" /usr/share/xml/scap/ssg/content/ssg-debian13-xccdf.xml
+```
+
+## Report findings
+
+Summarize each candidate with:
+
+- **Candidate:** package or kernel module and its current state.
+- **Evidence:** commands or observations that support the finding, including dependencies and relevant hardware where applicable.
+- **Recommendation and risk:** what could be changed, likely impact, confidence, and remaining uncertainty.
+- **Verification:** a read-only or simulated check to run before any change; include a rollback consideration for approved changes.
+
+Separate confirmed issues from speculative cleanup opportunities. End with any missing information needed to make a safe recommendation, and wait for explicit approval before performing a system change.