Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/aliyun/alibabacloud-ecs-troubleshoot-skillsnpx agentmods add skills/aliyun/alibabacloud-ecs-troubleshoot-skills/alibabacloud-ecs-sec-userspaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aliyun/alibabacloud-ecs-troubleshoot-skills/alibabacloud-ecs-sec-userspace)<a href="https://agentmods.dev/skills/aliyun/alibabacloud-ecs-troubleshoot-skills/alibabacloud-ecs-sec-userspace"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-ecs-troubleshoot-skills/alibabacloud-ecs-sec-userspace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aliyun/alibabacloud-ecs-troubleshoot-skills/alibabacloud-ecs-sec-userspace"><img src="https://agentmods.dev/badge/skills/aliyun/alibabacloud-ecs-troubleshoot-skills/alibabacloud-ecs-sec-userspace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00233 | $0.04379 |
| Opus 5 | $0.00117 | $0.02190 |
| Sonnet 5 | $0.00047 | $0.00876 |
| Haiku 4.5 | $0.00023 | $0.00438 |
Grade D, and why
alibabacloud-ecs-sec-userspace scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- terminal (sudo required for full scan) Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
| SSH 密钥 | `sudo cat /root/.ssh/authorized_keys` | How it starts
The opening of the file, as written. The whole thing — 389 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sec-userspace
Linux 服务器安全入侵检测与取证工具 | Linux Server Security Intrusion Detection & Forensics Tool
First Run Setup | 首次运行
AI Agent 首次使用本 Skill 时，MUST 执行以下权限申请（一次性，后续无需重复）：
cd /data/sec-userspace && sudo python3 scripts/setup_permissions.py --auto
这将自动：
- 检测系统已安装的 AI 工具（Claude Code, Qoder, OpenCode, Windsurf, Cursor, Gemini CLI, Trae）
- 配置最小权限集（sudo, read all, write workspace）
- 备份已有配置
- 验证权限生效
配置完成后重启 AI 工具即可永久生效。验证权限：
cd /data/sec-userspace && python3 scripts/setup_permissions.py --verify
Quick Start | 快速开始
完整流程: 权限申请 → 环境初始化 → 执行扫描 → 反思验证 → 输出结果
Step 1: 环境初始化（首次）
cd /data/sec-userspace && sudo bash scripts/setup.sh
自动完成：检测/安装 Python >= 3.11、创建 workspace、安装 Skill 到 AI 工具目录。
Step 2: 执行扫描
# 推荐（源码模式）
cd /data/sec-userspace && sudo python3 -m scripts.main --output-dir /data/sec-userspace/workspace
# 编译版（需 Python 3.11 精确匹配）
cd /data/sec-userspace && sudo python3 scripts/main.pyz --output-dir /data/sec-userspace/workspace
pyz 失败处理：若出现
bad magic number错误，详见 references/python-runtime.md
Step 3: 查看报告
报告输出到 /data/sec-userspace/workspace/{YYYY-MM-DD}/report/：
| 文件 | 格式 | 用途 |
|---|---|---|
sec-report-{date}.md |
Markdown | 主报告：结论、证据、时间线、修复建议 |
sec-report-{date}.json |
JSON | 结构化数据，便于程序化处理 |
attack-chain-{date}.md |
Markdown | 攻击链分析 |
sec-userspace-log-{date}.log |
Log | 执行日志 |
Step 4: Post-Scan Reflection（MANDATORY）
扫描完成后，必须先执行反思流程，再向用户汇报结果。 详见 Post-Scan Reflection。
What Can It Do? | 能做什么？
Detection Capabilities | 检测能力
覆盖 12 大检测类别、51 个安全分析器、10 个数据采集器，映射 103+ MITRE ATT&CK 技术。
| 检测类别 | 核心能力 |
|---|---|
| 进程异常 | 隐藏进程、反弹 Shell、进程树异常、代码注入 |
| 网络异常 | C2 通信、DNS 隧道、DGA 域名、威胁情报匹配 |
| 认证与凭据 | SSH 后门密钥、暴力破解、PAM 后门、凭据泄露 |
| 持久化机制 | Crontab/Systemd/Shell 配置后门 |
| Rootkit | 内核模块异常、LD_PRELOAD 劫持、io_uring/eBPF Rootkit |
| 恶意软件 | 挖矿、勒索软件、RAT、无文件恶意软件 |
| 内存取证 | 内存注入、RWX 异常、memfd 无文件攻击 |
| 文件系统 | SUID/SGID 异常、Webshell、隐藏文件 |
| 横向移动 | SSH 横向、端口转发、时序关联分析 |
| 容器/K8s | 容器逃逸、RBAC 风险、运行时行为异常 |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- __init__.py 0 B runs code
- assets-origin/ioc/domain.b64 4.8 KB
- assets-origin/ioc/hash.b64 678 B
- assets-origin/ioc/ip_port.b64 3.0 KB
- assets-origin/ioc/manifest.json 867 B
- assets-origin/ioc/url.b64 94 B
- assets-origin/whitelist/analyzer_rules.b64 9.9 KB
- assets-origin/whitelist/domain.b64 111 B
- assets-origin/whitelist/hash.b64 75 B
- assets-origin/whitelist/ip_port.b64 129 B
- assets-origin/whitelist/manifest.json 1003 B
- assets-origin/whitelist/url.b64 68 B
- assets/ioc/.gitkeep 0 B
- assets/whitelist/.gitkeep 0 B
- configs/analyzer.yaml 4.5 KB
- configs/collector.yaml 4.2 KB
- configs/sec-userspace.yaml 534 B
- CONTRIBUTOR.md 6.4 KB
- deploy/docker/docker-compose.yml 767 B
- deploy/docker/Dockerfile 603 B
- deploy/docker/README.md 836 B
- deploy/k8s/configmap.yaml 1.1 KB
- deploy/k8s/cronjob.yaml 4.9 KB
- deploy/k8s/job.yaml 4.3 KB
- deploy/k8s/rbac.yaml 1.6 KB
- deploy/standalone/README.md 665 B
- references/call-other-sec-skills.md 6.6 KB
- references/detection-capabilities.md 7.2 KB
- references/installation.md 2.5 KB
- references/lessons-learned.md 5.9 KB
- references/permissions.md 4.2 KB
- references/post-run-reflection.md 13 KB
- references/python-runtime.md 1.6 KB
- references/security-best-practices.md 34 KB
- references/technique-mappings.md 7.2 KB
- references/whitelist-management.md 9.2 KB
- requirements.txt 619 B
- scripts/__init__.py 811 B runs code
- scripts/__main__.py 122 B runs code
- scripts/analyzer/__init__.py 2.8 KB runs code
- scripts/analyzer/analyzer_registry.py 13 KB runs code
- scripts/analyzer/auth_analyzer.py 64 KB runs code
- scripts/analyzer/base.py 28 KB runs code
- scripts/analyzer/cicd_detector.py 6.2 KB runs code
- scripts/analyzer/cilium_evasion_detector.py 43 KB runs code
- scripts/analyzer/cilium_runtime_security_analyzer.py 741 B runs code
- scripts/analyzer/cilium/__init__.py 731 B runs code
- scripts/analyzer/cilium/analyzer.py 4.0 KB runs code
- scripts/analyzer/cilium/constants.py 8.1 KB runs code
- scripts/analyzer/cilium/evasion_detector.py 16 KB runs code
- scripts/analyzer/cilium/helpers.py 422 B runs code
- scripts/analyzer/cilium/policy_analyzer.py 18 KB runs code
- scripts/analyzer/cilium/runtime_monitor.py 31 KB runs code
- scripts/analyzer/cloud_exfiltration_analyzer.py 19 KB runs code
- scripts/analyzer/cloud_service_whitelist.py 10 KB runs code
- scripts/analyzer/cloud_storage_execution_analyzer.py 19 KB runs code
- scripts/analyzer/config_loader.py 12 KB runs code
- scripts/analyzer/container_environment_detector.py 12 KB runs code
- scripts/analyzer/container_syscall_monitor.py 22 KB runs code
- scripts/analyzer/crypto_utils.py 11 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 389 lines · 233 tokens per session scan D 459bf931f847
alibabacloud-ecs-sec-userspace is a skill published in the GitHub repository aliyun/alibabacloud-ecs-troubleshoot-skills (147 stars, last pushed 23d ago), licensed Apache-2.0. It adds 233 tokens to every session and 4,379 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it D with 2 findings (asks for root, reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
officecli-word-form
Use this skill to create fillable Word forms (.docx) with real Content Controls (SDT) + legacy FormField checkboxes + MERGEFIELD mail-merge placeholders + document protection. Trigger on: 'fillable form', 'form fields', 'content controls', 'SDT', 'word form', 'fill in', 'only editable fields', 'protect document'…
officecli-data-dashboard
Use this skill to build a multi-element Excel dashboard — Dashboard sheet on open, multiple formula-driven KPI cards, multiple charts, sparklines, and conditional formatting — from CSV or tabular input. Trigger on: 'dashboard', 'KPI dashboard', 'analytics dashboard', 'executive dashboard', 'metrics dashboard', 'CSV to…
make_plan
For external plan request scenarios, guides the Agent to request a clear, actionable, step-by-step plan from a stronger Agent via listagents and chatwithagent, emphasizing that the plan is executed by the requester, not by the consulted Agent.
gpt-image-2
A skill for generating or editing images with GPT Image 2 across local, host-provided, or advisory setups.
new
Create a new project to start development quickly.
oss-upload
Upload local files to Tencent COS (oss.1024code.com CDN) using coscli. Use when user wants to upload a file to CDN/OSS, or deploy static assets.