agentmods.dev

host-forensics

host-forensics is a skill for Claude Code from gensecaihq/Wazuh-Autopilot. It costs 45 tokens per session (1,349 once invoked), scanned E, original, MIT.

A read-only procedure for investigating a possibly compromised computer through information reported by its Wazuh agent. It examines processes, network ports, monitoring settings, and past alerts, while noting that it cannot image the disk or run commands.

In plain words
What is it for?
Use it to identify the computer, check agent health, review running processes and listening ports, inspect monitoring configuration, and look for persistence or tampering evidence.
Why use it?
It gives investigators a structured view of a suspected endpoint while making the limits and age of the collected information clear. This helps avoid treating an old inventory record as live proof.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

not rated 63repo +1 1mo ago E scan 45 tokens original MIT

Good fit Use it to identify the computer, check agent health, review running processes and listening ports, inspect monitoring configuration, and look for persistence or tampering evidence.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/gensecaihq/wazuh-autopilot/host-forensics
View source ↗ gensecaihq/Wazuh-Autopilot wazuh-mcp-openclaw.netlify.app
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add gensecaihq/Wazuh-Autopilot --skill host-forensics
Clone the repo
git clone --depth 1 https://github.com/gensecaihq/Wazuh-Autopilot

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for host-forensics

README.md
[![agentmods](https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/host-forensics/github.svg)](https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/host-forensics)
Your own site
<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/host-forensics"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/host-forensics/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for host-forensics

Your own site · 80×15
<a href="https://agentmods.dev/skills/gensecaihq/wazuh-autopilot/host-forensics"><img src="https://agentmods.dev/badge/skills/gensecaihq/wazuh-autopilot/host-forensics.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 45 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,349 The whole file, excluding the scripts and references it only reads on demand.
Security scan E 3 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00045 $0.01349
Opus 5.5 $0.00018 $0.00540
Sonnet 5.5 $0.00009 $0.00270
Haiku 4.5 $0.00005 $0.00135

Measured 1mo ago against content hash aa09fd0e1fca, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade E, and why

host-forensics scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

`~/.ssh/authorized_keys`, `/etc/rc.local`, `/etc/ld.so.preload`, shell profiles

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

| Encoded / obfuscated command lines (`-enc`, `FromBase64String`, `curl | sh`) | T1059, T1027 |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

| Encoded / obfuscated command lines (`-enc`, `FromBase64String`, `curl | sh`) | T1059, T1027 |
backend/app/skills/host-forensics/SKILL.md · 90 lines

How it starts

The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Host Forensics

Remote, read-only live response through the Wazuh agent's inventory (syscollector) and alert history. You cannot image disks or run commands; you work from what the agent reports. Be explicit about that limitation in findings.

Procedure

  1. Identify the agent: get_wazuh_agents (match name/IP) → agent_id, OS, version, last keepalive.
  2. check_agent_health — a disconnected or stale agent means inventory may be old; record the inventory timestamp. Syscollector inventories run on an interval (1 hour by default), so a short-lived process may never appear, and a killed one may still be listed until the next scan. Compare scan.time with the incident time.
  3. get_agent_processes(agent_id) — review with the heuristics below.
  4. get_agent_ports(agent_id) — listening and established sockets.
  5. get_agent_configuration(agent_id) — confirm FIM/rootcheck/log collection is enabled; attackers disable monitoring.
  6. get_wazuh_alerts(agent_id=..., timestamp_start="now-7d") — FIM (rules 550, 553, 554; registry rules 594, 598, 750, 752), rootcheck (rule 510; rule 513 Windows malware), SCA (rule 19011 check passed → failed) and audit events for persistence evidence. Load wazuh-fim-investigation and wazuh-malware-detection for detail.
  7. get_wazuh_vulnerabilities(agent_id) and get_sca_policy_checks(agent_id) — the likely way in (unpatched service, weak configuration) matters for eradication.

Suspicious process heuristics

Signal Why
Interpreter children of web/database servers (w3wp, httpd, nginx, java, sqlservr → cmd, powershell, sh, bash) web shell / exploitation (T1505.003, T1059)
Binaries running from /tmp, /dev/shm, /var/tmp, %TEMP%, %APPDATA%, C:\Users\Public staging / malware
Names mimicking system binaries in wrong paths (svchost.exe outside System32, [kworker] with a real exe path) masquerading (T1036)
Encoded / obfuscated command lines (-enc, FromBase64String, `curl sh`)
Known tools: mimikatz, procdump targeting lsass, nc -e, socat, chisel, rclone credential access / tunneling / exfil
Processes owned by root/SYSTEM that are normally user-level privilege escalation

Read the full file on GitHub · 90 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 90 lines · 45 tokens per session scan E aa09fd0e1fca

Subscribe to this mod's changes

host-forensics is a skill published in the GitHub repository gensecaihq/Wazuh-Autopilot (63 stars, last pushed 1mo ago), licensed MIT. It adds 45 tokens to every session and 1,349 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it E with 3 findings (reaches for credential files, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.

Autonomous AgentsDebuggingSecurityagentic-aimcpsecurity-automationsiemsoc
Related

host-forensics compared with skills from other repositories

host-forensics next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
host-forensicsgensecaihq/Wazuh-AutopilotSkill631mo agoMITE45Claude Code
agent-performance-optimizerruvnet/rufloSkill81ktodayMITA19Claude Code
agent-refinementruvnet/rufloSkill81ktodayMITA15Claude Code
diag-harnessruvnet/metaharnessSkill744todayMITA85Claude Code
business-logic-and-state-abusemakifbaysal/tasktrooperSkill122yesterdayApache-2.0A82Claude Code, Codex
root-cause-debuggingmakifbaysal/tasktrooperSkill122yesterdayApache-2.0A47Claude Code, Codex
unity-performance-and-gcmakifbaysal/tasktrooperSkill122yesterdayApache-2.0A76Claude Code, Codex