Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-linux-system-artifactsgit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-linux-system-artifacts)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-linux-system-artifacts"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-linux-system-artifacts.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00670 |
| Opus 5 | $0.00022 | $0.00335 |
| Sonnet 5 | $0.00009 | $0.00134 |
| Haiku 4.5 | $0.00004 | $0.00067 |
Grade A, and why
analyzing-linux-system-artifacts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
分析 Linux 系统痕迹
适用场景
- 调查受损的 Linux 服务器或工作站时
- 识别持久化（Persistence）机制（cron、systemd、SSH 密钥）时
- 通过 Shell 历史和身份验证日志追踪用户活动时
- 事件响应（Incident Response）期间确定 Linux 系统漏洞的影响范围时
- 检测 Rootkit、后门和未授权修改时
前置条件
- 取证镜像或对 Linux 系统的实时只读访问权限
- 了解 Linux 文件系统层次结构（FHS）
- 了解常见 Linux 日志位置（/var/log/）
- 工具：chkrootkit、rkhunter、AIDE、auditd 日志
- 熟悉 systemd、cron 和 PAM 配置
- 完整痕迹收集需要 root 访问权限
工作流程
(参见源文档中的命令)
核心概念
| 概念 | 定义 |
|---|---|
| /var/log/auth.log | Debian/Ubuntu 系统上的主要身份验证日志 |
| /var/log/secure | RHEL/CentOS 系统上的主要身份验证日志 |
| wtmp/btmp | 记录成功和失败登录会话的二进制日志 |
| .bash_history | 用户命令历史文件（攻击者可能清除） |
| crontab | 通常用于持久化的计划任务系统 |
| authorized_keys | 授予账户无密码访问权限的 SSH 公钥 |
| SUID 位 | 允许以文件所有者身份执行的文件权限（权限提升向量） |
| LD_PRELOAD | 在所有其他库之前加载共享库的环境变量（钩挂技术） |
工具与系统
| 工具 | 用途 |
|---|---|
| chkrootkit | Linux 系统 Rootkit 检测扫描器 |
| rkhunter | Rootkit Hunter - 检查 Rootkit、后门和本地漏洞利用 |
| AIDE | 高级入侵检测环境 - 文件完整性监控器 |
| auditd | 用于系统调用和文件访问监控的 Linux 审计框架 |
| last/lastb | 解析 wtmp/btmp 获取登录和失败登录历史 |
| Plaso/log2timeline | 包含 Linux 痕迹的超级时间线创建工具 |
| osquery | 基于 SQL 的系统查询工具，用于实时取证调查 |
| Velociraptor | 具有 Linux 痕迹收集能力的终端代理 |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 58 lines · 43 tokens per session scan A b82af8143ad4
analyzing-linux-system-artifacts is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (44 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 43 tokens to every session and 670 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-linux-system-artifacts
Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence…
analyzing-linux-system-artifacts
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
analyzing-linux-system-artifacts
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
analyzing-linux-system-artifacts
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
analyzing-linux-system-artifacts
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.
analyzing-linux-system-artifacts
Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover evidence of compromise or unauthorized activity.