Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add killvxk/cybersecurity-skills-zh --skill analyzing-persistence-mechanisms-in-linuxgit clone --depth 1 https://github.com/killvxk/cybersecurity-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-persistence-mechanisms-in-linux)<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-persistence-mechanisms-in-linux"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-persistence-mechanisms-in-linux/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/killvxk/cybersecurity-skills-zh/analyzing-persistence-mechanisms-in-linux"><img src="https://agentmods.dev/badge/skills/killvxk/cybersecurity-skills-zh/analyzing-persistence-mechanisms-in-linux.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.00662 |
| Opus 5 | $0.00029 | $0.00331 |
| Sonnet 5 | $0.00012 | $0.00132 |
| Haiku 4.5 | $0.00006 | $0.00066 |
Grade B, and why
analyzing-persistence-mechanisms-in-linux scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- 目标 Linux 系统（或取证镜像）的 root 或 sudo 访问权限 What it actually says
分析 Linux 持久化机制
概述
攻击者通过 crontab 任务、systemd 服务/计时器单元、LD_PRELOAD 库注入、Shell 配置文件修改（.bashrc、.profile）、SSH authorized_keys 后门以及 init 脚本操控等方式在 Linux 系统上建立持久化（Persistence）。本技能扫描所有已知持久化向量，检查文件时间戳和完整性，并将发现结果与 auditd 日志关联，以构建持久化安装的时间线。
前置条件
- 目标 Linux 系统（或取证镜像）的 root 或 sudo 访问权限
- auditd 已配置针对持久化路径的文件监控规则
- Python 3.8+ 及标准库（os、subprocess、json）
- 可选：OSSEC/Wazuh 代理用于文件完整性监控告警
步骤
- 扫描 Crontab 条目 — 枚举所有用户 crontab、/etc/cron.d/、/etc/cron.daily/ 和 anacron 任务中的可疑命令
- 审计 Systemd 单元 — 检查 /etc/systemd/system/ 和 ~/.config/systemd/user/ 中非包管理器托管的服务和计时器单元
- 检测 LD_PRELOAD 劫持 — 检查 /etc/ld.so.preload 和 LD_PRELOAD 环境变量中注入的共享库
- 检查 Shell 配置文件 — 扫描 .bashrc、.bash_profile、.profile、/etc/profile.d/ 中注入的命令或反向 Shell
- 检查 SSH Authorized Keys — 审计所有 authorized_keys 文件中的未授权公钥及命令限制
- 关联 Auditd 日志 — 搜索 auditd 日志中持久化路径的文件修改事件，构建安装时间线
- 生成持久化报告 — 生成包含所有发现的持久化机制及风险评分的报告
预期输出
- 包含所有持久化机制及风险评分的 JSON 报告
- 基于 auditd 关联的持久化安装时间线
- MITRE ATT&CK 技术映射（T1053、T1543、T1574、T1546）
- 每个检测到的持久化机制的修复命令
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 41 lines · 58 tokens per session scan B b97b2eb34a2b
analyzing-persistence-mechanisms-in-linux is a skill published in the GitHub repository killvxk/cybersecurity-skills-zh (45 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 58 tokens to every session and 662 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-persistence-mechanisms-in-linux
Scan Linux systems for persistence mechanisms including crontab/systemd entries, LDPRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorizedkeys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or…
analyzing-persistence-mechanisms-in-linux
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LDPRELOAD hijacking, bashrc modifications, and authorizedkeys backdoors using auditd and file integrity monitoring.
analyzing-persistence-mechanisms-in-linux
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LDPRELOAD hijacking, bashrc modifications, and authorizedkeys backdoors using auditd and file integrity monitoring.
analyzing-persistence-mechanisms-in-linux
Scan Linux systems for persistence mechanisms including crontab/systemd entries, LDPRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorizedkeys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or…
analyzing-persistence-mechanisms-in-linux
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LDPRELOAD hijacking, bashrc modifications, and authorizedkeys backdoors using auditd and file integrity monitoring.
analyzing-persistence-mechanisms-in-linux
Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LDPRELOAD hijacking, bashrc modifications, and authorizedkeys backdoors using auditd and file integrity monitoring.