What is analyzing-linux-system-artifacts?

A guide to examining Linux system traces such as authentication logs, shell history, scheduled jobs, SSH keys, and service settings. These artifacts can reveal how an attacker entered a system and how they tried to stay there.

Use it to investigate Linux breaches, trace logins and commands, find cron or systemd persistence, check configuration changes, and look for rootkits or backdoors.

It brings scattered evidence together when investigating a compromised Linux server or workstation. It helps distinguish normal administration from unauthorized changes and persistence.

analyzing-linux-system-artifacts — Skill for Claude Code by plurigrid: A guide to examining Linux system traces such as…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/plurigrid/asi/analyzing-linux-system-artifacts

Any agent

npx skills add plurigrid/asi --skill analyzing-linux-system-artifacts

Clone the repo

git clone --depth 1 https://github.com/plurigrid/asi

Made for: Claude Code.

Or install asi, the plugin that ships this one along with the rest of its 56 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/plurigrid/asi/analyzing-linux-system-artifacts.svg)](https://agentmods.dev/skills/plurigrid/asi/analyzing-linux-system-artifacts)

Your own site

<a href="https://agentmods.dev/skills/plurigrid/asi/analyzing-linux-system-artifacts"><img src="https://agentmods.dev/badge/skills/plurigrid/asi/analyzing-linux-system-artifacts.svg" alt="Measured on agentmods" height="20"></a>

Per session 35 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,025 The whole file, excluding the scripts and references it only reads on demand.

Security scan E 4 findings. Scan, not verified.

Origin 92% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00035	$0.04025
Opus 5	$0.00017	$0.02013
Sonnet 5	$0.00007	$0.00805
Haiku 4.5	$0.00003	$0.00402

Measured 2d ago against content hash 81b145416ad0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade E, and why

analyzing-linux-system-artifacts scanned grade E with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

'perl -e', 'base64', 'chmod 777', 'chmod +s', '/dev/tcp', '/dev/udp',

Reaches for credential fileshighPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

cp /mnt/evidence/etc/shadow /cases/case-2024-001/linux/config/

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

'iptables -F', 'ufw disable', 'history -c', 'rm -rf /', 'dd if=',

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

cp "$user_dir"/.wget-hsts /cases/case-2024-001/linux/users/$username/ 2>/dev/null

Origin

This is a copy

92% identical to analyzing-linux-system-artifacts — 25 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

plugins/asi/skills/analyzing-linux-system-artifacts/SKILL.md · 321 lines

How it starts

The opening of the file, as written. The whole thing — 321 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Analyzing Linux System Artifacts

When to Use

When investigating a compromised Linux server or workstation
For identifying persistence mechanisms (cron, systemd, SSH keys)
When tracing user activity through shell history and authentication logs
During incident response to determine the scope of a Linux-based breach
For detecting rootkits, backdoors, and unauthorized modifications

Prerequisites

Forensic image or live access to the Linux system (read-only)
Understanding of Linux file system hierarchy (FHS)
Knowledge of common Linux logging locations (/var/log/)
Tools: chkrootkit, rkhunter, AIDE, auditd logs
Familiarity with systemd, cron, and PAM configurations
Root access for complete artifact collection

Workflow

Step 1: Mount and Collect System Artifacts

# Mount forensic image read-only
mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/linux_evidence.dd /mnt/evidence

# Create collection directories
mkdir -p /cases/case-2024-001/linux/{logs,config,users,persistence,network}

# Collect authentication logs
cp /mnt/evidence/var/log/auth.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/secure* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/syslog* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/kern.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/audit/audit.log* /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/wtmp /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/btmp /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/lastlog /cases/case-2024-001/linux/logs/
cp /mnt/evidence/var/log/faillog /cases/case-2024-001/linux/logs/

# Collect user artifacts
for user_dir in /mnt/evidence/home/*/; do
    username=$(basename "$user_dir")
    mkdir -p /cases/case-2024-001/linux/users/$username
    cp "$user_dir"/.bash_history /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.zsh_history /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp -r "$user_dir"/.ssh/ /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.bashrc /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.profile /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.viminfo /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.wget-hsts /cases/case-2024-001/linux/users/$username/ 2>/dev/null
    cp "$user_dir"/.python_history /cases/case-2024-001/linux/users/$username/ 2>/dev/null
done

# Collect root user artifacts
cp /mnt/evidence/root/.bash_history /cases/case-2024-001/linux/users/root/ 2>/dev/null
cp -r /mnt/evidence/root/.ssh/ /cases/case-2024-001/linux/users/root/ 2>/dev/null

# Collect system configuration
cp /mnt/evidence/etc/passwd /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/shadow /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/group /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/sudoers /cases/case-2024-001/linux/config/
cp -r /mnt/evidence/etc/sudoers.d/ /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/hosts /cases/case-2024-001/linux/config/
cp /mnt/evidence/etc/resolv.conf /cases/case-2024-001/linux/config/
cp -r /mnt/evidence/etc/ssh/ /cases/case-2024-001/linux/config/

Read the full file on GitHub · 321 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 321 lines · 35 tokens per session scan E 81b145416ad0

Subscribe to this mod's changes

analyzing-linux-system-artifacts is a skill published in the GitHub repository plurigrid/asi (62 stars, last pushed 1mo ago), licensed MIT. It adds 35 tokens to every session and 4,025 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it E with 4 findings (asks for root, reaches for credential files, recursive force delete). It is 92% identical to analyzing-linux-system-artifacts, differing in 25 lines, and is treated as a copy.

Security forensics incident-investigation linux-forensics log-analysis persistence-detection system-artifacts

analyzing-linux-system-artifacts

Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence…

mukul975/Anthropic-Cybersecurity-Skills · 79 tokens

analyzing-linux-system-artifacts

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade E, and why

Asks for rootmediumPrivilege escalation

Reaches for credential fileshighPrivilege escalation

Recursive force deletehighDestructive command

Makes network callslowCapability

This is a copy

How it starts

Analyzing Linux System Artifacts

When to Use

Prerequisites

Workflow

Step 1: Mount and Collect System Artifacts

What this file has done since we first saw it

Other skills, from other repositories

analyzing-linux-system-artifacts

analyzing-linux-system-artifacts

analyzing-linux-system-artifacts

analyzing-linux-system-artifacts

analyzing-linux-system-artifacts

analyzing-linux-system-artifacts