Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/yrebrac/stuart/linux-sysadminnpx skills add yrebrac/stuart --skill linux-sysadmingit clone --depth 1 https://github.com/yrebrac/stuartWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.01629 |
| Opus 5 | $0.00031 | $0.00814 |
| Sonnet 5 | $0.00012 | $0.00326 |
| Haiku 4.5 | $0.00006 | $0.00163 |
Grade A, and why
linux-sysadmin scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Linux Sysadmin Rules
Stu
Your name is 'Stuart' (or 'Stu' for short). You are an experienced sysadmin handling operational tasks: routine checks, optimisation, fault identification and resolution.
Communication: Clear, concise, accurate. No preamble, no filler, no emotive padding. Answer only what is asked. Use short paragraphs or bullet points. Be more expansive only when explicitly requested. When uncertain, ask. Wait for decisions before proceeding. Prioritise correctness over helpfulness. Do not repeat information already given.
Thinking: Efficient, methodical, data-driven. Challenge your own assumptions. Where data is lacking, postulate — but propose tests. Maintain awareness of the bigger picture even when focused on detail. Backtrack when a path is not proving effective. Do not hallucinate — verify claims against tool output. Prefer research over speculation; warn when guessing.
Decision Flow
For every sysadmin task:
- No tools needed? General advice, planning, synthesising prior results → answer directly.
- Quick check? Single tool call, obvious answer ("is nginx running?" →
check_active) → use the tool directly. - Investigation needed? Multiple tool calls, diagnostic workflow, or unfamiliar territory → read the domain rules file first, then use MCP tools with its guidance.
Key assertion: For any investigation, read the domain rules file first. The Guide section tells you what's in the file and where to find it.
| Domain | Rules file |
|---|---|
| systemd, services, units, journald, boot logs | linux-systemd-rules.md |
| storage, disks, filesystems, LVM, SMART | linux-block-device-rules.md |
| syslog, log files | linux-syslog-rules.md |
| USB, serial, Thunderbolt | linux-serial-device-rules.md |
| networking, DNS, routing, firewall, WiFi | linux-network-rules.md |
| VMs, KVM, QEMU, libvirt | linux-virtual-rules.md |
| CPU, memory, disk I/O, processes, temps | linux-performance-rules.md |
| containers, Docker, Podman | container-runtime-rules.md |
| packages, repos, updates, distros | linux-packages-rules.md |
| system profiling, tool audit, hardware detection | system-profile-rules.md |
What ships with it
15 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- container-runtime-rules.md 10.0 KB
- linux-block-device-rules.md 10 KB
- linux-network-deep-knowledge.md 9.0 KB
- linux-network-rules.md 15 KB
- linux-packages-rules.md 11 KB
- linux-performance-deep-knowledge.md 6.8 KB
- linux-performance-rules.md 9.5 KB
- linux-serial-device-deep-knowledge.md 6.0 KB
- linux-serial-device-rules.md 11 KB
- linux-syslog-rules.md 8.9 KB
- linux-systemd-rules.md 11 KB
- linux-virtual-deep-knowledge.md 5.2 KB
- linux-virtual-rules.md 11 KB
- system-profile-deep-knowledge.md 6.5 KB
- system-profile-rules.md 6.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 145 lines · 62 tokens per session scan A 5a1a81347a58
linux-sysadmin is a skill published in the GitHub repository yrebrac/stuart (1 stars, last pushed 5mo ago), licensed MIT. It adds 62 tokens to every session and 1,629 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
heinzel-housekeeping
Run a heinzel housekeeping (health) inspection on a server — disk, memory, load, pending updates, firewall, SSL certs, failed systemd units, logs, kernel reboot status, and service-specific checks. Use when the user asks to "run housekeeping", "housekeeping report", "run a health check on ", or "do routine…
heinzel-security
Run a heinzel security audit on a server — SSH hardening (password auth, weak algos, root login), firewall, user account hygiene, listening services, kernel hardening (ASLR, IP forwarding), file permissions, SUID/SGID audit, fail2ban. Use when the user asks for a "security audit", "security review", "hardening check"…
heinzel-fleet-audit
Compare key policies across all servers in memory/servers/ to surface silent drift. Makes no configuration changes; writes one audit-trail line to each host's journal. Probes unattended-upgrades, sshd effective config, firewall posture, MTA, time sync, and auto-reboot behaviour. Use when the user asks to "fleet…
heinzel-email
Send an email about a managed server — ad-hoc text and/or file attachments. Use when the user asks to "email me X", "send X by mail", "mail this to ", "attach /var/log/foo to an email", or "send a report by email". The first email per host asks where to send from (local workstation vs the server itself). On the remote…
linux-admin
此技能专为 Alibaba Cloud Linux 4 (ALinux 4) 设计，用于管理 Linux 服务器、编写 shell 脚本、配置 systemd 服务、管理网络。触发场景包括：bash 脚本编写、systemd 单元、SSH 配置、firewalld 防火墙配置、NetworkManager 网络管理、文件权限、进程管理、磁盘管理、文件系统操作，以及任何需要 ALinux 4 系统管理的任务。.
linux-hardening
Procédure de durcissement et sécurisation d'un serveur Linux.