How to use the Linux System Artifact Analysis agent skill

What the skill makes the agent do

An agent skill is a folder of instructions (a SKILL.md file) plus supporting files that an AI agent loads when a task matches the skill's description. This one covers Linux system artifacts: authentication logs, cron and systemd persistence, shell history, SSH keys and system configuration files.

When it applies, the agent follows a structured incident-response checklist. It copies key evidence into a case folder, checks accounts for red flags such as extra UID 0 (root-equivalent) accounts or system accounts with login shells, and reviews cron jobs and other persistence locations that attackers commonly use. It also explains findings in terms a responder can act on.

• Collects logs such as auth.log or secure, syslog, kern.log, audit.log, wtmp, btmp and lastlog
• Collects per-user files such as .bash_history, .zsh_history, .ssh/, .bashrc and .profile
• Collects /etc/passwd, /etc/shadow, /etc/group, sudoers and SSH configuration
• Reviews crontabs, /etc/cron.d, systemd service files and authorized_keys files
• Summarises login history with last and lastb

Install the skill in Claude

Download the ZIP for this skill from the directory page. Then choose one of the two install routes below.

For a personal install, unzip the download into ~/.claude/skills/ so the skill folder sits there. For a single project, unzip it into that project's .claude/skills/ folder instead. The skill is only available where it is placed.

In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

• Personal: unzip into ~/.claude/skills/
• Project only: unzip into .claude/skills/ inside the project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Trigger the skill with a natural request

You do not need a special command. The agent decides to use the skill when your request matches its description, which covers investigating a compromised Linux server or workstation, hunting for persistence mechanisms, and scoping a Linux-based breach during incident response.

Name the system and the goal in plain words. Mention the evidence you have, such as a disk image or read-only access, so the agent knows how to proceed.

• Investigate this Linux server for signs of compromise. I have a read-only disk image mounted at /mnt/evidence.
• Hunt for persistence on this Ubuntu workstation: check cron, systemd services and authorized_keys.
• Scope what an attacker did on this host using auth logs and shell history.
• Check this server for extra root-level accounts and system accounts with login shells.

Prepare the evidence before you start

The skill's workflow starts by mounting a forensic image read-only and copying artifacts into a case folder, so the original evidence is not changed. The source uses a case folder such as /cases/case-2024-001 with subfolders for logs, config, users, persistence and network. Keep your evidence copy separate from your working notes.

The source's mount example uses a read-only loop mount with an offset. Adjust the image path and mount point to match your own setup.

• Use a forensic image or read-only access to the target system
• Have root if you want full collection, since some files such as shadow and root's .ssh are only readable by root
• Create a dedicated case folder before the agent copies anything

Review what the agent reports

For account checks, the agent flags UID 0 accounts other than root, and it lists accounts with interactive shells. For persistence, it reviews crontab files, systemd unit files and authorized_keys entries. For login history, it converts wtmp and btmp into readable text using last and lastb.

Treat each finding as a lead, not a verdict. A legitimate admin account or scheduled job can look unusual. Check the timeline and the content of each item before you decide it is malicious.

• Look for UID 0 accounts other than root
• Check cron entries and systemd services that were changed near the incident window
• Compare authorized_keys entries against known administrators
• Review failed logins in btmp for brute-force patterns