Linux System Artifact Analysis
Lets an agent hunt for signs of compromise and persistence on Linux systems using logs, accounts, cron and SSH keys.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent follows a structured incident-response checklist for a Linux server or workstation: it copies key evidence such as authentication logs, shell histories, SSH keys and account files into a case folder, then checks accounts for red flags (such as extra root-level users or system accounts with login shells) and reviews cron jobs and other persistence locations that attackers commonly use. It is meant to be run against a forensic image or read-only access, and it explains what it finds in a way a responder can act on.
Great for
- Incident responders and forensic analysts investigating a suspected Linux breach
- Security engineers scoping what an attacker touched on a server
- Sysadmins who want a repeatable checklist for persistence hunting
Skip it if
- Casual users with no incident to investigate, since it collects sensitive files such as password hashes and SSH keys by design
- Live production systems without authorisation or a read-only approach, because copying shadow and key files and running the scripts could expose secrets or alter evidence
Try asking
- “Investigate this mounted disk image for signs of persistence via cron, systemd or SSH keys”
- “Check /etc/passwd and shadow from this Linux server for UID 0 accounts or unexpected login shells”
- “Review the bash history and auth logs to reconstruct what the suspicious user did”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-linux-system-artifacts.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-linux-system-artifacts.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-linux-system-artifacts.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Always work from a read-only mounted image or copy, never the original evidence, and keep a record of every command run.
- Review the script's findings yourself; the checks are simple heuristics and can produce false positives or miss attacks.
- Treat collected shadow files and SSH keys as sensitive and store the case folder securely.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.