analyzing-linux-system-artifacts

Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence mechanisms, or scoping a Linux-based breach during incident response.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable code and good structure, but it lacks validation checkpoints in its batch collection workflow and fails to point to the bundle files that already exist alongside it.

Suggestions

Add validation checkpoints after mounting (verify the mount succeeded) and after batch collection (confirm expected files exist before analysis) to lift workflow clarity above the batch-operation cap of 3.

Link the existing bundle files from the body — e.g., a '## API Reference' section pointing to references/api-reference.md and a note that scripts/agent.py automates the workflow — so progressive disclosure is properly signaled.

Trim the 'Key Concepts' table entries that restate knowledge Claude already has (SUID bit, LD_PRELOAD) or move them into the reference file to tighten conciseness.

Dimension	Reasoning	Score
Conciseness	The body is mostly lean, executable bash/python assuming Claude's competence, with only minor over-explanation in the 'Key Concepts' table (e.g., defining SUID bit, LD_PRELOAD) that could be trimmed, fitting the 4 anchor above the verbose midpoint.	4 / 5
Actionability	Provides complete, copy-paste-ready bash and embedded Python covering collection, account analysis, persistence checks, history analysis, and rootkit detection, matching the fully-executable 5 anchor.	5 / 5
Workflow Clarity	Five clearly sequenced steps exist, but the batch collection (mass cp of logs/config/user artifacts) has no validation checkpoints verifying mount success or that files were copied, so the destructive/batch cap of 3 applies.	3 / 5
Progressive Disclosure	Sections are well organized, but the provided bundle files references/api-reference.md and scripts/agent.py are never linked or signaled from the body, and API/tool detail is inlined rather than split out — matching the 'references present but not clearly signaled' 3 anchor.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it states concrete capabilities, provides explicit 'Use when' trigger guidance, and occupies a distinct Linux-forensics niche. The only minor gap is slightly limited variety of synonyms and file-extension trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across named artifact types — 'Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity' — giving comprehensive coverage, matching the 5 anchor.	5 / 5
Completeness	Explicitly states both the 'what' (examine artifacts to uncover compromise, detect rootkits, reconstruct activity) and a concrete 'Use when...' clause with multiple trigger phrases, matching the 5 anchor.	5 / 5
Trigger Term Quality	Includes natural phrases a user would say — 'investigating a compromised Linux server or workstation', 'hunting for persistence mechanisms', 'scoping a Linux-based breach during incident response' — but omits some common synonyms and file extensions, landing just below comprehensive.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear Linux system-artifact forensics niche with distinct triggers and minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-linux-system-artifacts/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.