analyzing-persistence-mechanisms-in-linux

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-persistence-mechanisms-in-linux/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is admirably concise and well-structured but stops at high-level step descriptions, offloading all executable commands to a reference file it never links and providing no validation feedback loops for forensic operations. Signaling the bundle and adding a verification checkpoint would meaningfully raise actionability and workflow clarity.

Suggestions

Link the bundle from the body, e.g. under Steps add 'See references/api-reference.md for exact commands and auditd rules' and 'Run scripts/agent.py to automate the scan'.

Add a validation checkpoint step, e.g. 'Verify findings: cross-check each discovered mechanism against auditd timestamps before reporting' with a retry-on-mismatch loop.

Inline 1-2 key executable commands per step (e.g. `crontab -l -u <user>` and `cat /etc/ld.so.preload`) so the most common cases are copy-paste ready without opening the reference.

Dimension	Reasoning	Score
Conciseness	Lean body with no concept-explanation padding; every section (Overview, When to Use, Prerequisites, Steps, Expected Output) earns its place and assumes Claude's competence.	5 / 5
Actionability	Steps name actions but provide no inline executable commands or code; the concrete commands live only in references/api-reference.md, which the body never links, leaving guidance incomplete rather than copy-paste ready.	3 / 5
Workflow Clarity	Seven steps are clearly sequenced, but there are no validation checkpoints or feedback loops for forensic/batch operations; the rubric caps workflow clarity at 3 when validation is missing in such contexts.	3 / 5
Progressive Disclosure	Section structure is reasonable and a references/api-reference.md plus scripts/agent.py bundle exists, but the body never signals or links these files, so navigation to the detail material is missing.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely enumerates the persistence vectors scanned and the auditd correlation output, paired with an explicit use-when trigger for incident response and threat hunting. Slightly more trigger-term synonym coverage would push it to a perfect score.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete scanning actions (crontab/systemd entries, LD_PRELOAD injection, shell profile modifications, SSH authorized_keys backdoors) plus auditd log correlation into a timeline, giving comprehensive coverage.	5 / 5
Completeness	Explicitly states what the skill does (scan vectors + correlate auditd into a timeline) and an explicit 'Use during incident response or threat hunting...' trigger.	5 / 5
Trigger Term Quality	Includes natural terms analysts say ('incident response', 'threat hunting', 'persistence mechanisms', 'auditd') but misses common synonyms like 'backdoor detection' or 'host compromise'.	4 / 5
Distinctiveness Conflict Risk	Narrow Linux persistence-hunting niche with specific vectors and MITRE-mapped triggers; minimal overlap risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-persistence-mechanisms-in-linux/SKILL.md
Commit: 54a7988

Reviewed: ~1 hour ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.