analyzing-persistence-mechanisms-in-linux

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline. Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

65%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-structured but stops short of being actionable and navigable: it describes steps rather than giving executable commands, omits a validation checkpoint for the batch scan, and fails to link the bundled script and API reference that would make it copy-paste ready.

Suggestions

Make the Steps actionable by adding the bundled scanner invocation (e.g. 'Run `python scripts/agent.py --scan all --output linux_persistence_report.json`') or inlining key one-liners from references/api-reference.md so guidance is copy-paste ready.

Insert a validation/triage checkpoint between scanning and report generation — e.g. 'Triage findings against known-good package-managed units and baseline cron entries before scoring' — to add the feedback loop the batch workflow currently lacks.

Link the bundle from the body: add a '## References' or inline pointers such as 'See references/api-reference.md for the full command catalog' and 'See scripts/agent.py for the automated scanner' so the existing detailed materials are discoverable one level deep.

Dimension	Reasoning	Score
Conciseness	The body is lean and assumes Claude's competence — the Overview and Steps state actions without explaining what cron/systemd/LD_PRELOAD are, and every section earns its place. It is not the verbose, concept-explaining anchor for score 1, nor does it carry the mild padding of score 2.	3 / 3
Actionability	Steps name concrete paths ('/etc/cron.d/', '/etc/ld.so.preload', '~/.config/systemd/user/') but the body itself contains no executable commands or code, and it never points to the bundled scripts/agent.py or references/api-reference.md, leaving guidance incomplete per the 'some concrete guidance but incomplete' anchor rather than fully copy-paste ready.	2 / 3
Workflow Clarity	Seven steps are clearly sequenced, but this batch-scan workflow has no validation/triage checkpoint — no step to verify findings or filter false positives before report generation — so it matches 'steps listed but validation gaps; checkpoints missing or implicit' rather than the explicit feedback-loop anchor.	2 / 3
Progressive Disclosure	Sections are well organized, but the body never references the existing bundle (scripts/agent.py and references/api-reference.md); the detailed command catalog and automated scanner are orphaned rather than signaled one level deep, matching 'references present but not clearly signaled' rather than the well-navigated score-3 anchor.	2 / 3
	Total	9 / 12 Passed

Description

100%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, trigger-rich, complete, and distinctive, using third-person imperative voice consistent with the good examples. It clearly answers both what the skill does and when to use it.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Scan Linux systems for persistence mechanisms including crontab/systemd entries, LD_PRELOAD injection, shell profile modifications ... and SSH authorized_keys backdoors, then correlate findings with auditd logs into an installation timeline' — matching the 'lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Clearly states what it does (scan, correlate, build timeline) and when to use it via the explicit 'Use during incident response or threat hunting to detect or confirm how an adversary maintained access to a compromised Linux host.' clause, satisfying both what AND when.	3 / 3
Trigger Term Quality	Natural terms a practitioner would say are well covered: 'crontab', 'systemd', 'LD_PRELOAD', 'SSH authorized_keys', 'auditd', 'incident response', 'threat hunting', matching the 'good coverage of natural terms' anchor.	3 / 3
Distinctiveness Conflict Risk	Targets a clear niche (Linux persistence mechanisms) with distinct triggers (crontab/systemd/LD_PRELOAD/authorized_keys/auditd), making it unlikely to fire for an unrelated skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-persistence-mechanisms-in-linux/SKILL.md
Commit: e612f49

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.