linux-privilege-escalation

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with concrete, executable commands across all major Linux privesc vectors and a clear phased sequence. Its main weaknesses are lack of explicit validation/feedback checkpoints in the workflow and a monolithic structure with no progressive disclosure to manage its size.

Suggestions

Add explicit validation checkpoints between phases (e.g., confirm root via `id` after each technique, verify a cron script actually executes before waiting) with a verify-fix-retry loop, capping risky operations like kernel-exploit compilation.

Move the large enumeration command catalog and reverse-shell one-liners into a bundled reference file (e.g., references/enumeration-commands.md) and keep SKILL.md as a lean overview that links to it.

Trim redundant enumeration blocks that overlap between Phase 1 and the Quick Reference summary to reduce token load.

Dimension	Reasoning	Score
Conciseness	The body is heavily command-driven and mostly free of concept explanation, but it is long and somewhat padded with repeated enumeration blocks (e.g., overlapping basic enumeration plus a full reverse-shell one-liner reference) that could be tightened or deferred.	2 / 3
Actionability	Nearly every section provides copy-paste-ready, executable bash/C commands with concrete examples for sudo, SUID, capabilities, cron, PATH hijacking, and NFS exploitation.	3 / 3
Workflow Clarity	Phases are clearly sequenced (enumeration, automated tools, kernel, sudo, SUID, etc.), but the multi-step exploitation workflow lacks explicit validation checkpoints or verify-fix-retry feedback loops despite involving risky, potentially system-destabilizing operations.	2 / 3
Progressive Disclosure	The skill is a single monolithic file with no bundle files to offload detail; sections are well-organized but there is no one-level-deep reference structure to split the large command catalog out of SKILL.md.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-constructed: it states concrete capabilities, pairs them with explicit natural-language trigger phrases, and clearly conveys both what the skill does and when to invoke it. It is highly specific to a distinct niche with low conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions such as 'exploit sudo misconfigurations', 'abuse SUID binaries', 'exploit cron jobs for root access', and 'enumerate Linux systems for privilege escalation' rather than vague language.	3 / 3
Completeness	Explicitly answers what it does ('provides comprehensive techniques for identifying and exploiting privilege escalation paths') and when to use it via a direct 'Use when...'-style clause enumerating triggers.	3 / 3
Trigger Term Quality	Uses natural phrasings a user would actually say ('escalate privileges on Linux', 'find privesc vectors on Linux systems', 'gain root access from low-privilege shell') with good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	Occupies a clear niche (Linux privilege escalation) with distinct, specific triggers that would not overlap with other skills' activation conditions.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (505 lines); consider splitting into references/ and linking	Warning

	Total	15 / 16 Passed

Repository: zebbern/claude-code-guide
Path: skills/linux-privilege-escalation/SKILL.md
Commit: af7d491

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.