Guide · Agent skill
How to use the Linux Persistence Analyzer agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Linux Persistence Analyzer is an agent skill (analyzing-persistence-mechanisms-in-linux) that gives an AI agent a structured procedure for finding how an attacker kept access to a compromised Linux machine. It is aimed at incident responders, SOC analysts and security students working on a Linux host or forensic image. After reading this guide you will know how to install the skill, how to ask the agent for a persistence hunt, and what limits to respect before running it.
Linux Persistence Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP file from this page and unzip it. The folder should contain SKILL.md, scripts/agent.py and references/api-reference.md.
- 2Place it in the skills folder. Move the folder to ~/.claude/skills/ for personal use or to .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Confirm prerequisites on the target. Check that you have root or sudo access, Python 3.8+, and whether auditd has file watch rules on persistence paths.
- 4Ask for a persistence hunt. Describe the suspected compromise and the host in plain language, and state that you want persistence mechanisms checked.
- 5Review the findings. Read the risk-scored JSON report and the auditd timeline, and verify high-risk entries with the manual commands in the reference file.
- 6Apply remediation carefully. Review each remediation command with an expert and your change control process before running it.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file and optional scripts and reference files. When installed, the agent can load the skill's instructions and follow them when a request matches the skill's description. This skill is for hunting persistence on Linux: ways an adversary keeps access after the initial compromise.
- Checks crontab and cron directories, plus systemd service and timer units, for suspicious entries.
- Checks /etc/ld.so.preload and the LD_PRELOAD variable for injected shared libraries.
- Inspects shell profiles such as .bashrc, .bash_profile, .profile and /etc/profile.d/ for injected commands.
- Audits authorized_keys files for unauthorized public keys, including ones with command restrictions.
- Correlates file modification events in auditd logs with persistence paths to build an installation timeline.
- Produces a risk-scored JSON report with MITRE ATT&CK mapping and remediation commands.
Install the skill from the ZIP file
Download the ZIP file for the skill from this page and unzip it. For a personal install, place the unzipped folder in ~/.claude/skills/. To scope it to one project, place it in that project's .claude/skills/ folder instead.
If you use the Claude apps, you can upload the skill instead under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/analyzing-persistence-mechanisms-in-linux/
- Project: .claude/skills/analyzing-persistence-mechanisms-in-linux/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
Check the requirements before you start
The skill runs scripts and needs elevated access to read sensitive system locations. Confirm these before asking the agent to scan anything.
- Python 3.8+ using only the standard library (os, re, json, glob, subprocess, argparse).
- Root or sudo access on the target Linux system, or a forensic image of it.
- auditd configured with file watch rules on persistence paths. Without these, the timeline step has less to correlate.
- Optional: an OSSEC/Wazuh agent for file integrity monitoring alerts.
- The skill is Linux-only. Its paths and tools do not apply to macOS or Windows.
- The skill's metadata states it runs scripts and does not use the network.
Trigger the skill with a natural request
You do not need a special command. Describe the situation in plain language that matches the skill's purpose: a suspected compromise, persistence, or how an attacker kept access. The agent should load the skill when the request matches its description.
Good requests name the host or image, the scope, and the goal, for example: a persistence hunt on a suspected compromised Linux server, or confirming how an adversary maintained access and when each method was installed.
- "Hunt for persistence on this compromised Ubuntu server and tell me how the attacker kept access."
- "Check this forensic image for cron, systemd, LD_PRELOAD, profile and authorized_keys persistence."
- "Correlate auditd logs with the persistence I find and build an installation timeline."
- "Give me a risk-scored persistence report with remediation commands for each finding."
Understand the output and the manual checks behind it
The skill's reference file lists the underlying commands the procedure is built on. You can run them yourself to verify what the agent reports. Examples include listing user crontabs, listing enabled systemd services, listing timers, and finding recently modified cron files.
Treat the report as a lead, not a verdict. Legitimate cron jobs and profiles are common, so false positives are likely and an expert should review each finding.
- Expected output: a JSON report of persistence mechanisms with risk scores.
- A timeline of persistence installation from auditd correlation.
- MITRE ATT&CK technique mapping (T1053, T1543, T1574, T1546).
- Remediation commands for each detected mechanism. Review them before running.
crontab -l
systemctl list-timers --all
find /var/spool/cron/ /etc/cron* -mtime -7 -type f 2>/dev/nullSafety notes before running it on a real host
The skill reads sensitive locations and needs root or sudo. Only run it on systems you are authorized to examine, and follow your change control process. Running it against a production system without authorization is one of the explicit non-uses of this skill.
Because the skill runs scripts, read the scripts/agent.py file before use. Prefer a copy of the host or a forensic image where possible, so the investigation does not change the live system.
- Get written authorization for the target system.
- Read scripts/agent.py before running it.
- Prefer a forensic image or lab copy over a live production host.
- Review remediation commands before executing any of them, since removing a persistence entry can break legitimate services.
What people use it for
- Confirming how an attacker kept access to a compromised Linux server after an incident.
- Checking a suspicious host for a backdoored SSH authorized_keys entry or a malicious shell profile line.
- Validating whether your monitoring detects crontab, systemd and LD_PRELOAD persistence (MITRE T1053.003, T1543.002, T1574.006).
- Teaching persistence techniques to students using a lab machine or a forensic image.
- Building an installation timeline by matching persistence files against auditd modification events.
Frequently asked questions
How do I install the analyzing-persistence-mechanisms-in-linux skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What do I need to run the Linux persistence analyzer?
You need Python 3.8+ (standard library only), root or sudo access to the target Linux system or a forensic image, and auditd with file watch rules on persistence paths. An OSSEC/Wazuh agent is optional.
Is this skill free to use?
The skill is published under the Apache-2.0 licence, as listed on this page. Check the licence file in the skill's repository for the full terms before using or redistributing it.
Does it work on macOS or Windows?
No. The skill targets Linux only, and its paths and tools do not apply to macOS or Windows systems.
Does the skill send data over the network?
The skill's metadata states that it does not use the network, but it does run scripts and reads sensitive system locations, so read scripts/agent.py before running it.
What are alternatives if this skill is not right for me?
If you are not doing incident response, a general sysadmin audit of cron and systemd may be enough. For ongoing monitoring, the source mentions OSSEC/Wazuh file integrity monitoring as an optional complement.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits incident responders, SOC analysts and security students who need a structured, repeatable way to hunt Linux persistence and build an installation timeline. It is a poor fit for ordinary users or sysadmins without a security incident, and for anyone who cannot get authorization to examine the host, since its output can be noisy and needs expert review.
Download the skill