Agent skill

Analyzing Linux Kernel Rootkits

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Apache-2.0Auto-check: notesSecurity

Install Analyzing Linux Kernel Rootkits

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-kernel-rootkits --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/analyzing-linux-kernel-rootkits .claude/skills/analyzing-linux-kernel-rootkits && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "analyzing-linux-kernel-rootkits" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-linux-kernel-rootkits into .claude/skills/analyzing-linux-kernel-rootkits/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyzing-linux-kernel-rootkits", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-linux-kernel-rootkits

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-kernel-rootkits --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/analyzing-linux-kernel-rootkits .agents/skills/analyzing-linux-kernel-rootkits && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "analyzing-linux-kernel-rootkits" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-linux-kernel-rootkits into .agents/skills/analyzing-linux-kernel-rootkits/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyzing-linux-kernel-rootkits", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-kernel-rootkits --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/analyzing-linux-kernel-rootkits .cursor/skills/analyzing-linux-kernel-rootkits && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "analyzing-linux-kernel-rootkits" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-linux-kernel-rootkits into .cursor/skills/analyzing-linux-kernel-rootkits/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyzing-linux-kernel-rootkits", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-linux-kernel-rootkits

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-kernel-rootkits --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/analyzing-linux-kernel-rootkits .gemini/skills/analyzing-linux-kernel-rootkits && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "analyzing-linux-kernel-rootkits" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-linux-kernel-rootkits into .gemini/skills/analyzing-linux-kernel-rootkits/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyzing-linux-kernel-rootkits", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-kernel-rootkits

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/analyzing-linux-kernel-rootkits .github/skills/analyzing-linux-kernel-rootkits && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "analyzing-linux-kernel-rootkits" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-linux-kernel-rootkits into .github/skills/analyzing-linux-kernel-rootkits/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyzing-linux-kernel-rootkits", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-linux-kernel-rootkits --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/analyzing-linux-kernel-rootkits .opencode/skills/analyzing-linux-kernel-rootkits && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "analyzing-linux-kernel-rootkits" agent skill from https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-linux-kernel-rootkits into .opencode/skills/analyzing-linux-kernel-rootkits/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyzing-linux-kernel-rootkits", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: analyzing-linux-kernel-rootkits
GitHub stars: 34k
Token cost: ~1.4k tokens
SKILL.md length: 260 words
Files: 4 (incl. scripts, references)
Skills in repo: 639
Repo updated: Aug 31, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Works in 4 steps: Acquire Memory Dump → Analyze with Volatility3 → Cross-View Analysis → …
Security work in your project
SKILL.md covers Overview, When to Use, Prerequisites and Steps, plus 2 more sections
Runs Python scripts from its folder

What it does

Analyzing Linux Kernel Rootkits is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (checksyscall, lsmod, hiddenmodules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.

Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security. It works with Linux. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

Security work in your project

Example prompts

“/analyzing-linux-kernel-rootkits”

Requirements

Python 3

Workflow steps

4 steps, taken from the step headings in SKILL.md.

Acquire Memory Dump
Analyze with Volatility3
Cross-View Analysis
Live System Scanning

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Analyzing Linux Kernel Rootkits loads about 1.4k tokens when it runs, and up to ~2k if it reads all its reference files. Until then it costs about 76 tokens; SKILL.md has 260 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~76
When it runs · the whole SKILL.md, loaded when a task matches: ~1.4k
With references · SKILL.md plus every file in references/, read only if the agent opens them: ~2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

NoteRuns commands with sudoSKILL.md:74

$ sudo python3 rootkit_analyzer.py --memory /evidence/linux-mem.lime --profile Ubuntu2204

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 260 words, ~1,359 tokens.

Download SKILL.mdSave it as .claude/skills/analyzing-linux-kernel-rootkits/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.

name: analyzing-linux-kernel-rootkits
description: Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
domain: cybersecurity
subdomain: digital-forensics
tags: rootkit, linux, kernel, volatility3, memory-forensics, malware-analysis, rkhunter, forensics
version: 1.0
author: mahipal
license: Apache-2.0
nist_csf: RS.AN-03, DE.AE-02, RS.MA-01
mitre_attack: T1014, T1547.006, T1564.001

Analyzing Linux Kernel Rootkits

Overview

Linux kernel rootkits operate at ring 0, modifying kernel data structures to hide processes, files, network connections, and kernel modules from userspace tools. Detection requires either memory forensics (analyzing physical memory dumps with Volatility3) or cross-view analysis (comparing /proc, /sys, and kernel data structures for inconsistencies). This skill covers using Volatility3 Linux plugins to detect syscall table hooks, hidden kernel modules, and modified function pointers, supplemented by live system scanning with rkhunter and chkrootkit.

When to Use

When investigating security incidents that require analyzing linux kernel rootkits
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Volatility3 installed (pip install volatility3)
Linux memory dump (acquired via LiME, AVML, or /proc/kcore)
Volatility3 Linux symbol table (ISF) matching the target kernel version
rkhunter and chkrootkit for live system scanning
Reference known-good kernel image for comparison

Steps

Step 1: Acquire Memory Dump

Capture Linux physical memory using LiME kernel module or AVML for cloud instances.

Step 2: Analyze with Volatility3

Run linux.check_syscall, linux.lsmod, linux.hidden_modules, and linux.check_idt plugins to detect rootkit artifacts.

Step 3: Cross-View Analysis

Compare module lists from /proc/modules, lsmod, and /sys/module to identify modules hidden from one view but present in another.

Step 4: Live System Scanning

Run rkhunter and chkrootkit to detect known rootkit signatures, suspicious files, and modified system binaries.

Expected Output

JSON report containing detected syscall hooks, hidden kernel modules, modified IDT entries, suspicious /proc discrepancies, and rkhunter findings.

Example Output

text

$ sudo python3 rootkit_analyzer.py --memory /evidence/linux-mem.lime --profile Ubuntu2204

Linux Kernel Rootkit Analysis Report
=====================================
Memory Image: /evidence/linux-mem.lime
Kernel Version: 5.15.0-91-generic (Ubuntu 22.04 LTS)
Analysis Time: 2024-01-18 09:15:32 UTC

[+] Scanning syscall table for hooks...
    Syscall Table Base: 0xffffffff82200300
    Total syscalls checked: 449

    HOOKED SYSCALLS DETECTED:
    ┌─────────┬──────────────────┬──────────────────────┬──────────────────────┐
    │ NR      │ Syscall          │ Expected Address     │ Current Address      │
    ├─────────┼──────────────────┼──────────────────────┼──────────────────────┤
    │ 0       │ sys_read         │ 0xffffffff8139a0e0   │ 0xffffffffc0a12000   │
    │ 2       │ sys_open         │ 0xffffffff8139b340   │ 0xffffffffc0a12180   │
    │ 78      │ sys_getdents64   │ 0xffffffff813f5210   │ 0xffffffffc0a12300   │
    │ 62      │ sys_kill         │ 0xffffffff8110c4a0   │ 0xffffffffc0a12480   │
    └─────────┴──────────────────┴──────────────────────┴──────────────────────┘
    WARNING: 4 syscall hooks detected - rootkit behavior confirmed

[+] Checking for hidden kernel modules...
    Loaded modules (lsmod):         147
    Modules in kobject list:        149
    HIDDEN MODULES:
      - "netfilter_helper" at 0xffffffffc0a10000 (size: 12288)
      - "kworker_sched"    at 0xffffffffc0a14000 (size: 8192)

[+] Scanning /proc for discrepancies...
    Processes in task_struct list: 234
    Processes visible in /proc:   231
    HIDDEN PROCESSES:
      - PID 31337  cmd: "[kworker/0:3]"   (disguised as kernel thread)
      - PID 31442  cmd: "rsyslogd"         (fake, real rsyslogd is PID 892)
      - PID 31500  cmd: ""                 (unnamed process)

[+] Checking IDT entries...
    IDT entries scanned: 256
    Modified entries: 0 (clean)

[+] Running rkhunter scan...
    Checking for known rootkits:        68 variants checked
    Diamorphine rootkit:                WARNING - signatures match
    System binary checks:
      /usr/bin/ps:     MODIFIED (SHA-256 mismatch)
      /usr/bin/netstat: MODIFIED (SHA-256 mismatch)
      /usr/bin/ls:     MODIFIED (SHA-256 mismatch)
      /usr/sbin/ss:    OK

[+] Network analysis...
    Hidden connections (not in /proc/net/tcp):
      ESTABLISHED  0.0.0.0:0 -> 198.51.100.47:4443 (PID 31337)
      ESTABLISHED  0.0.0.0:0 -> 198.51.100.47:8080 (PID 31442)

Summary:
  Rootkit Type:         Loadable Kernel Module (LKM)
  Probable Family:      Diamorphine variant
  Syscall Hooks:        4 (read, open, getdents64, kill)
  Hidden Modules:       2
  Hidden Processes:     3
  Hidden Connections:   2 (C2: 198.51.100.47)
  Modified Binaries:    3 (/usr/bin/ps, netstat, ls)
  Risk Level:           CRITICAL

Files

SKILL.md and 3 other files (scripts, references) in skills/analyzing-linux-kernel-rootkits of mukul975/Anthropic-Cybersecurity-Skills.

SKILL.md
LICENSE
references/api-reference.md
scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Analyzing Linux Kernel Rootkits next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Analyzing Linux Kernel Rootkits compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Analyzing Linux Kernel Rootkits this skillmukul975/Anthropic-Cybersecurity-Skills	34k	—	~1.4k	Automated safety check: Notes	Apache-2.0	1 mo ago
Write Cve Ruleevdenis/cvehound	138	—	~2.5k	Automated safety check: Pass	GPL-3.0	5 days ago
Securitystatic-web-server/static-web-server	2.4k	—	~1.5k	Automated safety check: Notes	Apache-2.0	yesterday
User Managementsickn33/agentic-awesome-skills	47k	2 repos	~2.8k	Automated safety check: Notes	MIT	yesterday
Memory Dumperptn1411/skill	219	—	~945	Automated safety check: Notes	None	15 days ago
Patt Fetchertransilienceai/communitytools	559	—	~1.3k	Automated safety check: Pass	MIT	2 mo ago

Similar skills

Write Cve Rule
evdenis/cvehound
Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.
138 GitHub stars~2.5k tokensUpdated 5 days ago
SecurityAuto-check passed
Security
static-web-server/static-web-server
Review or implement security measures for the Static Web Server (SWS) project — path traversal prevention, TLS, security headers, CORS, and input validation
2.4k GitHub stars~1.5k tokensUpdated yesterday
SecurityAuto-check: notes
User Management
sickn33/agentic-awesome-skills
Manage users, groups, and permissions on Linux systems. An agent skill from sickn33/agentic-awesome-skills.
47k GitHub starsUsed in 2 repos~2.8k tokens
SecurityAuto-check: notes
Memory Dumper
ptn1411/skill
Dump process memory and scan for secrets, license keys, decryption keys, tokens, and crypto artifacts.
219 GitHub stars~945 tokensUpdated 15 days ago
SecurityAuto-check: notes
Patt Fetcher
transilienceai/communitytools
Fetches and extracts payloads from PayloadsAllTheThings on demand.
559 GitHub stars~1.3k tokensUpdated 2 mo ago
SecurityAuto-check passed
Re Ti
dslsdzc/rev-skills
威胁情报查询与关联：VT/Any.run/hybrid-analysis、MISP. An agent skill from dslsdzc/rev-skills.
117 GitHub stars~1.4k tokensUpdated 2 days ago
SecurityAuto-check passed

Questions about Analyzing Linux Kernel Rootkits

What does Analyzing Linux Kernel Rootkits do?

Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (checksyscall, lsmod, hiddenmodules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify…. Analyzing Linux Kernel Rootkits is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (checksyscall, lsmod, hiddenmodules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.

When should I use Analyzing Linux Kernel Rootkits?

Analyzing Linux Kernel Rootkits fits situations like: security work in your project.

How do I install Analyzing Linux Kernel Rootkits in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a claude-code`. Or copy the skill folder (skills/analyzing-linux-kernel-rootkits in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/analyzing-linux-kernel-rootkits in your project. Claude Code loads it when a task matches its description.

How do I install Analyzing Linux Kernel Rootkits in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a codex`. Or copy the skill folder (skills/analyzing-linux-kernel-rootkits in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/analyzing-linux-kernel-rootkits in your project. Codex loads it when a task matches its description.

Can I use Analyzing Linux Kernel Rootkits in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-linux-kernel-rootkits -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyzing-linux-kernel-rootkits, .gemini/skills/analyzing-linux-kernel-rootkits, .github/skills/analyzing-linux-kernel-rootkits and .opencode/skills/analyzing-linux-kernel-rootkits in your project.

What does Analyzing Linux Kernel Rootkits need to run?

Going by SKILL.md and its folder, Analyzing Linux Kernel Rootkits needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Analyzing Linux Kernel Rootkits access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Analyzing Linux Kernel Rootkits safe to install?

Our automated static check of SKILL.md found notes only (runs commands with sudo), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Analyzing Linux Kernel Rootkits use?

Analyzing Linux Kernel Rootkits is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Analyzing Linux Kernel Rootkits use?

About 1.4k tokens (SKILL.md is roughly 5.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 648 tokens, read only when the agent opens those files.

What are the alternatives to Analyzing Linux Kernel Rootkits?

Skills that share tags, products or a category with Analyzing Linux Kernel Rootkits: Write Cve Rule (evdenis/cvehound, 138 stars), Security (static-web-server/static-web-server, 2.4k stars), User Management (sickn33/agentic-awesome-skills, 47k stars) and Memory Dumper (ptn1411/skill, 219 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Analyzing Linux Kernel Rootkits?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 33,870 GitHub stars. The repository holds 639 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Analyzing Linux Kernel Rootkits

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

Analyzing Linux Kernel Rootkits

Overview

When to Use

Prerequisites

Steps

Step 1: Acquire Memory Dump

Step 2: Analyze with Volatility3

Step 3: Cross-View Analysis

Step 4: Live System Scanning

Expected Output

Example Output

Files

Compare with similar skills

Similar skills

More from mukul975/Anthropic-Cybersecurity-Skills

Related

Questions about Analyzing Linux Kernel Rootkits