Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward auditd reference skill that prints command examples, though some examples would be powerful if a user manually runs them on a real Linux system.
Installers should understand this as a sysadmin reference, not an automation tool. Review and adapt any auditctl, service, semodule, or rules.d examples before running them, especially on production systems, because copied commands can change or disable audit coverage.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -l
# Watch a file
auditctl -w /etc/passwd -p wa -k identity
# Search for events
ausearch -k identity
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -w /etc/ssh/ -p wa -k sshd_config
# Permission filters: r=read, w=write, x=execute, a=attribute
auditctl -w /etc/shadow -p rwxa -k shadow_access
```
### System Call Rules (-a)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -w /etc/ssh/ -p wa -k sshd_config
# Permission filters: r=read, w=write, x=execute, a=attribute
auditctl -w /etc/shadow -p rwxa -k shadow_access
```
### System Call Rules (-a)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -w /etc/ssh/ -p wa -k sshd_config
# Permission filters: r=read, w=write, x=execute, a=attribute
auditctl -w /etc/shadow -p rwxa -k shadow_access
```
### System Call Rules (-a)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -w /etc/ssh/ -p wa -k sshd_config
# Permission filters: r=read, w=write, x=execute, a=attribute
auditctl -w /etc/shadow -p rwxa -k shadow_access
```
### System Call Rules (-a)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
auditctl -w /etc/ssh/ -p wa -k sshd_config
# Permission filters: r=read, w=write, x=execute, a=attribute
auditctl -w /etc/shadow -p rwxa -k shadow_access
```
### System Call Rules (-a)
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock/ -p wa -k logins
# 4.1.7 Record session initiation
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k logins
-w /var/log/btmp -p wa -k logins
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
| success | 0 or 1 | Syscall succeeded? |
| exit | -EACCES | Exit value |
## Persistent Rules
```bash
# Rules in /etc/audit/rules.d/*.rules survive reboot
# File: /etc/audit/rules.d/10-identity.rules
The script presents destructive audit rule management commands such as deleting all active audit rules without any warning, confirmation, or clear note about operational impact. In a reference skill, this can mislead users into disabling or removing audit coverage and reduce visibility during incidents or compliance monitoring.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
-w /var/log/btmp -p wa -k logins
# 4.1.8 Record permission changes
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -k perm_mod
-a always,exit -F arch=b64 -S chown -S fchown -S fchownat -S lchown -k perm_mod
-a always,exit -F arch=b64 -S setxattr -S lsetxattr -S fsetxattr -k perm_mod
-a always,exit -F arch=b64 -S removexattr -S lremovexattr -S fremovexattr -k perm_mod
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 4.1.11 Record use of privileged commands
# Generate with: find / -xdev -perm /6000 -type f
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
# 4.1.17 Make rules immutable
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 4.1.11 Record use of privileged commands
# Generate with: find / -xdev -perm /6000 -type f
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged
# 4.1.17 Make rules immutable
The tool reference includes commands to disable auditing, unlock or weaken audit behavior, and reduce failure handling without any cautionary context. Users may copy these examples directly, causing loss of audit logs, weaker enforcement, or complete audit shutdown on production systems.
No suspicious patterns detected.