rootkit-triage
From the author
Triages suspected rootkits, bootkits, hidden processes, kernel hooks, driver or module anomalies, concealed network activity, eBPF implants, and boot-integrity failures. Use when host tools may be lying and the incident needs evidence-preserving cross-view analysis, containment, or forensic handoff.
Install
npx skills add zero-lab-ai/skills --skill rootkit-triage -a claude-code
Installs to .claude/skills/rootkit-triage/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 85
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- memory-forensics-triagezero-lab-ai/skillsTriages supplied Windows, Linux, or other volatile-memory images while preserving acquisition provenance, image integrity, process and region evidence, network and object correlations, extracted-artifact custody, timeline limits, and claim confidence. Use for offline memory-forensics review and handoff, not live rootkit trust assessment or full malware reverse engineering.Security★ 281
- windbg-kernel-verifier-triagemicrosoft/win-dev-skillsUse when a kernel dump contains Driver Verifier violations; inspect flags, bugcheck subcodes, and available I/O shadow state. Not for Application Verifier user-mode stops or inferring a violation from enabled flags alone.Other★ 479
- hardware-securitycoco-research/cocoUse for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.Security★ 784
- binary-fault-triagezero-lab-ai/skillsTriages supplied binary, crash, sanitizer, dump, static-analysis, and external reproduction evidence to distinguish a lead, observed fault, reproducible fault, security relevance, and demonstrated non-weaponized impact without executing, mutating, exploiting, or weaponizing a binary.Security★ 281
- windbg-kernel-bugcheck-triagemicrosoft/win-dev-skillsUse when a kernel dump reports a Windows bugcheck; decode parameters and recover exception or trap context before investigating your driver. Not for user-mode process crashes or blaming a module from its name alone.Finance★ 479
- triagehashgraph-online/awesome-codex-pluginsDiagnose stalled, blocked, overloaded, or unhealthy Agiflow projects and recommend specific corrective actions. Use for project health checks, blocked work, conflicting priorities, obsolete tasks, overloaded assignees, or an unmanageable backlog.Planning★ 1.4K
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in