Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and reconstruct user/attacker activity. Use when investigating a compromised Linux server or workstation, hunting for persistence mechanisms, or scoping a Linux-based breach during incident response.
Install
KitScout test notes
Not tested by KitScout yet. When our harness runs it, pros, cons and the tasks we tried appear here, with the date and evidence.
Similar tools
reverse-engineer-anything456,653 ★ Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and b
scaffold-exercises323,485 ★ Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use
wait-what323,485 ★ Stop. That last message did not land: re-pitch it.
template-skill193,970 ★ Replace with description of the skill and when Claude should use it.
ponytail-debt190,107 ★ List every `shortcut:` comment (and older `ponytail:` ones) as a debt ledger. One-shot report, changes nothing