Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
A structured framework for analyzing and securing a Linux host during or after a security incident. Covers network inspection, process analysis, rootkit scanning, file integrity verification, forensic artifact analysis, and firewall-based containment across Debian, Ubuntu, RHEL-family, Fedora, and Arch Linux systems. Enforces forensic hygiene, anti-lockout safeguards, and change logging throughout.
Covers the full incident response cycle from evidence collection through containment and eradication while enforcing anti-lockout checks and forensic preservation steps that generic runbooks omit.
When to use it
- Investigating a compromised server after detecting unusual outbound traffic
- Blocking a malicious IP and persisting firewall rules across reboots
- Verifying package integrity after suspected unauthorized system modifications
- Analyzing suspicious files statically without executing them
- Auditing cron jobs and systemd services for attacker persistence mechanisms
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Investigate a suspicious high-CPU process on a RHEL server
- 1Run ps auxww --forest and top to identify the suspicious process and its PID
- 2Use lsof -p <PID> to inspect open file handles and ss -antp to check active connections
- 3Hash the associated binary with sha256sum and move it to /root/quarantine
- 4Block the associated IP using nftables or firewall-cmd and persist the rule with firewall-cmd --runtime-to-permanent
- 5Check crontab -l, systemd unit files, and ~/.ssh/authorized_keys for persistence mechanisms
Process contained, artifact preserved in quarantine with hash recorded, firewall rule persisted, persistence mechanisms identified and documented with UTC timestamps