The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses standard Linux audit utilities (auditctl, augenrules, ausearch, aureport) to configure and query the kernel audit system.
[PRIVILEGE_ESCALATION]: Administrative access via sudo is required for all management tasks, including service installation and the use of immutable mode (-e 2) to lock system auditing rules.
[PERSISTENCE]: Persistence is achieved through the auditd systemd service and configuration files within /etc/audit/rules.d/.
[DATA_EXFILTRATION]: The skill sets up monitoring for sensitive paths such as /etc/shadow and /root/.ssh to provide forensic attribution. This is a standard security practice.
[EXTERNAL_DOWNLOADS]: Necessary packages are downloaded from official Linux distribution repositories (apt, dnf).
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audit logs (/var/log/audit/audit.log) via ausearch. While the example alerting script lacks sanitization for log lines, the ingestion surface is limited to investigative querying by the agent.

linux-auditd-rules