What problem does it solve? After a compromise, attackers often erase their tracks by clearing shell history, redirecting it to /dev/null, disabling history in shell rc files, or truncating login records like wtmp. This Skill detects those tamper indicators across every login user and root without ever reading the contents of anyone's history, so you can spot a possible breach while respecting user privacy. ## Core Features & Use Cases - Tamper detection via metadata only: Judges wiping from file size, symlink targets, permissions, ownership, immutable bits, and shell rc settings — never reads what users typed. - Stable fingerprinting and regression alerts: Journals each finding in SQLite with a stable per-user/per-path fingerprint, so a re-wiped trail regresses loudly on the next audit run. - Read-only and safe: Never modifies history files, permissions, rc files, or logs; destructive actions are blocked by a prime directive and handed to the operator. - Use Case: During a routine /watchman audit on a Linux server, the Skill flags that root's .bash_history is a symlink to /dev/null and wtmp was truncated — a classic post-compromise signal — and records it for the operator to investigate. ## Quick Start Ask the AI to run the check-shell-history audit to verify whether shell history and login records on this machine show signs of tampering.
