Skill UI

A comprehensive skill for cybersecurity threat hunting and incident response. This tool systematically scans Linux systems to detect various persistence vectors used by adversaries, including suspicious crontab entries, unauthorized systemd units, LD_PRELOAD hijacking, profile modifications (.bashrc), and SSH key backdoors. It correlates findings with auditd logs to build a detailed timeline of compromise.

This tool diagnoses and validates complex cron expressions (e.g., crontab, Kubernetes CronJob) to prevent silent scheduling failures. It identifies five common pitfalls: impossible dates, misunderstood OR semantics, resource spikes, uneven step drift, and leap year issues. Users can check the syntax, understand the true meaning, and calculate future execution times reliably.