---
name: "rkhunter-rootkit-scanner"
description: "Scan Linux servers for known rootkits, backdoors, and suspicious hidden files."
metadata:
  author: "Rootkit Hunter"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run rkhunter scan"
  - "update rkhunter database"
  - "check for rootkits linux"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Rootkit Hunter System Integrity & Scanner

Scans Linux hosts with rkhunter: verifying MD5/SHA hashes against baseline package manager databases, checking for hidden processes and files, inspecting listening socket backdoors, and scanning /dev.

## When to Invoke
Invoke this skill whenever you need to:
- run rkhunter scan
- update rkhunter database
- check for rootkits linux

## Execution SOP & Rules
1. Update signature files with rkhunter --update before scanning.
2. Update file properties database after authorized software updates with rkhunter --propupd.
3. Execute non-interactive scan with rkhunter --check --skip-keypress --report-warnings-only.
4. Review /var/log/rkhunter.log to investigate flagged suspicious binaries or hidden ports.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.