competition-linux-credential-pivot
Lets your agent trace credentials on Linux and how they allow movement between machines. Useful for understanding unauthorized access.
What it does
This tool helps trace how login information (like passwords and keys) on Linux systems can be used to access other systems or gain more permissions. It focuses on finding and connecting this information to understand attacks.
When to use it
- ✓When you want to understand how an attacker moved between Linux machines using stolen credentials.
- ✓When you need to find out which tokens or keys were used to gain access to services.
- ✓To analyze how Linux security flaws allow an attacker to gain more control.
Example of what to ask your AI
“How can I trace how a leaked SSH key allowed an attacker to access another Linux server?”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool first collects all types of login and permission information found. Then, it tests where this information can be used to gain access and finally creates a clear path showing how an attacker moved from one point to another.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill competition-linux-credential-pivotOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/CTF-Sandbox-Orchestrator/competition-linux-credential-pivot/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Competition Linux Credential Pivot
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the decisive edge is Linux credential material and where that material is accepted.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Separate credential storage from accepted privilege.
- Record user, process, namespace, socket, key file, and service trust boundary before conclusions.
- Keep artifact recovery, replay path, and resulting capability in one chain.
- Distinguish local escalation from lateral host pivot.
- Reproduce one minimal artifact-to-accepted-access path.
Workflow
1. Map Credential And Trust Artifacts
- Record SSH keys, agent sockets, kubeconfigs, cloud tokens, service-account secrets, env vars, config files, and process memory clues.
- Note sudoers rules, capabilities, setuid binaries, systemd unit context, and namespace boundaries.
- Keep each artifact tied to owner, scope, and expected accepting service.
2. Prove Replay And Pivot
- Show where key, token, socket, or secret is accepted: SSH, API, Unix socket, container runtime, or control-plane endpoint.
- Record host target, protocol, principal, and resulting session or privilege.
- Distinguish authentication success from useful capability gain.
3. Reduce To Decisive Linux Pivot Chain
- Compress to: recovered artifact -> accepted replay path -> pivot host or privilege transition -> resulting capability.
- State whether root cause is weak key handling, token leakage, socket trust, sudo or capability abuse, or namespace crossover.
- If the chain pivots into kernel exploit boundaries, hand off to kernel container escape skill.
Read This Reference
- Load
references/linux-credential-pivot.mdfor artifact checklists, replay matrix, and evidence packaging.
What To Preserve
- Artifact path, owner, scope, accepting service, and resulting principal
- Exact pivot order with protocol and target host or namespace
- One minimal replayable chain proving capability gain
FAQ
What are 'credential artifacts'?
These are pieces of information that prove who you are or that you have permission to do something, like access keys, tokens, or passwords.
What does 'pivoting' mean?
In security, 'pivoting' means using a compromised system as a starting point to attack other systems.
Why is it important to separate 'credential storage' from 'accepted privilege'?
It's a good security practice. It means where you keep your passwords/keys should be separate from where they are actually used to grant access, making it harder for an attacker to use stolen information for full control.
Details
Original description by the author
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Linux credential artifacts, service tokens, SSH material, cloud and container secrets, socket-level trust, and host-to-host pivot chains. Use when the user asks to trace Linux auth artifacts, accepted token or key replay, socket or service-account trust edges, sudo or capability abuse, or explain lateral movement acro
Popularity
- GitHub stars
- 42k
- Ranking position
- #4724
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
dashboard-builder
Helps your agent create useful monitoring dashboards. It turns data into charts that answer important system questions.
affaan-m/ECC
dev-team
Simulates a collaborative development team where different roles respond to a problem together. It's useful for getting multiple perspectives without manually switching agents.
affaan-m/ECC
ecc-council
Has your agent convene a four-voice council for difficult decisions. It's useful when there are multiple good options and debate is needed before choosing.
affaan-m/ECC