escalate-linux-privilege SKILL.md skillA
escalate-linux-privilege from cha0upup/leoai is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add cha0upup/leoai/escalate-linux-privilege@git:20261001.e4dd21aPins git:20261001.e4dd21a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- cha0upup/leoai
- Path
ai/src/main/resources/skills/agent-node/escalate-linux-privilege/SKILL.md- Versions recorded
- 1
- Latest version
- git:20261001.e4dd21a, committed Oct 1, 2026
- Size
- 5,392 bytes
- Repository stars
- 331
- License
- GPL-3.0
在 Linux Agent 立足点上以只读方式发现并排序本地提权候选路径，覆盖 sudo、SUID/SGID、cron、PATH、服务、容器、Docker socket、NFS 和版本风险。当红队任务需要扩大本机权限、突破容器边界或判断是否值得投入提权时使用；本 skill 不执行利用。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Linux 提权路径优选 目标不是罗列所有弱点，而是找出最可能、收益最高、噪声最低且能推进任务的提权路径。 ## 行动目标 - 确认当前权限是否阻碍演练目标。 - 发现本地或容器边界中的可操作提权候选。 - 对候选路径进行前提验证和红队优先级排序。 - 为后续人工或独立验证提供证据，不执行提权。 ## 授权与 ROE - 风险等级：medium；访问模式：read-only。 - 当前已是 root 时停止，转而评估目标达成或后续行动价值。 - 不执行利用、下载代码、编译载荷、写 cron、修改服务或触发崩溃风险测试。 - `sudo` 仅使用非交互模式，不提交密码。 - 摘要不保存可直接执行的利用代码。 ## OPSEC 预算 - 先执行高价值低噪声检查，再决定是否扩大搜索。 - SUID/SGID 优先限定标准二进制目录；全根文件系统搜索必须 `-xdev`、限时并限制输出。 - 版本匹配只作为候选，不运行 PoC 验证。 - 独立只读项并发执行；异步命令获取必要输出后调用 `stopTask` 释放资源。 ## 工作流 1. 读取侦察摘要，确认任务目标、当前身份、OS、内核和容器状态。 2. 判断提升权限是否会实际推进目标；若不会，建议停止而不是机械扫描。 3. 创建 4 步以内计划：身份与快速路径、配置与文件权限、容器与版本、排序与交接。 4. 执行第一轮低噪声检查；只在没有足够候选时扩大 SUID/cron/服务范围。 5. 对每个候选补齐证据、必要前提、预计收益、稳定性和检测面。 6. 只保留最多 5 条有行动价值的路径，写入一次摘要。 ## 快速检查 ```bash id; whoami; groups; uname -r; cat /etc/os-release 2>/dev/null sudo -n -l 2>/dev/null printf '%s\n' "$PATH" | tr ':' '\n' | while IFS= read -r dir; do [ -n "$dir" ] && [ -w "$dir" ] && echo "WRITABLE_PATH=$dir"; done ls -ld /etc/passwd /etc/shadow /etc/sudoers /etc/sudoers.d 2>/dev/null find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -xdev -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null cat /etc/crontab 2>/dev/null; crontab -l 2>/dev/null …
Read the whole file at its exact version.
How to install
mdr add cha0upup/leoai/escalate-linux-privilege@sha256:8b729725cb69da2eThe line at the top of this page pins the label git:20261001.e4dd21a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_vvmb3twe6j5atjvl)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Oct 1, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5392 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cha0upup/leoai · 331 stars · license GPL-3.0 · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_vvmb3twe6j5atjvl GET https://markdownregistry.com/api/v1/resolve?ref=cha0upup/leoai/escalate-linux-privilege GET https://markdownregistry.com/api/v1/blob/8b729725cb69da2eb189229979843432e6cd4e381499a8e90977d4a23b6c1c1b
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.