From linux-av-manager
Run an on-demand security scan with one or more installed tools — ClamAV (clamscan / clamdscan against home or a chosen path), rkhunter, chkrootkit, Lynis (system audit), AIDE (integrity check). User picks scope (quick / deep / specific path) and which scanners to run. Reports go to the user-defined scan-results folder, organised per tool with timestamped filenames. Triggers on "scan my system", "run clamav", "rkhunter scan", "lynis audit".
npx claudepluginhub danielrosehill/claude-code-plugins --plugin linux-av-managerThis skill uses the workspace's default tool permissions.
Single on-demand scan run. Reads `installed.*` to know what's available; asks the user which scanners + scope.
Mandates invoking relevant skills via tools before any response in coding sessions. Covers access, priorities, and adaptations for Claude Code, Copilot CLI, Gemini CLI.
Share bugs, ideas, or general feedback.
Single on-demand scan run. Reads installed.* to know what's available; asks the user which scanners + scope.
${CLAUDE_USER_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/claude-plugins}/linux-av-manager/config.json
scans_dir is the report root. Per-tool subfolder; one file per scan named <ISO-timestamp>.txt (or .json where the tool supports it).
~ only, ClamAV + rkhunter./) excluding pseudo-FS (/proc /sys /dev /run), all installed scanners.Default if not asked: quick.
| Tool | Command | Output |
|---|---|---|
| ClamAV | clamdscan --multiscan --fdpass <path> (if clamav-daemon is up) else clamscan -r <path> | <scans_dir>/clamav/<timestamp>.txt |
| rkhunter | sudo rkhunter --check --skip-keypress --report-warnings-only | <scans_dir>/rkhunter/<timestamp>.txt |
| chkrootkit | sudo chkrootkit -q (-q = quiet, infections only) | <scans_dir>/chkrootkit/<timestamp>.txt |
| Lynis | sudo lynis audit system --quick --no-colors | <scans_dir>/lynis/<timestamp>.txt (also leaves /var/log/lynis-report.dat) |
| AIDE | sudo aide --check | <scans_dir>/aide/<timestamp>.txt |
Run in parallel only if independent and the host has the headroom — these are I/O heavy. Default to sequential.
After all scanners complete, write a <scans_dir>/_summary/<timestamp>.md with one section per tool:
verdict field: clean, noisy (warnings only), findings (real hits).Highlight the real findings at the top of the summary — bury the clean entries.
bindshell INFECTED on port 465 is a known false positive (Postfix submissions). Annotate, don't alarm.Hidden files found warnings are usually benign system files (.gitignore, .cache). Annotate.update-definitions first if a recent apt upgrade ran./ can take an hour+ — warn before starting deep mode.