技能 linux-production-shell-scripts
📦
linux-production-shell-scripts
v1.1 内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
构建 Linux 生产环境 Shell 脚本
Linux 团队需要可重复使用的脚本来处理常见管理工作。此技能为备份、监控、日志、用户、网络和自动化提供结构化的 Bash 模板。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "linux-production-shell-scripts" from https://skillstore.io/skills/sickn33-linux-production-shell-scripts.md and its manifest at https://skillstore.io/api/skills/sickn33-linux-production-shell-scripts/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“linux-production-shell-scripts”。 为 /srv/app 创建一个保留七个归档文件的备份脚本。
预期结果:
一份 Bash 备份方案，包含可配置的源路径和目标路径、带时间戳的归档名称、保留逻辑，以及用于测试恢复行为的说明。
正在使用“linux-production-shell-scripts”。 检查 Apache 是否正在运行，并在需要时重启它。
预期结果:
一个服务维护脚本大纲，用于检查服务状态、记录每个操作、仅在需要时使用特权命令，并清晰报告失败。
正在使用“linux-production-shell-scripts”。 汇总 Linux 系统日志中的错误。
预期结果:
一种日志分析方法，用于选择日志文件、过滤重要错误词、统计匹配次数，并写入带日期的报告供审查。
安全审计
严重v5 • 2026/7/9 打开版本化报告
The skill is primarily documentation with Bash templates, so many Markdown backtick and shebang findings are false positives. Real risks remain in privileged package and service commands, cron and nohup persistence patterns, account inventory, destructive file operations, remote SSH execution, and unsafe secret handling examples.
1
已扫描文件
505
分析行数
30
复核项
0
已忽略误报
已确认安全问题 (10)
严重
System password file access
for user in $(grep "/bin/bash" /etc/passwd | cut -d: -f1); do
The password expiry checker reads /etc/passwd to enumerate shell users. /etc/passwd is readable on many systems, but the script still collects sensitive account inventory.
高
Cron job modification
| `crontab -e` | Edit cron jobs |
The quick reference instructs users to edit cron jobs. Cron entries are a persistence mechanism, so this is a real administrative risk even as documentation.
高
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The skill combines executable shell templates with cron scheduling, nohup background execution, sudo commands, and remote SSH execution. The intent appears administrative, but the combination is a real persistence and privilege risk.
高
Remote Script Execution Template
The skill includes an SSH template that sends a local script to a remote server and runs it with bash. This can execute unreviewed local content on another host if users accept defaults or provide the wrong target.
The SSH command explicitly runs a supplied script on a remote server. This is a direct remote execution pattern with clear administrative impact.
高
Destructive File Operation Templates
The skill includes rsync deletion and find-based removal templates. These patterns can delete large amounts of data when paths, variables, or retention values are wrong.
The commands include rsync --delete and rm execution through find. Both are valid admin tools, but the destructive behavior is explicit.
中
Unsafe Secret Handling Examples
The database backup template uses a password variable in the script, and the password generator prints generated passwords to standard output. These examples can encourage secret exposure in logs, shells, or files.
The examples visibly place a database password in a shell variable and echo generated passwords. The issue is contextual and not covered by the static patterns.
低
System reconnaissance
output_file="system_info_$(hostname)_$(date +%Y%m%d).txt"
The system info collector names its report with the hostname and gathers host details. This is expected admin inventory but still system reconnaissance.
低
System reconnaissance
echo "Hostname: $(hostname)"
The script explicitly records the hostname. Host identity collection is low-risk but useful for reconnaissance.
显示全部 10 条已确认问题
低
System reconnaissance
echo "OS: $(uname -a)"
The script records uname -a output, including kernel and platform details. This is legitimate diagnostics but also system fingerprinting.
低
Network reconnaissance
ip addr show "$interface" 2>/dev/null || ifconfig "$interface" 2>/dev/null
The network interface script displays interface addresses and routing data. This is normal troubleshooting but exposes network topology details.
能力复核项 (30)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Ruby/shell backtick execution
```bash
This code block creates local user accounts and invokes passwd, changing authentication state.
高
Ruby/shell backtick execution
```bash
This code block reads local account data and password aging metadata for all bash users.
高
Ruby/shell backtick execution
```bash
This code block installs system packages with sudo apt-get, changing host software state.
高
Ruby/shell backtick execution
```bash
This code block writes to crontab, creating scheduled execution and persistence.
高
Ruby/shell backtick execution
```bash
This code block controls system services through sudo systemctl, which can affect availability.
高
Ruby/shell backtick execution
```bash
This code block deletes files selected by find and can remove unintended data if parameters are wrong.
高
Ruby/shell backtick execution
```bash
This code block executes a local script on a remote host over SSH, creating remote command execution risk.
高
Ruby/shell backtick execution
| `crontab -e` | Edit cron jobs |
This quick reference recommends crontab editing, which can create scheduled persistence.
高
Shell command substitution
for user in $(grep "/bin/bash" /etc/passwd | cut -d: -f1); do
The script enumerates bash users from /etc/passwd for password expiry reporting. This exposes local account inventory and overlaps with sensitive system reconnaissance.
高
Template literal with command substitution
```bash
The surrounding password expiry checker enumerates users and password aging metadata.
高
Unix shell invocation
useradd -m -s /bin/bash "$username"
This line creates a local user with /bin/bash as the shell. Account creation changes system security state and should require explicit administrative review.
高
Unix shell invocation
for user in $(grep "/bin/bash" /etc/passwd | cut -d: -f1); do
This loop enumerates local bash users from /etc/passwd. The context is an admin report, but it still collects sensitive account inventory.
高
sudo privilege escalation
sudo apt-get install -y "$package"
The package installation template runs sudo apt-get install -y. It modifies system packages with elevated privileges and can alter host trust boundaries.
高
sudo privilege escalation
sudo systemctl restart "$service_name"
The service template restarts a system service through sudo systemctl. This is privileged service control that can disrupt availability or change runtime state.
高
sudo privilege escalation
sudo systemctl start "$service_name"
The service template starts a system service through sudo systemctl. This is privileged service control and must not be run without operator approval.
高
sudo privilege escalation
- Many scripts require root/sudo privileges
The limitations section states many scripts require root or sudo privileges. This accurately reflects a real elevated-privilege risk in the templates.
高
Standard device file access
(crontab -l 2>/dev/null; echo "$schedule_time $scheduled_task") | crontab -
Although the scanner matched stderr redirection, the line writes a new entry into crontab. Cron modification creates scheduled persistence and needs explicit safeguards.
中
Ruby/shell backtick execution
```bash
This code block contains backup rotation that can remove backup directories when paths are wrong.
中
Ruby/shell backtick execution
```bash
This code block uses rsync --delete, which can remove destination files during synchronization.
中
Ruby/shell backtick execution
```bash
This code block collects host, OS, CPU, memory, disk, network, and login information.
中
Ruby/shell backtick execution
| `nohup ./script.sh &` | Run in background |
This quick reference recommends nohup background execution, a persistence-like run mode.
中
Shell command substitution
while [ $(ls -1 "$backup_dir" | wc -l) -gt "$max_backups" ]; do
The command substitution is part of backup rotation logic that counts files before deleting older backups. A wrong backup_dir can cause unintended deletion, so this is a real operational risk.
中
Shell command substitution
oldest_backup=$(ls -1t "$backup_dir" | tail -n 1)
The command substitution selects a path that is later removed by the backup rotation script. File names from ls output can be fragile and may lead to deleting the wrong target.
中
Shell command substitution
password_expires=$(chage -l "$user" 2>/dev/null | grep "Password expires" | awk -F: '{print $2}')
The command queries password aging metadata for each local user. This is legitimate administration but discloses account security state when run broadly.
中
Shell command substitution
output_file="system_info_$(hostname)_$(date +%Y%m%d).txt"
The system information collector embeds the hostname in an output file and then records host details. This is low-severity reconnaissance data collection.
中
Shell command substitution
echo "Hostname: $(hostname)"
The command collects the hostname as part of a system inventory report. Hostname collection is benign for admins but still reveals system identity.
中
Shell command substitution
echo "OS: $(uname -a)"
The command records uname -a output, which can reveal kernel and platform details useful for targeting. It is an administrative script but still a recon signal.
中
Template literal with command substitution
```bash
The surrounding backup rotation script uses command substitution to choose items later removed by rm -r.
中
Template literal with command substitution
```bash
The surrounding system info collector records host identity and platform details.
中
nohup (background persistent process)
| `nohup ./script.sh &` | Run in background |
The quick reference recommends nohup background execution, which can keep scripts running outside the terminal. This is a legitimate pattern but also a persistence mechanism.
风险因素
⚙️ 外部命令 (50)
SKILL.md:39-47 SKILL.md:47-50 SKILL.md:50-58 SKILL.md:58-61 SKILL.md:61-73 SKILL.md:73-76 SKILL.md:76-87 SKILL.md:87-92 SKILL.md:92-104 SKILL.md:104-107 SKILL.md:107-119 SKILL.md:119-122 SKILL.md:122-131 SKILL.md:131-134 SKILL.md:134-160 SKILL.md:160-165 SKILL.md:165-179 SKILL.md:179-182 SKILL.md:182-198 SKILL.md:198-203 SKILL.md:203-210 SKILL.md:210-213 SKILL.md:213-233 SKILL.md:233-238 SKILL.md:238-247 SKILL.md:247-250 SKILL.md:250-265 SKILL.md:265-270 SKILL.md:270-284 SKILL.md:284-287 SKILL.md:287-301 SKILL.md:301-304 SKILL.md:304-314 SKILL.md:314-319 SKILL.md:319-335 SKILL.md:335-338 SKILL.md:338-346 SKILL.md:346-349 SKILL.md:349-363 SKILL.md:363-368 SKILL.md:368-376 SKILL.md:376-379 SKILL.md:379-389 SKILL.md:389-392 SKILL.md:392-404 SKILL.md:404-409 SKILL.md:409-438 SKILL.md:438-443 SKILL.md:443-460 SKILL.md:460-463
🌐 网络访问 (2)
检测到的模式
System password file accessCron job modificationSystem reconnaissance×3Network reconnaissance
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/sickn33-linux-production-shell-scripts/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-linux-production-shell-scripts?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-linux-production-shell-scripts?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-linux-production-shell-scripts/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-linux-production-shell-scripts.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
sickn33. (2026). linux-production-shell-scripts security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-linux-production-shell-scripts/audits/5BibTeX 引用
@techreport{sickn33-sickn33-linux-production-shell-scripts-2026,
author = {sickn33},
title = {linux-production-shell-scripts security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-linux-production-shell-scripts/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "linux-production-shell-scripts security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-linux-production-shell-scripts/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-linux-production-shell-scripts:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
69
社区
87
规范符合性
你能构建什么
创建备份任务
生成用于本地归档、远程 rsync 备份、数据库转储和简单备份轮转的脚本。
监控服务器健康状况
构建脚本来记录 CPU、磁盘、正常运行时间、进程、内存和服务状态，以便进行例行检查。
自动化维护任务
准备可重复使用的脚本，用于清理、包安装、cron 调度和仓库更新。
试试这些提示
创建基础备份脚本
创建一个 Bash 脚本，将一个目录备份到另一个目录，并生成带时间戳的归档文件。包含清晰的变量和基本错误处理。
添加监控告警
创建一个 Linux 监控脚本，根据阈值检查 CPU 和磁盘使用率，并写入带时间戳的告警日志。
审查维护脚本
审查此 shell 脚本的引用、权限、破坏性命令、日志记录和回滚问题。在生产使用前建议更安全的修改。
设计生产环境自动化套件
设计一组用于备份、日志分析、清理和服务检查的 Bash 脚本。包含 dry-run 模式、配置变量和运维保障措施。
最佳实践
- 先在非生产测试环境中运行生成的脚本。
- 在执行前，将占位符替换为明确的路径、用户、主机和阈值。
- 围绕破坏性操作添加 dry-run、日志记录、确认和备份步骤。
避免
- 在未先阅读每条命令的情况下，以 root 身份运行生成的脚本。
- 在脚本文件中嵌入真实密码、令牌或私有主机名。
- 在验证路径和权限之前，调度 cron 任务或执行远程命令。
常见问题
此技能可以替我运行 shell 脚本吗？
不能。它提供脚本模板和指导。用户必须在自己的环境中审查并运行脚本。
它支持生产 Linux 服务器吗？
可以，但每个脚本都应经过测试，并根据目标发行版、权限和运维策略进行调整。
它可以创建监控脚本吗？
可以。它包含用于 CPU 使用率、磁盘使用率、正常运行时间检查、系统健康状况和基础服务监控的模板。
它可以管理用户和密码吗？
它包含管理示例，但用户和密码任务需要严格的权限控制和本地策略审查。
它默认会安全处理密钥吗？
不能。用户应在生产使用前，将密钥迁移到已批准的密钥存储或受保护的环境变量中。
使用生成的脚本前应审查什么？
审查 sudo 使用、删除操作、cron 变更、远程主机、文件路径、日志记录和回滚步骤。