System commands

Skill iammm0/secbot/skills/base/system-commands

Authorized security testing workspace. v2 TypeScript terminal product on release; v1 Python on pypi-release; Go branch is demo only.

Install

npx -y skills add iammm0/secbot --skill system-commands

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.

What its author says it does

Copied from the file, not written here

System-level commands for security assessment and system enumeration. Use this skill when performing local system reconnaissance, process analysis, or system information gathering during authorized security testing.

SKILL.md

5.2 KB, ~1.4k tokens by cl100k_base, as published. Nobody here has run it

System Commands Reference

Overview

This skill provides comprehensive system-level commands for security assessment and enumeration.

File Operations

List Files

{
    "action": "list_files",
    "path": "C:\\",
    "recursive": false
}

Read File

{
    "action": "read_file",
    "file_path": "C:\\path\\to\\file.txt",
    "encoding": "utf-8"
}

Write File

{
    "action": "write_file",
    "file_path": "C:\\output\\result.txt",
    "content": "file content here"
}

File Info

{
    "action": "get_file_info",
    "file_path": "C:\\Windows\\System32\\notepad.exe"
}

Directory Operations

[
    { "action": "create_directory", "dir_path": "C:\\temp\\new_folder" },
    { "action": "delete_file", "file_path": "C:\\temp\\file.txt" },
    { "action": "delete_directory", "dir_path": "C:\\temp\\folder" },
    { "action": "copy_file", "src": "C:\\source\\file.txt", "dst": "C:\\dest\\file.txt" },
    { "action": "move_file", "src": "C:\\source\\file.txt", "dst": "C:\\dest\\file.txt" }
]

Process Operations

List Processes

{
    "action": "list_processes",
    "filter_name": "svchost"
}

Returns:

PID, name, CPU%, memory%, status

Get Process Info

{
    "action": "get_process_info",
    "pid": 1234
}

Kill Process

{
    "action": "kill_process",
    "pid": 1234
}

Common Process Enumeration (Security)

Task	Command	Use Case
Find suspicious processes	`tasklist /v` (Win) / `ps aux` (Lin)	Malware detection
Process with network	`netstat -ano` + tasklist	Find process using port
Hidden processes	`wmic process` (Win)	Rootkit detection
Service processes	`sc query` (Win) / `systemctl list` (Lin)	Persistence check

System Information

Get CPU Info

{
    "action": "get_cpu_info"
}

Get Memory Info

{
    "action": "get_memory_info"
}

Get Disk Info

{
    "action": "get_disk_info"
}

Get Network Info

{
    "action": "get_network_info"
}

Security Assessment Use Cases

1. System Reconnaissance

[
    { "action": "get_system_info" },
    { "action": "list_files", "path": "C:\\Users", "recursive": true },
    { "action": "list_processes" }
]

2. Malware Analysis

[
    { "action": "get_process_info", "pid": 1234 },
    { "action": "list_processes", "filter_name": "svchost" },
    { "action": "list_files", "path": "C:\\Windows\\System32", "recursive": false }
]

3. Privilege Escalation Check

[
    { "action": "execute_command", "command": "whoami /all" },
    { "action": "execute_command", "command": "id" },
    { "action": "execute_command", "command": "net user admin" }
]

4. Persistence Detection

[
    {
        "action": "list_files",
        "path": "C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
    },
    {
        "action": "execute_command",
        "command": "reg query HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    },
    {
        "action": "execute_command",
        "command": "cat /etc/crontab"
    }
]

5. Credential Hunting

[
    { "action": "execute_command", "command": "reg save HKLM\\SAM C:\\temp\\sam" },
    { "action": "execute_command", "command": "cat /etc/passwd" },
    { "action": "execute_command", "command": "cat /etc/shadow" },
    {
        "action": "list_files",
        "path": "C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
    }
]

Environment Variables

Get Environment Variable

{
    "action": "get_env",
    "key": "PATH"
}

Set Environment Variable

{
    "action": "set_env",
    "key": "MY_VAR",
    "value": "test_value"
}

List All Variables

{
    "action": "list_env"
}

Path Operations

Get Current Directory

{
    "action": "get_current_directory"
}

Change Directory

{
    "action": "change_directory",
    "path": "C:\\temp"
}

Check Path Exists

{
    "action": "path_exists",
    "path": "C:\\Windows"
}

Output Format

All operations return:

{
    "success": true,
    "result": "<operation result>",
    "error": "error message if failed"
}

Best Practices

Permissions
- Some operations require elevated privileges
- Check return values for permission errors
Performance
- Use recursive: false for large directories
- Consider timeout for network operations
Security
- Be careful with file write operations
- Avoid overwriting critical system files
Logging
- All operations are logged for audit
- Sensitive operations may require confirmation