tomevault-io Scan
Single on-demand scan run. Reads installed.* to know what's available; asks the user which scanners + scope.
Config
${CLAUDE_USER_DATA:-${XDG_DATA_HOME:-$HOME/.local/share}/claude-plugins}/linux-av-manager/config.json
scans_dir is the report root. Per-tool subfolder; one file per scan named <ISO-timestamp>.txt (or .json where the tool supports it).
Scope choices
- Quick —
~only, ClamAV + rkhunter. - Deep — full filesystem (
/) excluding pseudo-FS (/proc /sys /dev /run), all installed scanners. - Path — user-supplied path; ClamAV only.
- Custom — let the user pick scanners + path.
Default if not asked: quick.
Per-tool commands
| Tool | Command | Output |
|---|---|---|
| ClamAV | clamdscan --multiscan --fdpass <path> (if clamav-daemon is up) else clamscan -r <path> |
<scans_dir>/clamav/<timestamp>.txt |
| rkhunter | sudo rkhunter --check --skip-keypress --report-warnings-only |
<scans_dir>/rkhunter/<timestamp>.txt |
| chkrootkit | sudo chkrootkit -q (-q = quiet, infections only) |
<scans_dir>/chkrootkit/<timestamp>.txt |
| Lynis | sudo lynis audit system --quick --no-colors |
<scans_dir>/lynis/<timestamp>.txt (also leaves /var/log/lynis-report.dat) |
| AIDE | sudo aide --check |
<scans_dir>/aide/<timestamp>.txt |
Run in parallel only if independent and the host has the headroom — these are I/O heavy. Default to sequential.
Reporting
After all scanners complete, write a <scans_dir>/_summary/<timestamp>.md with one section per tool:
- Tool, scanner version, signature/db version (if applicable).
- Files / paths scanned.
- Counts: infected / suspect / warnings / clean.
- The actual findings (full lines, not just counts).
- A
verdictfield:clean,noisy(warnings only),findings(real hits).
Highlight the real findings at the top of the summary — bury the clean entries.
False-positive handling
- chkrootkit's
bindshell INFECTEDon port 465 is a known false positive (Postfix submissions). Annotate, don't alarm. - rkhunter
Hidden files foundwarnings are usually benign system files (.gitignore,.cache). Annotate. - AIDE deltas after a system update are expected. Suggest
update-definitionsfirst if a recent apt upgrade ran.
Notes
- Don't auto-quarantine. Surface findings; let the user act.
- Don't email results; just write to disk.
- Long ClamAV scans of
/can take an hour+ — warn before starting deep mode.
Source: danielrosehill/Claude-Linux-AV-Manager-Plugin — distributed by TomeVault.