re-ebpf
Helps you analyze and understand security programs that run inside the Linux kernel.
Installation
Paste this into Claude Code, Cursor, or any agent that can run commands.
What this skill does
What it does:
- Analyzes special programs that run inside the Linux kernel
- Reads and understands the low-level instructions that eBPF programs use
- Finds what system functions an eBPF program is monitoring or controlling
- Identifies malicious eBPF code that might be hiding in the kernel
- Helps understand how security tools use eBPF to watch system activity
When to use it:
- You need to understand what a kernel-level monitoring program does
- You suspect malicious code is running at the kernel level
- You want to analyze how a security tool or EDR system works
- You need to reverse engineer eBPF programs from running systems
- You are studying kernel-level hooks and system monitoring techniques
The full skill text could not be loaded right now. It installs fine with the command above, or read it at the source.
Mirrored from the author's public source. Install counts from the open skills registry.