{"slug":"detecting-rootkit-activity","source_name":"detecting-rootkit-activity","name":"Detecting Rootkit Activity","description":"Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.","version":1,"lift":{"pass_rate_delta_pts":22.73,"pass_rate_pct":31.8,"total_cases":22,"passed_cases":7,"tokens_delta_pct":105,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T02:28:16.351943+00:00"},"skill_score":0.3182,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":22.73,"with_pass_pct":31.8,"without_pass_pct":9.1,"tokens_delta_pct":105,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":21,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T02:28:16.351943+00:00","run_id":"a6a39590-c657-46c0-8f30-a2ff76be417f","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"6a9598def50ed7c9c927070cc2cbff9d2bf43a841c675a4bab0cdeb6f20c0c8c","raw_url":"https://app.decimal.ai/s/detecting-rootkit-activity/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/detecting-rootkit-activity"}