Am I compromised? After supply-chain news — a poisoned npm/PyPI package, a malicious VS Code extension, a backdoored dep that ran as you — this runs a guided IOC triage of a Windows + WSL2 dev box, then trims the attack surface the next compromise would use. WSL side: known-bad package versions, ld.so.preload, persistence (systemd/cron/autostart), planted SSH keys, shell-rc injection, executable .pth. Windows side: full AV scan (a third-party AV makes Defender passive — one scan, not two), second-opinion scan, Sysinternals Autoruns with VirusTotal, code --list-extensions, scheduled tasks, BYOVD-class drivers. Carries the discriminators that stop false alarms: filename IOCs via find not grep, VT named-family verdicts over aggregate labels, web-filter blocks vs infections. Fires on "am I hacked", "did I get owned", a named bad package or CVE in your dependency chain, or an AV detection you're unsure how to read. Windows/WSL-specific; verifies — does not harden. A clean result raises confidence, never proves.
Install with
Claude CodeCodexCursorGitHub CopilotGemini CLI
Supported by the Atlas install prompt. Skill-specific requirements vary.
Skill stats
Skills1CategorySecurityStars0
About this skill
Am I compromised? After supply-chain news — a poisoned npm/PyPI package, a malicious VS Code extension, a backdoored dep that ran as you — this runs a guided IOC triage of a Windows + WSL2 dev box, then trims the attack surface the next compromise would use. WSL side: known-bad package versions, ld.so.preload, persistence (systemd/cron/autostart), planted SSH keys, shell-rc injection, executable .pth. Windows side: full AV scan (a third-party AV makes Defender passive — one scan, not two), second-opinion scan, Sysinternals Autoruns with VirusTotal, code --list-extensions, scheduled tasks, BYOVD-class drivers. Carries the discriminators that stop false alarms: filename IOCs via find not grep, VT named-family verdicts over aggregate labels, web-filter blocks vs infections. Fires on "am I hacked", "did I get owned", a named bad package or CVE in your dependency chain, or an AV detection you're unsure how to read. Windows/WSL-specific; verifies — does not harden. A clean result raises confidence, never proves.
Quick start
Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.
Am I compromised? After supply-chain news — a poisoned npm/PyPI package, a malicious VS Code extension, a backdoored dep that ran as you — this runs a guided IOC triage of a Windows + WSL2 dev box, then trims the attack surface the next compromise would use. WSL side: known-bad package versions, ld.so.preload, persistence (systemd/cron/autostart), planted SSH keys, shell-rc injection, executable .pth. Windows side: full AV scan (a third-party AV makes Defender passive — one scan, not two), second-opinion scan, Sysinternals Autoruns with VirusTotal, code --list-extensions, scheduled tasks, BYOVD-class drivers. Carries the discriminators that stop false alarms: filename IOCs via find not grep, VT named-family verdicts over aggregate labels, web-filter blocks vs infections. Fires on "am I hacked", "did I get owned", a named bad package or CVE in your dependency chain, or an AV detection you're unsure how to read. Windows/WSL-specific; verifies — does not harden. A clean result raises confidence, never proves.
About this listing
Category
Security
Reported license
MIT
Listing language (estimated)
English
Review status
Not individually reviewed
Agent compatibility
Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.
Claude Code
Codex
Cursor
GitHub Copilot
Gemini CLI