persistence-audit

Name: persistence-audit
Availability: InStock
Author: Conduction

Identify post-compromise persistence vectors across authentication flows and automation configurations.

1|1|Updated Apr 8, 2026

Search Tags:#security #oauth #audit #persistence #ci-cd #incident-response

Ready to run

npx skills add https://github.com/ConductionNL/shillinq --skill persistence-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: persistence-audit
Source: https://github.com/ConductionNL/shillinq/tree/main/.claude/skills/persistence-audit
Command: npx skills add https://github.com/ConductionNL/shillinq --skill persistence-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the critical security gap where attackers maintain access to a system even after standard credential rotation, by identifying hidden persistence vectors like OAuth grants, service accounts, and CI/CD secrets.

Core Features & Use Cases

Comprehensive Vector Analysis: Scans for persistence across six categories: OAuth/Tokens, Service Accounts, CI/CD, IdP, Audit Trails, and Endpoint/Workload configurations.
Context-Aware Auditing: Supports specialized modes for PR diffs, architecture specs, and post-incident response to ensure thorough coverage.
Use Case: After a suspected breach, use this Skill to verify that rotating credentials actually removed all trust paths, ensuring an attacker cannot re-enter the system via forgotten service accounts or stale OAuth grants.

Quick Start

Run the persistence-audit skill on the current repository to identify any remaining security gaps.

Frequently Asked Questions about persistence-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect hidden persistence vectors after a security breach?▼

Detecting hidden persistence vectors involves systematically scanning authentication flows, machine identities, and CI/CD configurations to uncover unauthorized access paths. This process evaluates six categories: OAuth tokens, service accounts, CI/CD pipelines, IdP, audit trails, and endpoint workloads to ensure complete security eradication.

Why does rotating credentials fail to remove attacker access completely?▼

Rotating credentials fails to remove attacker access when hidden persistence vectors like stale OAuth grants or forgotten service accounts remain active. Attackers exploit these unauthorized trust paths to re-enter a system, bypassing standard credential rotation and maintaining silent post-compromise persistence.

How do I audit OAuth grants and service accounts for unauthorized access?▼

Auditing OAuth grants and service accounts requires context-aware scanning of authentication flows and machine identities across a codebase or architecture. This systematic evaluation identifies unauthorized access paths within identity provider configurations and ensures stale trust relationships are eradicated.

Can I use persistence auditing on PR diffs and architecture specs?▼

Yes, persistence auditing supports specialized context-aware modes for PR diffs and architecture specs. This ensures thorough security coverage during code reviews by evaluating authentication flows and automation configurations directly within the proposed changes before deployment.

What is the best way to harden CI/CD pipelines against post-compromise persistence?▼

Hardening CI/CD pipelines against post-compromise persistence requires scanning automation configurations and CI/CD secrets to detect unauthorized access paths. This systematic approach evaluates pipeline trust relationships and ensures complete security eradication of hidden machine identities during incident response.

When do I need a systematic persistence audit during incident response?▼

You need a systematic persistence audit during incident response immediately after a suspected breach and credential rotation. It verifies that all trust paths are removed, ensuring an attacker cannot re-enter via forgotten service accounts, stale OAuth grants, or modified audit trails.