Unfragile

chkrootkit is a local rootkit checker for Unix-like systems: it scans for signs of rootkits, promiscuous interfaces, lastlog/wtmp deletions and LKM trojans 1. No other listed product does this task, so the answer is chkrootkit itself; none of the other products is a true alternative.

1
Chkrootkitchkrootkit.orgwebsite read, tools not yet checked
Locally checks a Unix-like system for signs of a rootkit, including promiscuous-mode interfaces, lastlog and wtmp deletions, and LKM trojans 1.
Website

Sources

1chkrootkit -- locally checks for signs of a rootkitchkrootkit.org · read 2026-10-29

For agents: the 10 actions behind this answer

· Chkrootkit website read, tools not yet checked
chkrootkit locally checks for signs of a rootkit. Includes ifpromisc.c to check if the interface is in promiscuous mode, chklastlog.c and chkwtmp.c to check for lastlog and wtmp deletions and chkproc.c for signs of LKM trojans.
github/ossar-action · ossar-action verified and signed
Run open source security static analysis tools without the added complexity with OSSAR (Open Source Static Analysis Runner)
search_software_toolkits · mcp-security found in code, not yet checked
Search software toolkits (or just tools) in the Google Threat Intelligence platform.
check_installation · automated-security-helper found in code, not yet checked
Check if ASH is properly installed and ready to use.
urlscanner-search-scans · Cloudflare API verified and signed
Search URL scans
skill-scanner · skill-scanner verified and signed
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret expo
· Vuls website read, tools not yet checked
Agentless Vulnerability Scanner for Linux/FreeBSD
· REMnux Documentation website read, tools not yet checked
REMnux Documentation
· Sleuthkit website read, tools not yet checked
Open source digital forensics tools for analyzing hard drives, smartphones, and disk images.
· voidtools website read, tools not yet checked

Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.