/op-trace

description: Scan for traces left behind on a system and eliminate them
allowed-tools: ToolSearch, Bash, Read, Write, Glob, Grep, Task, AskUserQuestion
argument-hint: <target-host> [--scan-only | --eliminate]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to /tmp/ or any system temporary directory.

Trace Scanning and Elimination

Target and options: `$ARGUMENTS`

1. Parse `$ARGUMENTS` for target host and mode flag (`--scan-only` or `--eliminate`). Default to `--scan-only` if neither flag is specified.

2. **Phase 1 — Scan**: Check for forensic artifacts across all categories:

• **Login records**: Examine `wtmp`, `btmp`, `lastlog`, `/var/log/auth.log` for entries matching the operator's activity window. Flag any login entries, failed attempts, or sudo usage.

• **Command history**: Search for shell history files:
• `~/.bash_history`
• `~/.zsh_history`
• `~/.python_history`
• `~/.mysql_history`
• `~/.psql_history`

Flag any files with recent entries or non-zero size.

• **Temp files**: Scan `/tmp/*`, `/dev/shm/*`, `/var/tmp/*` for files created during the operational window. Flag any files owned by the operator or with suspicious names.

• **Cron entries**: Check `crontab -l` for current user and root. Scan `/etc/cron.*` directories and `/var/spool/cron/` for persistence mechanisms.

• **SSH artifacts**: Inspect:
• `~/.ssh/authorized_keys` for added keys
• `~/.ssh/known_hosts` for target entries
• Recent SSH connection logs in auth.log
• SSH agent socket files

• **Recent files accessed**: Check `~/.local/share/recently-used.xbel` and similar desktop tracking files for recently opened files.

• **Connection logs**: Search for network connection records in logs — `ss` output snapshots, `netstat` entries, firewall logs, and `/var/log/messages` for connection-related entries.

3. **Phase 2 — Report**: Present all findings categorized by risk level:

• **CRITICAL**: Active persistence mechanisms (cron jobs, authorized_keys, running processes)
• **HIGH**: Login records, command history with operational commands
• **MEDIUM**: Temp files, SSH known_hosts entries, connection logs
• **LOW**: Recently-used file trackers, cached data

4. **Phase 3 — Eliminate** (only if `--eliminate` flag is set):

• For each trace found, present the artifact to the user and ask for confirmation before removal via `AskUserQuestion`
• Remove artifacts in order from CRITICAL to LOW severity
• For login records: use `utmpdump`/`utmpset` or direct binary editing to remove specific entries
• For history files: truncate or selectively remove lines
• For temp files: secure-delete with `shred` then `rm`
• For cron entries: remove specific lines from crontab
• For SSH artifacts: remove specific lines from authorized_keys and known_hosts
• Verify each removal was successful

5. Log all findings to the ops tracker:

   node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add <target> trace-scan <category> "<artifact>" <risk-level> <status>

6. Write the trace report to the project directory. Include all scanned categories, findings with risk levels, and elimination status if `--eliminate` was used.