Will it modify my website?

No. It only reads the folder you point it at. Reports are written outside that folder.

What does `[!]` mean?

A new or changed file with a script/executable extension (`.php`, `.js`, `.htaccess`, …). Review those first — `uploads/*.php` is a classic webshell location.

What if someone edits the baseline JSON on the server?

The manifest fingerprint printed at baseline time won't match. Pass it with `--expect` (store it in your password manager). Exit code 2 means don't trust that baseline.

Can I exclude cache folders?

Yes — `--exclude 'wp-content/cache/*'` (repeatable). `.git/`, `node_modules/` and `__pycache__/` are excluded by default.

Is this a certified FIM product?

No. It's a practical offline SHA-256 baseline/verify tool for humans and agents.

file integrity baseline and verifier

Example session with this skill installed

I deploy a small bakery website every Friday. Here's last Friday's document root and today's copy. Did anything change that I didn't deploy? Flag anything that looks like a webshell path.

Read your context and instructions
Compiled the file integrity baseline

Answer: yes — 6 changes, 3 of them on script/config files you should review first.

Result   : 6 CHANGE(S)
  added 1 | removed 1 | changed 2 | moved 1 | mode 1
  executable/script files added or changed: 3  <- review these first

-- ADDED
  [!] uploads/cache.php  67 bytes
-- CHANGED
  [!] .htaccess   (+ AddType application/x-httpd-php .jpg)
  [!] js/menu.js  (injected script tag)
-- REMOVED
      robots.txt
-- MOVED
      images/logo.svg -> assets/logo.svg
-- PERMISSIONS CHANGED
      wp-config.php  0o644 -> 0o666  (now world-writable)

Deliverables: terminal summary, optional integrity.md + integrity.json. Manifest fingerprint printed at baseline time for offline safekeeping.

Next steps: treat [!] rows as priority; keep copies as evidence; check access logs for requests to uploads/cache.php; restore from known-good backup; rotate CMS/hosting passwords. This tool proves change, not malware.

(Numbers from a real run on the bundled samples/site → samples/site-after scenario.)

Connects securely to your tools. The creator never sees your data.

About this skill

Know whether anyone changed files in a folder — without installing an agent.

file integrity baseline and verifier gives your AI agent a two-command FIM toolkit. Take a SHA-256 snapshot when a website, config tree or evidence folder is known-good. Later, verify it and get a plain-language report of what was added, removed, changed, moved or had its permissions flipped. New or modified scripts (.php, .js, .htaccess, .sh, …) are marked [!] so you look there first. A manifest fingerprint catches someone editing the baseline itself.

What it does

baseline a folder into a JSON manifest (SHA-256 per file, mode, mtime, symlink targets)
verify against that manifest with ADDED / REMOVED / CHANGED / MOVED / PERMISSIONS sections
Flag risky extensions first; call out world-writable modes
Detect a tampered manifest via --expect <fingerprint>
Bundled sample site with a simulated compromise so you can try it immediately

Who it's for

Site owners, WordPress/PHP hosts, MSPs, IR responders preserving evidence folders, and anyone who wants change detection without OSSEC/AIDE.

What's included

SKILL.md, scripts/fib.py, scripts/make_samples.py, references, examples.

Going further: paid skills from the same creator

server log threat hunter: hunt nginx/Apache and SSH logs for the attack that dropped the file.
small business security audit: broader security checkup.
phishing email analyzer: if the break-in started with email.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Free forever

No account required to browse

file integrity baseline and verifier