Windows Wsl Security Verification

Am I compromised? After supply-chain news — a poisoned npm/PyPI package, a malicious VS Code extension, a backdoored dep that ran as you — this runs a guided IOC triage of a Windows + WSL2 dev box, then trims the attack surface the next compromise would use. WSL side: known-bad package versions, ld.so.preload, persistence (systemd/cron/autostart), planted SSH keys, shell-rc injection, executable .pth. Windows side: full AV scan (a third-party AV makes Defender passive — one scan, not two), second-opinion scan, Sysinternals Autoruns with VirusTotal, code --list-extensions, scheduled tasks, BYOVD-class drivers. Carries the discriminators that stop false alarms: filename IOCs via find not grep, VT named-family verdicts over aggregate labels, web-filter blocks vs infections. Fires on "am I hacked", "did I get owned", a named bad package or CVE in your dependency chain, or an AV detection you're unsure how to read. Windows/WSL-specific; verifies — does not harden. A clean result raises confidence, never proves.

mkdir -p ~/.claude/skills/windows-wsl-security-verification
curl -L https://claudskills.com/skills/windows-wsl-security-verification/SKILL.md \
  -o ~/.claude/skills/windows-wsl-security-verification/SKILL.md

@misc{windows-wsl-security-verification-2026,
  author    = {bogheorghiu},
  title     = {Windows Wsl Security Verification [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/windows-wsl-security-verification/}
}