Skip to main content
affpapa.org
RU EN
skill CX Codex

littlesnitch-linux — Claude Code skill: eBPF network monitor

A skill covering the open-source part of Little Snitch for Linux: Rust eBPF programs that intercept network connections and block hosts from lists.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a claude-code
Open on GitHub

What littlesnitch-linux does

The skill walks through the open-source components of Little Snitch for Linux: eBPF programs, shared types and a demo loader. The programs attach to the kernel and intercept network connections, while data moves between kernel and user space through eBPF maps. The full product from Objective Development also ships a proprietary UI and rule engine, which the open part does not include.

Four pieces live in the repo: ebpf/ holds the kernel programs, common/ the shared types, demo-runner/ is the loader and event consumer, and webroot/ carries a JavaScript web UI. The loader is built on Aya, and blocklists come from blocked_hosts.txt and blocked_domains.txt in the working directory. Building goes through cargo build --release; build scripts handle the eBPF compilation on their own.

You need both stable and nightly Rust toolchains, with rust-src on the nightly one, plus bpf-linker and clang. The kernel has to be Linux 5.15+ with BTF and CO-RE support, and loading the programs takes root or CAP_BPF. Skip the nightly toolchain with rust-src and the eBPF build fails, so check that before the first run.

What it helps with

  • build eBPF programs that intercept network connections
  • block a list of IPs and domains at the kernel level
  • understand how the ebpf, common and demo-runner crates fit together
  • run the demo loader for the eBPF programs
  • add a shared type for kernel-to-user-space data exchange

Example prompts for the agent

  • Walk me through the common crate and which types both kernel and user space share
  • Explain how demo-runner loads the eBPF programs and fills the BLOCKED_HOSTS map
  • What do I need installed to build the eBPF part of this Rust project?

How to install littlesnitch-linux

1Skills CLI (Vercel)

npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a claude-code

2Manually: put the files in place

~/.claude/skills/littlesnitch-linux/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/littlesnitch-linux/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about littlesnitch-linux

How do I install littlesnitch-linux in Claude Code?

Run npx skills add reason-machines/trending-skills --skill littlesnitch-linux -a claude-code, and the skill lands in ~/.claude/skills/littlesnitch-linux/SKILL.md.

What does littlesnitch-linux do?

It covers the open-source part of Little Snitch for Linux: Rust eBPF programs, shared types and a demo loader that intercepts network connections and blocks hosts from lists.

What is required to build and run it?

A nightly Rust toolchain with rust-src, bpf-linker, clang, and a Linux 5.15+ kernel with BTF and CO-RE support. Loading the programs needs root or CAP_BPF.

Similar skills

All skills for Security →
git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set139

bluehammer-vulnerability-poc A skill that walks the agent through the BlueHammer repo: building the C exploit, running it, and reading the vulnerability code. For isolated labs only. CX Codex +1 570installs alayarenderer-generative-world An agent skill that walks you through AlayaRenderer: splitting RGB video into G-buffers and restyling footage from a text prompt. CX Codex +1 564installs keychron-keyboards-hardware-design Lets your agent work with Keychron's open CAD files — STEP, DXF, DWG and PDF for keyboards and mice. Useful for 3D printing or laser cutting. CX Codex +1 550installs 3dsvg-interactive-react Turns SVGs and text into interactive 3D React components with the 3dsvg library. Useful for a dimensional logo or hero badge. CX Codex +1 529installs pyre-code-ml-practice This skill walks you through hosting Pyre Code, a practice platform with 68 ML problems, and through writing your own. Handy when you want hands-on work on transformer and diffusion internals without a GPU. CX Codex +1 517installs maoxuan-skill-cognitive-framework A skill that hands your agent a set of thinking models drawn from Mao Zedong's writings: find the principal contradiction, plan from the weaker side, gather allies. CX Codex +1 513installs codex-oauth-automation-extension Installs a Chrome extension that walks the whole OpenAI OAuth signup and login: pulls the email code, confirms the callback, repeats for several rounds. CX Codex +1 505installs rattles-terminal-spinners A Claude skill covering rattles, a minimal Rust library for terminal spinners. Useful when a CLI needs a loading indicator without extra dependencies. CX Codex +1 497installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor