linux-kernel-crash-debug

• Outcome: Pass
• Latest audit: Oct 8, 2026 · 3:52 PM UTC
• Version: 1.4.5

Overview

This skill is a coherent Linux kernel crash-debugging guide with a bounded offline wrapper and clear warnings around privileged or destructive operations.

Install this only if you need Linux kernel crash or vmcore analysis. Treat vmcores as highly sensitive because they can contain credentials and process memory, and do not let an agent run sudo, enable services, load modules, change boot settings, or trigger crash tests unless you have approved the exact host, action, maintenance context, and rollback plan.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (50)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

clawhub install linux-kernel-crash-debug

方式二：手动安装

mkdir -p ~/.openclaw/workspace/skills/linux-kernel-crash-debug cp SKILL.md ~/.openclaw/workspace/skills/linux-kernel-crash-debug/

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL_CN.md (reported line 34)May include surrounding context.

clawhub install linux-kernel-crash-debug

方式二：手动安装

mkdir -p ~/.openclaw/workspace/skills/linux-kernel-crash-debug cp SKILL.md ~/.openclaw/workspace/skills/linux-kernel-crash-debug/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL_CN.md (reported line 116)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL_CN.md (reported line 117)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/arm64-crash-params.md (reported line 219)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 265)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 266)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 419)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 452)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 479)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 491)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 492)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 493)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/kdump-setup-guide.md (reported line 505)May include surrounding context.

软件安装会改变主机；仅在获得具体主机和软件包的明确授权后执行。优先使用已安装工具，离线转储分析使用非 root 账号。按发行版安装工具与匹配的 debuginfo：

bash

# RHEL / CentOS / Rocky / AlmaLinux
sudo dnf install crash gdb binutils makedumpfile kexec-tools
sudo dnf debuginfo-install kernel-$(uname -r)

# Debian / Ubuntu

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agentic-heuristics.md (reported line 36)May include surrounding context.

md

* **Deadlock Analysis**: `scripts/agent-crash.sh -k vmlinux -c vmcore flow-deadlock`
  Automatically extracts all UN (Uninterruptible) task backtraces filtering out idle CPU noise.
* **OOM Analysis**: `scripts/agent-crash.sh -k vmlinux -c vmcore flow-oom`
  Automatically runs complex sorts to deliver the explicitly top 15 memory-hogging processes and SLAB caches without overflowing the Agent's context.

## 4. The "Linus" Method: Reverse Engineering 
If line numbers from Backtraces are wrong due to compiler optimization (`-O2`):

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

# LAB ONLY: test_kasan intentionally exercises invalid accesses. Obtain
# explicit authorization for a disposable test kernel before loading it.
$ sudo modprobe test_kasan
$ sudo modprobe -r test_kasan  # cleanup when built as an unloadable module

# Test-kernel boot parameters: report repeatedly, or panic on invalid access

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

# LAB ONLY: test_kasan intentionally exercises invalid accesses. Obtain
# explicit authorization for a disposable test kernel before loading it.
$ sudo modprobe test_kasan
$ sudo modprobe -r test_kasan  # cleanup when built as an unloadable module

# Test-kernel boot parameters: report repeatedly, or panic on invalid access

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL_CN.md (reported line 120)May include surrounding context.

md

# LAB ONLY: test_kasan intentionally exercises invalid accesses. Obtain
# explicit authorization for a disposable test kernel before loading it.
$ sudo modprobe test_kasan
$ sudo modprobe -r test_kasan  # cleanup when built as an unloadable module

# Test-kernel boot parameters: report repeatedly, or panic on invalid access

Static analysis

No suspicious patterns detected.