Security audit

Linux Incident Remediator

Security checks for vulnerabilities and agentic risk

Overview

This Linux incident-response skill is mostly coherent, but it includes privileged installation of unverified remote Python tools from mutable GitHub URLs, which users should review before installing.

Install only if you are comfortable with a privileged Linux incident-response playbook. Before following the Didier Stevens Suite setup, pin exact commits, verify checksums or signatures, download as an unprivileged user, and prefer a trusted internal forensic toolkit or disposable analysis VM.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:233
Finding: Unverified Remote Python Scripts Retrieved from a Mutable Branch and Executed Locally
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (20)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 70% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
ning Services

bash
ss -tulpn

Active Connections

bash
ss -antp | grep ESTABLISHED

Firewall State

iptables

bash
iptables -L -n -v --line-numbers iptables -S

nftables

bash
nft list ruleset

Local Service Enumeration (Low Noise)

bash
ss -lntup

Avoid unnecessary full scans of localhost unless required.

Conservative Network Scan

bash
nmap -sV -T3 -p- localhost

Packet Capture (Short Snapshot)

bash
tcpdump -i any -nn -c 100

2. Process & Runtime Analysis

Process Tree

bash
ps auxww --forest

High CPU / Memory

bash
top

Open File Handles

bash
lsof -p <PID>

System Call Trace (Caution: Alters Timing)

bash
strace -p <PID>

⚠️ strace may change process behavior. Use carefully during live compromise.

Kernel Modules

bash
lsmod

Kernel Messages

bash
dmesg | tail -50

3. Rootkit & Malware Scanning

Rootkit Scanners

bash

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 498)May include surrounding context.
md
To prevent catastrophic system damage: - NEVER use: - `rm -rf *` - `rm -rf /` - `killall` - Broad `pkill` patterns

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 499)May include surrounding context.
md
- NEVER use: - `rm -rf *` - `rm -rf /` - `killall` - Broad `pkill` patterns - Unbounded globbing in sensitive directories

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 499)May include surrounding context.
md
- NEVER use: - `rm -rf *` - `rm -rf /` - `killall` - Broad `pkill` patterns - Unbounded globbing in sensitive directories

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 549)May include surrounding context.
SSH Backdoors

bash
cat ~/.ssh/authorized_keys

After removal of malicious artifacts:

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
md
## Execution Assumptions - Shell: `bash` or POSIX `sh` - Privilege: Root or sudo - Host-level access (NOT container-restricted environments) - systemd-based systems preferred

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill instructs users to download executable forensic scripts directly from GitHub into a privileged system path using sudo, without pinning versions, verifying signatures, or checking hashes. If the upstream repository, network path, or referenced content is tampered with, an operator could place attacker-controlled code on a trusted host during incident response.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
Install:

bash
sudo mkdir -p /opt/forensics sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/base64dump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: This line continues the same unsafe pattern of using sudo with wget to fetch unverified executable tooling from the internet. In an incident-response context, this is especially risky because compromised hosts and urgent workflows increase the chance of trust bypass and execution of tampered tools.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
bash
sudo mkdir -p /opt/forensics sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/base64dump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Downloading another script as root from a mutable raw GitHub URL creates software supply-chain risk. The danger is amplified because these tools are later marked executable and may be relied upon for forensic decisions on sensitive systems.
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
bash
sudo mkdir -p /opt/forensics sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/base64dump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: This is the same vulnerable pattern: privileged retrieval of remote code without authenticity validation. A hostile or hijacked upstream could cause unauthorized code placement on the responder's target host.
Content: Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.
md
sudo mkdir -p /opt/forensics sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/base64dump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Fetching executable analysis tooling with sudo from the internet during live response can undermine forensic integrity and introduce compromise. This is not inherently malicious, but it is an unsafe operational practice with real exploitation potential.
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/base64dump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py sudo chmod +x /opt/forensics/*.py

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 92% confidence
Finding: Applying chmod +x to all downloaded Python scripts in a privileged directory broadens the risk from unverified download to easy execution. If any fetched file is malicious or replaced, the skill normalizes making it directly runnable on the host.
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py sudo chmod +x /opt/forensics/*.py

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This finding is part of the same root-executed remote-download sequence and inherits its supply-chain risk. The context makes it more dangerous because the skill is designed for privileged remediation on potentially compromised Linux hosts.
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py sudo chmod +x /opt/forensics/*.py

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The final line in the sequence still contributes to an unsafe privileged installation workflow for third-party scripts from mutable URLs. In aggregate, this creates a realistic path to code introduction on sensitive systems.
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py sudo chmod +x /opt/forensics/*.py

text
### Decode Base64

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.
journalctl -u sshd.service | grep "Failed password"

text
### Sudo Activity ```bash journalctl _COMM=sudo

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.
Sudo Activity

bash
journalctl _COMM=sudo

Audit Logs

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
Cron Jobs

bash
crontab -l ls -lah /etc/cron*

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 525)May include surrounding context.
Cron Jobs

bash
crontab -l ls -lah /etc/cron*

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.
bash
sha256sum file mkdir -p /root/quarantine mv file /root/quarantine/file.vir

Persistent Context Injection

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
Content: Scanner excerpt · SKILL.md (reported line 595)May include surrounding context.
md
--- ### B. Immediate vs Persistent Rules Firewall rule changes are runtime by default and may not survive reboot.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

SkillSpector

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

Active Connections

Firewall State

iptables

nftables

Local Service Enumeration (Low Noise)

Conservative Network Scan

Packet Capture (Short Snapshot)

2. Process & Runtime Analysis

Process Tree

High CPU / Memory

Open File Handles

System Call Trace (Caution: Alters Timing)

Kernel Modules

Kernel Messages

3. Rootkit & Malware Scanning

Rootkit Scanners

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

SSH Backdoors

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo Activity

Audit Logs

Session Persistence

Cron Jobs

Session Persistence

Cron Jobs

Session Persistence

Persistent Context Injection

Static analysis