ClawHub
Back to skill

Security audit

Linux Incident Remediator

Security checks across malware telemetry and agentic risk

Overview

This is a transparent Linux incident-response skill, but it includes powerful administrator commands and unpinned third-party tool downloads that users should verify before using.

Install this only if you want administrator-level Linux incident response guidance. Review every command before running it, avoid host-modifying steps when strict forensic preservation is required, back up firewall and service state first, and replace the raw GitHub download steps with pinned, checksum-verified, or internally vetted forensic tools.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo mkdir -p /opt/forensics
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/base64dump.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py
Confidence
91% confidence
Finding
The skill instructs downloading executable forensic scripts directly from GitHub into /opt with sudo, then making them executable, without pinning versions, verifying hashes/signatures, or using a package manager. In a root context, a compromised upstream repository, MITM, or replaced script could lead to execution of attacker-controlled code on the host.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/base64dump.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/re-search.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/zipdump.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/1768.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/pdf-parser.py
sudo wget -P /opt/forensics https://raw.githubusercontent.com/DidierStevens/DidierStevensSuite/master/oledump.py
sudo chmod +x /opt/forensics/*.py
Confidence
93% confidence
Finding
These sudo wget and chmod instructions create a supply-chain risk by retrieving multiple Python scripts from the internet and marking them executable in a privileged location. Even though the intent is forensic analysis, the combination of remote download, root privileges, and executable permission materially increases the risk of host compromise.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.