AuditCore — Network Security Audit Suite

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:58 AM UTC
• Version: 1.0.0

Overview

This looks like a real network-audit toolkit, but it is labeled read-only while documenting persistent writes, executable remediation scripts, broad external workflow routing, and high-impact offensive tooling.

Install only if you intend to run an authorized, write-capable and exec-authorized security-audit toolkit. Treat the read-only label as inaccurate: review or disable tools-secops, community-cybersec-index, auto-generation, persistent memory, and remediation script generation before use, and keep it out of production unless targets, commands, storage paths, retention, and approvals are tightly controlled.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources

Findings (6)

T01 · Skill Instruction Hijacking

Warning

• Location: system-methodology/SKILL.md:18
• Finding: Universal Skill Authority Claim Can Override Conflicting Safety Instructions## Vulnerability Details **File Location**: `system-methodology/SKILL.md`, lines 18-20 **Vulnerability Type**: Instruction-priority manipulation **Risk Level**: Medium **Code Snippet**: ```markdown Eres un agente auditor de ciberseguridad de infraestructura. TODAS tus auditorías siguen esta metodología sin excepción. Este documento es tu constitución — prevalece sobre cualquier otro skill. ``` ### Technical Analysis The Skill declares that its instructions apply without exception and take precedence over every other Skill. This creates an instruction-hierarchy conflict rather than limiting precedence to the AuditCore package's internal workflow. A loaded Skill must not claim universal authority over unrelated Skills or external safety controls. Although the document does not explicitly claim precedence over system or developer instructions, the unrestricted wording can cause the Agent to displace stricter controls supplied by another Skill. ### Attack Path 1. The methodology Skill is loaded as a permanent Layer 0 component. 2. Its universal precedence claim enters the Agent's active context. 3. Another Skill supplies a stricter safety restriction or a conflicting execution workflow. 4. The Agent interprets the methodology as authoritative and disregards the conflicting restriction. 5. Audit operations proceed under weakened or unintended controls. ### Impact Assessment This issue can alter the Agent's current-session decision hierarchy. It does not directly grant operating-system privileges, but it can weaken safeguards governing command execution, data handling, and approval requirements. The scope includes every audit session in which this always-loaded Skill is active.
• Remediation: ## Remediation Suggestions - Remove phrases asserting universal or constitutional precedence. - Scope precedence only to non-security AuditCore workflow conventions. - Explicitly state that system, developer, user, platform, authorization, and safety policies take precedence. - Add conflict handling that chooses the most restrictive safety requirement. - Use wording such as: “Apply this methodology only when it does not conflict with higher-priority instructions or stricter safety controls.”

T04 · Embedded Malicious Code

Error

• Location: tools-secops/SKILL.md:114
• Finding: Embedded Reverse-Shell Listener Command Enables Remote Shell Access## Vulnerability Details **File Location**: `tools-secops/SKILL.md`, lines 114-120 **Vulnerability Type**: Embedded remote shell command **Risk Level**: Critical **Code Snippet**: ```markdown ## 🏠 POST-EXPLOTACIÓN / PIVOTING (requiere autorización) | Herramienta | Binario | Uso básico | |-------------|---------|------------| | **impacket** | pip (secretsdump, smbclient, etc.) | `python3 ~/.local/bin/impacket-secretsdump <domain>/<user>@<ip>` | | **bloodhound-python** | `~/.local/bin/bloodhound-python` | `bloodhound-python -d <domain> -u <user> -p <pass> -c all` | | **chisel** | `~/tools/bin/chisel` | `chisel server -p 8080 --reverse` | | **ligolo-ng** | `~/tools/bin/ligolo-ng` | `./ligolo-ng --selfcert` | | **socat** | `/usr/bin/socat` | `socat TCP-LISTEN:4444 EXEC:/bin/bash` | ``` ### Technical Analysis The `socat` example binds TCP port 4444 and passes each accepted connection to `/bin/bash`. If invoked, it creates an unauthenticated network-accessible command shell under the privileges of the Agent process. This behavior is not necessary for read-only network compliance auditing. The surrounding reverse-tunneling and pivoting tools further demonstrate that this section is intended to establish command and traffic channels rather than collect passive audit evidence. The text requires authorization, but no technical mechanism validates the target, restricts the listening interface, authenticates clients, limits commands, or prevents accidental production execution. ### Attack Path 1. The `tools-secops` Skill is loaded for a local or community workflow. 2. A prompt, external Skill, or operator request causes the documented `socat` command to be selected. 3. The Agent executes `socat TCP-LISTEN:4444 EXEC:/bin/bash`. 4. The host begins listening on TCP port 4444. 5. A network client connects to the port. 6. The connecting client gains shell command execution with the Agent process's operating-system privil ...[truncated 388 chars]
• Remediation: ## Remediation Suggestions - Remove the `socat TCP-LISTEN:4444 EXEC:/bin/bash` example. - Remove reverse-tunneling and pivoting instructions from the network-audit Skill. - Maintain a strict allowlist of read-only audit commands. - Place legitimate offensive testing in a separate, disabled-by-default package. - Require cryptographically recorded authorization, explicit target allowlists, expiration times, and per-command approval for offensive operations. - Run approved testing tools inside an isolated container with no host credentials and restricted egress. - Add automated policy checks that reject commands containing shell listeners, `EXEC:/bin/sh`, `EXEC:/bin/bash`, reverse tunnels, or equivalent constructs.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: tools-secops/SKILL.md:90
• Finding: Credential Extraction and Pivoting Tooling Exceeds Audit Least Privilege## Vulnerability Details **File Location**: `tools-secops/SKILL.md`, lines 90-120 **Vulnerability Type**: Excessive offensive access capability **Risk Level**: High **Code Snippet**: ```markdown ## 🔑 ATAQUES A CREDENCIALES (requiere autorización del operador) | Herramienta | Binario | Uso básico | |-------------|---------|------------| | **hydra** | `/usr/bin/hydra` | `hydra -l admin -P pass.txt <ip> ssh` | | **medusa** | `/usr/bin/medusa` | `medusa -h <ip> -u admin -P pass.txt -M ssh` | | **hashcat** | `/usr/bin/hashcat` | `hashcat -m 1000 hashes.txt wordlist.txt` | | **john** | `/usr/sbin/john` | `john --wordlist=rockyou.txt hashes.txt` | | **kerbrute** | `~/go/bin/kerbrute` | `kerbrute userenum -d <domain> users.txt` | | **crackmapexec** | `~/tools/CrackMapExec/` | `python3 cme smb <ip> -u user -p pass` | ## 🏠 POST-EXPLOTACIÓN / PIVOTING (requiere autorización) | **impacket** | pip (secretsdump, smbclient, etc.) | `python3 ~/.local/bin/impacket-secretsdump <domain>/<user>@<ip>` | | **bloodhound-python** | `~/.local/bin/bloodhound-python` | `bloodhound-python -d <domain> -u <user> -p <pass> -c all` | | **chisel** | `~/tools/bin/chisel` | `chisel server -p 8080 --reverse` | | **ligolo-ng** | `~/tools/bin/ligolo-ng` | `./ligolo-ng --selfcert` | ``` ### Technical Analysis The Skill provides instructions for password guessing, username enumeration, hash cracking, credential dumping, Active Directory collection, and network pivoting. These capabilities substantially exceed the permissions necessary for the package's declared network security audit and compliance-reporting functions. A natural-language authorization requirement is not a least-privilege control. The Skill does not enforce target ownership, permitted protocols, rate limits, credential boundaries, time windows, or separation between production and test environments. ### Attack Path 1. The tooling Skill is loaded through the community-Skill wo ...[truncated 852 chars]
• Remediation: ## Remediation Suggestions - Remove credential attacks, dumping, and pivoting from the standard AuditCore package. - Split offensive testing into a separately reviewed Skill that is not loaded by normal audit routing. - Enforce machine-readable target allowlists and deny private or production ranges unless separately approved. - Require per-command approval rather than one broad operator confirmation. - Apply protocol-specific rate limits and account-lockout protections. - Prevent plaintext credentials from appearing in command lines or stored evidence. - Execute authorized offensive tools in isolated, ephemeral environments with minimal network reachability. - Log approvals, exact commands, target scope, timestamps, and resulting artifacts.

T02 · Agent Memory Poisoning

Error

• Location: memory-ops/SKILL.md:45
• Finding: Operator Instructions and Client Findings Are Written to Persistent Cross-Session Memory## Vulnerability Details **File Locations**: `memory-ops/SKILL.md`, lines 45-68; `system-methodology/SKILL.md`, lines 73-74 **Vulnerability Type**: Persistent memory poisoning and sensitive-state retention **Risk Level**: High **Code Snippet**: ```markdown ## Patrones de Escritura a Memoria ### Cuando escribir a memory/YYYY-MM-DD.md (diario) - Al final de cada sesion de auditoria - Cuando se descubren hallazgos criticos - Cuando se completa un reporte - Cuando el operador da instrucciones importantes - Cuando se comete un error (para no repetirlo) ### Cuando actualizar MEMORY.md (largo plazo) - Nuevo assessment completado -> agregar a Assessment History - Nueva decision de arquitectura - Cambio de postura de cumplimiento de un cliente - Aprendizaje que aplica a sesiones futuras ### Patron de entrada en MEMORY.md ``` ## [Evento] — YYYY-MM-DD **[Tipo]:** Cliente | Vendor | Fecha | Resultado **Hallazgos clave:** lista breve **Acciones pendientes:** con SLA **Reportes generados:** rutas de archivos ``` ``` Additional mandatory update: ```markdown ### Fase 7 — CERRAR - Actualizar MEMORY.md con delta de postura (score anterior vs nuevo) ``` ### Technical Analysis The Skill explicitly persists operator instructions, audit findings, client posture, architecture decisions, and lessons across sessions. It simultaneously declares `safety: read-only`, which does not accurately represent this write behavior. Operator instructions and collected evidence may contain untrusted content. Persisting such content without schema validation or a rule/content separation boundary can cause later sessions to retrieve and trust attacker-controlled instructions. The storage design also lacks explicit tenant isolation, retention limits, and approval requirements for sensitive client information. ### Attack Path 1. An attacker-controlled device response, audit artifact, or operator-provided instruction enters ...[truncated 875 chars]
• Remediation: ## Remediation Suggestions - Change the Skill's safety metadata to reflect persistent writes. - Require explicit user approval before every cross-session memory update. - Never persist free-form instructions from operators, devices, logs, reports, or external Skills. - Store data in a strict schema that separates inert evidence from executable Agent instructions. - Sanitize secrets, tokens, passwords, community strings, personal data, and prompt-like content. - Isolate memory by client, engagement, and user identity. - Define expiration and deletion policies for findings and audit history. - Encrypt persistent memory and restrict file and database permissions. - Mark retrieved memory as untrusted data and prohibit it from changing instruction priority.

T08 · Insecure Dependencies

Error

• Location: community-cybersec-index/SKILL.md:14
• Finding: Mutable External Community Skills Can Introduce Unreviewed Workflows## Vulnerability Details **File Location**: `community-cybersec-index/SKILL.md`, lines 14-20 **Vulnerability Type**: Unpinned third-party Skill dependency **Risk Level**: High **Code Snippet**: ```markdown source: https://github.com/hliosone/anthropic-cybersecurity-skills --- # COMMUNITY CYBERSEC INDEX — Layer 0 **Para cargar una skill:** Leer `skills/community-cybersec/skills/{skill-id}/SKILL.md` y ejecutar su workflow. ``` ### Technical Analysis The index references a mutable GitHub repository and directs the Agent to execute workflows from selected external Skill documents. No commit hash, release version, checksum, signature, trusted manifest, or mandatory review gate is specified. The external library is noted elsewhere as requiring separate installation, so the local index does not itself download or execute a remote payload. The risk arises when the separately installed dependency is obtained or updated from the unpinned source and its workflows are subsequently trusted. ### Attack Path 1. An operator installs or updates the separately distributed community Skill library from the referenced repository. 2. The upstream repository, account, release process, or dependency is compromised or changes after this package's review. 3. A user requests an operation routed through the community index. 4. The Agent reads the affected external `SKILL.md`. 5. The Agent executes its workflow as instructed by the local index. 6. Malicious commands or Agent instructions run with the permissions available to the Agent. ### Impact Assessment Impact depends on the external workflow and can include arbitrary local command execution, network access, credential theft, evidence disclosure, persistent memory modification, or destructive operations. The potential scope includes the Agent host and every target reachable through installed security tools.
• Remediation: ## Remediation Suggestions - Pin the community repository to a reviewed commit hash or signed release. - Vendor approved Skill files into a controlled, immutable dependency directory. - Publish and verify a checksum manifest before loading any external Skill. - Require signature verification and fail closed on verification errors. - Perform static policy scanning and human review for each dependency update. - Do not automatically execute an external workflow merely because it appears in the index. - Apply a restrictive sandbox, command allowlist, network policy, and per-action approval to community Skills. - Record the exact dependency version used in every assessment.

T08 · Insecure Dependencies

Warning

• Location: memory-ops/SKILL.md:76
• Finding: Unpinned Python Package Installation Creates Supply-Chain Exposure## Vulnerability Details **File Location**: `memory-ops/SKILL.md`, lines 76-80 **Vulnerability Type**: Unpinned package installation **Risk Level**: Medium **Code Snippet**: ```markdown Si se necesita busqueda semantica real sobre documentacion tecnica en el futuro: 1. Instalar: `pip3 install sentence-transformers chromadb` 2. El script `/tmp/gen_index.py` puede extenderse para crear embeddings 3. Crear skill `semantic-search` que use chromadb como backend 4. Esto reemplazaria correctamente lo que Gemma4 prometio en abril 2026 ``` ### Technical Analysis The installation command resolves current package versions from the configured Python package index without version constraints, integrity hashes, a lock file, or an isolated environment. Package contents can therefore change after the Skill is reviewed. Python package installation may execute build-backend or setup logic. A compromised release, dependency, package index, or local index configuration could consequently execute code during installation. The use of `/tmp/gen_index.py` introduces an additional trust concern because the document assumes a temporary script path without establishing its ownership or integrity, although the history does not show that the Skill executes this script directly. ### Attack Path 1. An operator follows the installation instruction. 2. `pip3` resolves unpinned current versions and transitive dependencies. 3. A compromised or substituted artifact is downloaded from the configured index. 4. Installation or build hooks execute attacker-controlled code. 5. The malicious package runs with the installing user's permissions and can affect subsequent semantic-search operations. ### Impact Assessment Potential impact includes arbitrary code execution as the installing user, access to local memory databases and audit evidence, modification of the Python environment, and persistence through installed package code. System-wide impact i ...[truncated 125 chars]
• Remediation: ## Remediation Suggestions - Pin all direct and transitive dependency versions in a reviewed lock file. - Require cryptographic hashes with `--require-hashes`. - Install into an isolated virtual environment or locked container. - Use a controlled internal package mirror with provenance verification. - Disable source builds unless explicitly reviewed. - Scan packages and their transitive dependencies before approval. - Replace the mutable `/tmp/gen_index.py` location with a package-controlled path and verify its hash before use. - Document an upgrade process that requires review and testing before changing dependency versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (85)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match

Content

the Volatility framework to identify malicious processes,   injected code, network  |
| `analyzing-memory-forensics-with-lime-and-volatility` | Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility   3 framework. Extracts pro |
| `analyzing-mft-for-deleted-file-recovery` |  |
| `analyzing-outlook-pst-for-email-forensics` |  |
| `analyzing-powershell-empire-artifacts` |  |
| `analyzing-prefetch-files-for-execution-history` |  |
| `analyzing-ransomware-payment-wallets` | Traces ransomware cryptocurrency payment flows using blockchain analysis tools such as Chainalysis Reactor,   WalletExplorer, and blockchain |
| `analyzing-slack-space-and-file-system-artifacts` |  |
| `analyzing-supply-chain-malware-artifacts` |  |
| `analyzing-usb-device-connection-history` |  |
| `analyzing-windows-amcache-artifacts` | Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application   installation

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]

Critical

• Category: YARA Match

Content

secretsdump, smbclient, etc.) | `python3 ~/.local/bin/impacket-secretsdump <domain>/<user>@<ip>` |
| **bloodhound-python** | `~/.local/bin/bloodhound-python` | `bloodhound-python -d <domain> -u <user> -p <pass> -c all` |
| **chisel** | `~/tools/bin/chisel` | `chisel server -p 8080 --reverse` |
| **ligolo-ng** | `~/tools/bin/ligolo-ng` | `./ligolo-ng --selfcert` |
| **socat** | `/usr/bin/socat` | `socat TCP-LISTEN:4444 EXEC:/bin/bash` |

---

## ☁️ CLOUD / INFRAESTRUCTURA

| Herramienta | Binario | Uso básico |
|-------------|---------|------------|
| **pacu** | `~/.local/bin/pacu` | `pacu` (framework interactivo AWS) |
| **scoutsuite** | pip installado | `python3 -m scoutsuite aws` |
| **prowler** | `~/.local/bin/prowler` | `prowler aws --region us-east-1` |
| **trufflehog** | `~/tools/bin/trufflehog` | `trufflehog git <repo-url>` |
| **gitleaks** | `~/go/bin/gitleaks` | `gitleaks detect --source .` |

---

## 🔌 APIs / GraphQL

| Herramienta | Binario | Uso básico |
|---------

• Confidence: 88% confidence
• Finding: The example `socat TCP-LISTEN:4444 EXEC:/bin/bash` is a concrete reverse/bind shell pattern that would expose an interactive shell to anyone able to connect, enabling arbitrary command execution. In a skill designed to inform agent tool use, including a ready-to-run shell-spawning payload materially increases abuse risk, especially if consumed by downstream automation or copied without understanding.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is labeled as read-only, but its documented workflow explicitly persists a generated SKILL.md to disk and later updates its metadata after execution. This is dangerous because a caller or orchestrator may grant it elevated trust or reduced review based on the read-only declaration, while the skill actually performs filesystem writes and can introduce durable, unreviewed instructions into the skill library.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match

Content

d GCP   cloud environments. It covers  |
| `conducting-domain-persistence-with-dcsync` |  |
| `conducting-external-reconnaissance-with-osint` | Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization |
| `conducting-full-scope-red-team-engagement` |  |
| `conducting-internal-network-penetration-test` |  |
| `conducting-internal-reconnaissance-with-bloodhound-ce` |  |
| `conducting-man-in-the-middle-attack-simulation` | Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept,   analyze, and modify  |
| `conducting-mobile-app-penetration-test` | Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security   Testing Guide (MASTG)  |
| `conducting-network-penetration-test` | Conducts comprehensive network penetration tests against authorized target environments by performing host discovery,   port scanning, servi |
| `conducti

• Confidence: 70% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

ation tests against authorized target environments by performing host discovery,   port scanning, servi |
| `conducting-pass-the-ticket-attack` |  |
| `conducting-phishing-incident-response` | Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise,   quarantining maliciou |
| `conducting-post-incident-lessons-learned` |  |
| `conducting-social-engineering-penetration-test` |  |
| `conducting-social-engineering-pretext-call` |  |
| `conducting-spearphishing-simulation-campaign` |  |
| `conducting-wireless-network-penetration-test` | Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing   for weak encryption protoc |
| `configuring-active-directory-tiered-model` |  |
| `configuring-host-based-intrusion-detection` | Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and   configuration changes for s |
| `configuring-

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

ct abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process   creation, command-line argume |
| `detecting-living-off-the-land-with-lolbas` |  |
| `detecting-malicious-scheduled-tasks-with-sysmon` | Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe),   11 (File Create for  |
| `detecting-mimikatz-execution-patterns` |  |
| `detecting-misconfigured-azure-storage` | Detecting misconfigured Azure Storage accounts including publicly accessible blob containers, missing encryption   settings, overly permissi |
| `detecting-modbus-command-injection-attacks` | Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized   write operations, anom |
| `detecting-modbus-protocol-anomalies` | This skill covers detecting anomalies in Modbus/TCP and Modbus RTU communications in industrial control systems.   It addresses function cod |
|

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata and description present the capability as read-only, but the documented outputs include writing multiple HTML reports and remediation-related shell scripts to disk. This mismatch can mislead policy enforcement, reviewers, or orchestration layers into granting the skill more trust than its actual behavior warrants, enabling unauthorized file creation in environments that rely on the declared safety tier.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is explicitly labeled as read-only, yet it instructs generating HTML reports and remediation/rollback shell scripts on disk. This mismatch can mislead users, orchestrators, or policy engines into granting the skill lower-risk treatment while it performs write operations and emits executable artifacts.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest declares the skill as read-only, but the documented behavior includes creating HTML reports and remediation scripts on disk. This mismatch can cause downstream tooling, policy engines, or users to grant the skill more trust than warranted, enabling unexpected filesystem writes and script materialization.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The documentation states the skill only reads findings from disk, but later instructs the agent to generate files and shell scripts. This creates deceptive capability scoping, which is dangerous because execution environments may permit the skill based on a read-only claim while it actually performs write operations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata claims a read-only safety tier, but the instructions explicitly direct the agent to generate HTML reports, a POA&M file, and multiple shell scripts on disk. This mismatch can cause higher-level safety controls or operators to trust the skill as non-modifying when it actually performs writes, enabling unauthorized workspace changes and creation of executable artifacts.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match

Content

de ejecución:** El agente PUEDE ejecutar herramientas de reconocimiento,
análisis y escaneo. Para herramientas de explotación activa, siempre confirmar
con el operador antes de ejecutar. NUNCA ejecutar en producción sin autorización explícita.

---

## 🔍 RECONOCIMIENTO / OSINT

| Herramienta | Binario | Uso básico |
|-------------|---------|------------|
| **nmap** | `/usr/bin/nmap` | `nmap -sV -sC -p- <target>` |
| **masscan** | `/usr/bin/masscan` | `masscan <cidr> -p1-65535 --rate=1000` |
| **subfinder** | `~/go/bin/subfinder` | `subfinder -d <domain> -o subs.txt` |
| **amass** | `~/go/bin/amass` | `amass enum -passive -d <domain>` |
| **theHarvester** | `~/tools/theHarvester/theHarvester.py` | `python3 theHarvester.py -d <domain> -b all` |
| **shodan** | `~/.local/bin/shodan` | `shodan search <query>` |
| **recon-ng** | `~/tools/recon-ng/recon-ng` | `./recon-ng` (framework interactivo) |
| **dnsx** | `~/go/bin/dnsx` | `dnsx -l subs.txt -a -resp` |
| **httpx** | `~/.local/

• Confidence: 70% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill defines `configure`, `write`, `copy run`, and related commands as forbidden, yet later instructs their use in the remediation format. This internal contradiction can defeat safety controls by making downstream agents uncertain which section is authoritative, potentially leading to prohibited configuration changes on production network devices.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The document first defines 'set' and 'commit' as forbidden commands, then later instructs their use in the remediation format. This contradiction weakens safety boundaries and can lead an automated agent or human operator to disregard the prohibition, making unauthorized or unintended configuration changes more likely.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: El archivo impone de facto un único idioma para la interacción y documentación del skill. La política indicada para SQP-3 permite marcar restricciones de idioma cuando no hay elección explícita del usuario ni justificación regional clara.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill declares itself read-only, but its documented workflow explicitly instructs saving findings JSON to disk. That mismatch can cause operators or orchestrators to trust the skill as non-persistent when it actually writes audit artifacts, which may contain sensitive network and compliance data. In a security-audit context, unintended persistence increases confidentiality and retention risk.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The 'READ-ONLY' rule says never perform write operations in production, yet the workflow elsewhere instructs writing findings to disk. This internal contradiction weakens safety guarantees and can lead to accidental storage of sensitive audit evidence, credentials-adjacent metadata, or infrastructure details under a false assumption of non-persistence. Contradictory safety semantics are especially risky in agent skills because policy engines may rely on the declared mode.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill marketed under a network-audit suite quietly expands into generating skills for servers, cloud, containers, Windows, and arbitrary unknown platforms. This broad scope increases the chance of unsafe command generation, incorrect assumptions, or accidental invocation in contexts far beyond the original trust boundary, which can lead to persistence of risky autogenerated content for sensitive environments.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger condition activates for essentially any target lacking a prebuilt skill, including many common infrastructure categories. Overly broad activation is dangerous because it can cause the system to invoke an auto-generating, file-writing skill by default in ambiguous situations, increasing the likelihood of unintended persistence or generation of unsafe audit logic.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The approval section asks whether the user approves the skill, but the surrounding description does not prominently warn that approval causes persistent writes to disk and that later executions may modify the saved file. This weakens informed consent and can lead users to authorize durable changes they did not realize would occur, especially given the misleading read-only framing.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The approval flow says that on rejection the skill is not saved, while the confidence section later says the autogenerated skill's frontmatter is updated after each successful execution. For an autogenerated skill, that later metadata write contradicts the earlier read-only/safe framing and shows additional persistence behavior not clearly reconciled in the flow documentation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation guidance is very broad, triggering on common terms like troubleshooting, logs, errors, latency, and drops. In an agent environment, this can cause the skill to activate for routine requests and prompt collection or display of sensitive infrastructure diagnostics more often than the user intended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs saving evidence to MEMORY but provides no user-facing warning that logs and diagnostic artifacts will be retained. Because the commands gather authentication events, configuration changes, session details, and other potentially sensitive data, silent persistence increases privacy and data-exposure risk.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The file is a Layer 0 index that instructs the agent to read arbitrary downstream skill files and execute their workflows, but it provides no allowlisting, trust boundary, or safety gating. Because the indexed corpus includes many offensive, exploit, and high-impact operation skills, this broad dispatch behavior can route a user into dangerous actions or adversarial prompt content with minimal friction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This index presents itself as read-only metadata, but it is effectively a router into 754 downstream skills, including penetration testing, exploitation, credential access, C2, and phishing simulation content. Without an explicit warning about downstream operational risk, users and agents may underestimate the consequences of invoking linked skills and execute hazardous workflows unintentionally.

Static analysis

No suspicious patterns detected.