S³ Memory Forensics

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:01 AM UTC
• Version: 1.0.0

Overview

This memory-forensics skill is coherent but needs review because it teaches full-system memory capture and credential extraction without strong authorization or secret-handling safeguards.

Install only if you will use it for authorized memory-forensics work. Before following its acquisition or credential commands, define the target system, written authorization, evidence location, retention period, and secret-handling rules; avoid returning raw hashes, tokens, passwords, or full environment values in chat or logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:51

Finding

Privileged Raw Memory Acquisition Without Authorization Guardrails

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–55
Vulnerability Type: Privileged access to raw system memory
Risk Level: High

Vulnerable Code Snippet:

bash

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf

Technical Analysis

The Skill instructs the Agent to use sudo to copy data from /dev/mem or /proc/kcore. These interfaces may expose kernel memory and the memory of user processes. A resulting image can contain passwords, cryptographic keys, access tokens, application secrets, personal information, and other security-sensitive data.

Raw memory acquisition is a legitimate forensic capability, but the Skill does not require the Agent to verify authorization, establish an approved scope, minimize collected data, or apply secure evidence-handling controls before executing these privileged commands. Consequently, an Agent following the instructions could cross least-privilege boundaries when the underlying task has not explicitly authorized full-system memory acquisition.

Attack Path

1. An attacker or untrusted user submits a request framed as a memory-forensics task.
2. The Agent follows the Skill and requests or uses elevated privileges.
3. The Agent reads /dev/mem or /proc/kcore and creates a memory image.
4. The image is searched for credentials, tokens, keys, or data belonging to other users and processes.
5. The extracted material is used to access protected applications, accounts, or services.

Exploitation depends on the Agent having, or being able to obtain, sufficient operating-system privileges.

Impact Assessment

Successful exploitation may disclose memory belonging to the kernel and multiple local processes. Depending on the host and available memory interface, the exposed scope can include credentials, session tokens, encryption keys, confidential docum ...[truncated 195 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit confirmation that the requester owns or is authorized to examine the target system.
• Define the target host, investigation scope, evidence destination, retention period, and approved acquisition method before running privileged commands.
• Require a human approval checkpoint before invoking sudo or reading kernel memory interfaces.
• Prefer a reviewed acquisition utility that records acquisition metadata and minimizes changes to the target.
• Write evidence only to an encrypted, access-controlled destination rather than a general temporary directory.
• Calculate and record a cryptographic hash immediately after acquisition.
• Record the operator, date, tool version, command, target, and evidence hash for chain-of-custody purposes.
• Prevent memory images from being uploaded, shared, or transmitted without separate authorization.
• Securely delete working copies after the approved retention period.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:377

Finding

Credential Extraction Procedures Lack Scope and Authorization Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 377–385
Vulnerability Type: Extraction of authentication secrets from captured memory
Risk Level: High

Vulnerable Code Snippet:

bash

# Dump hashes (requires hivelist first)
vol -f memory.raw windows.hashdump

# LSA secrets
vol -f memory.raw windows.lsadump

# Cached domain credentials
vol -f memory.raw windows.cachedump

Technical Analysis

The documented commands are specifically intended to recover password hashes, LSA secrets, and cached domain credentials. These artifacts can enable offline password cracking, credential reuse, account impersonation, and lateral movement.

Credential recovery can be necessary during an authorized incident investigation, but the Skill provides no requirement to confirm that credential extraction is within scope. It also lacks controls for masking output, restricting access, encrypting evidence, preventing disclosure in Agent responses, and securely destroying extracted secrets. This creates a risk that a broadly phrased forensic request could cause the Agent to obtain authentication material unnecessary for the legitimate task.

The same document also recommends environment-variable extraction at lines 117 and 205. Environment variables frequently contain API keys and service tokens, reinforcing the need for explicit secret-handling controls.

Attack Path

1. An attacker supplies or identifies a Windows memory image accessible to the Agent.
2. The attacker requests broad incident-response or memory-forensics analysis.
3. The Agent invokes windows.hashdump, windows.lsadump, or windows.cachedump without confirming that credential recovery is authorized.
4. The recovered hashes or secrets are written to output, logs, or analysis artifacts.
5. The attacker obtains the output and cracks, reuses, or relays the recovered credentials.
6. Valid credentials may then be used to impersonate users o ...[truncated 629 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, separate authorization for credential extraction; do not treat general permission to analyze memory as permission to recover credentials.
• Add a default prohibition against returning plaintext secrets, hashes, tokens, or complete environment-variable values in Agent responses.
• Limit credential extraction to identified accounts and artifacts necessary for the investigation.
• Redact secret values in reports and provide only artifact type, source, account identifier, and validation status where possible.
• Store extracted material in an encrypted evidence repository with role-based access controls and audit logging.
• Prevent credential artifacts from entering ordinary command logs, chat transcripts, shell history, or unprotected output files.
• Rotate affected credentials and revoke exposed tokens after authorized extraction.
• Define a short retention period and securely destroy extracted material when it is no longer required.
• Record who approved credential recovery and who accessed its output.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:88

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 88
Vulnerability Type: Unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Install Volatility 3
pip install volatility3

Technical Analysis

The installation command does not pin a reviewed package version, verify distribution hashes, specify a trusted package index, or require an isolated environment. Its resolved package and transitive dependencies can therefore change over time without any corresponding change to the audited Skill.

If the selected package release, package-index account, distribution artifact, or transitive dependency is compromised, installation or subsequent execution could run attacker-controlled code. Even without a malicious compromise, an incompatible future release could change plugin behavior and undermine forensic reproducibility.

The package name itself is not shown to be malicious. The vulnerability is the absence of version and integrity controls around executable third-party content.

Attack Path

1. A user or Agent follows the installation instruction.
2. pip resolves the latest available package and its transitive dependencies from the configured package index.
3. A compromised or unexpectedly modified release is downloaded because no reviewed version or hash is required.
4. Package installation or later Volatility execution runs attacker-controlled code under the installing user's privileges.
5. The malicious component accesses local evidence, credentials, files, or network resources available to that user.

Exploitation requires compromise or manipulation of a resolved package, dependency, package source, or local package-index configuration.

Impact Assessment

Malicious dependency code would execute with the privileges of the account performing installation or running Volatility. Because forensic workflows commonly access highly sensitive mem ...[truncated 206 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Volatility and all transitive dependencies to reviewed versions in a lock file.
• Require cryptographic hashes, such as through pip install --require-hashes -r requirements.txt.
• Use a dedicated virtual environment or isolated container with minimal host permissions.
• Configure an explicitly trusted package index and disable unintended fallback indexes.
• Download and review artifacts in advance rather than resolving the latest release during an investigation.
• Scan dependencies for known vulnerabilities and periodically review version updates.
• Record tool and dependency versions in each forensic report to support reproducibility.
• Run the analysis environment without unnecessary network access and mount evidence read-only where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

functions vol -f memory.raw windows.ssdt # System Service Descriptor Table

Driver analysis

vol -f memory.raw windows.driverscan vol -f memory.raw windows.driverirp

text

### Credential Extraction

```bash
# Dump hashes (requires hivelist first)
vol -f memory.raw windows.hashdump

# LSA secrets
vol -f memory.raw windows.lsadump

# Cached domain credentials
vol -f memory.raw windows.cachedump

# Mimikatz-style extraction
# Requires specific plugins/tools

YARA Integration

Writing Memory YARA Rules

yara

rule Suspicious_Injection
{
    meta:
        description = "Detects common injection shellcode"

    strings:
        // Common shellcode patterns
        $mz = { 4D 5A }
        $shellcode1 = { 55 8B EC 83 EC }  // Function prologue
        $api_hash = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 }  // Push hash, call

    condition:
        $mz at 0 or any of ($shellcode*)
}

rule Cobalt_Strike_Beacon
{
    meta:
        description = "Detects Cobalt Strike beacon in memory"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Linux

bash

# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Linux

bash

# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Linux

bash

# LiME (Linux Memory Extractor)
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

sudo insmod lime.ko "path=/tmp/memory.lime format=lime"

# /dev/mem (limited, requires permissions)
sudo dd if=/dev/mem of=memory.raw bs=1M

# /proc/kcore (ELF format)
sudo cp /proc/kcore memory.elf

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes credential-dumping commands such as hashdump, lsadump, and cachedump without an explicit warning that these actions expose highly sensitive secrets and may violate policy, law, or scope boundaries. In a dual-use security skill, omission of handling and authorization safeguards materially increases the chance of misuse or unsafe operator behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.