Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Docker sandbox/malware-analysis skill, but users should treat its file outputs, traffic captures, and credential handling carefully.
Install only if you intend to run Docker-based security analysis. Use a dedicated isolated host or VM, choose explicit output directories, clean up reports/PCAPs/snapshots/audit data, and avoid storing API keys in plaintext local config files unless you have verified restrictive permissions and retention controls.
The skill gives conflicting credential guidance: it recommends environment variables while also stating that all credentials are stored in a local configuration file. This inconsistency can cause operators to persist sensitive API keys insecurely on disk, increasing the chance of credential leakage through backups, mispermissions, or accidental sharing.
The skill documents export, report generation, captures, and snapshot operations but does not clearly warn that these actions write to local storage and may overwrite existing files or consume significant disk space. In a tool with read, write, and exec capabilities, unclear output-side effects can lead to data loss, unintended modification of analyst systems, or persistence of sensitive malware artifacts.
The skill supports network capture and optional external intelligence services but does not clearly warn that captured traffic, malware communications, or sample metadata may be collected, stored, or transmitted to third parties. In a malware-analysis context, this can expose sensitive internal network data, regulated content, or proprietary sample information during analysis workflows.
The credential-handling section conflicts with the safety section by recommending environment variables while also asserting local config-file credential storage, without a clear warning about local secret persistence risks. This can mislead users into storing API keys in insecure locations and undermines the stated prohibition against hardcoding secrets.
No suspicious patterns detected.
