x-cmd network skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:33 PM UTC
• Version: 1.0.1

Overview

This is a documentation-only network diagnostics skill whose scanning and DNS capabilities are disclosed and aligned with its stated purpose, but users should only run active scans or DNS changes with clear authorization.

Install only if you intend to use x-cmd for network administration. Treat nmap scans as active probing: target only systems you own or have permission to test, and review commands before running them. Be especially careful with DNS setting changes because they can alter connectivity or redirect traffic.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match

Content

ing.

- **Usage**: `x nmap [options] [targets]`
- **Key capabilities**:
  - Host discovery and port scanning
  - Service and version detection
  - OS fingerprinting
  - Scriptable vulnerability scanning
  - Network mapping and topology discovery
- **Examples**:
  - `x nmap -v -A scanme.nmap.org` - Comprehensive scan with OS detection
  - `x nmap -v -sn 192.168.0.0/16` - Host discovery only
  - `x nmap -p 22,80,443 192.168.1.0/24` - Targeted port scanning
  - `x nmap -O --traceroute target.com` - OS detection with traceroute

### ARP Table Management (arp)
Enhanced ARP cache analysis with multiple output formats.

- **Usage**: `x arp [flags]`
- **Key features**:
  - Interactive TUI application for ARP table viewing
  - Multiple output formats (CSV, TSV, TUI)
  - MAC address vendor lookup
  - Suspicious entry detection
  - Complete ARP table display
- **Examples**:
  - `x arp` - Auto-detect output format (TUI/TSV)
  - `x arp --all` - Show all ARP entries including incomplete
  - `x arp -

• Confidence: 70% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises host discovery, port scanning, OS fingerprinting, and vulnerability scanning without prominently warning that these actions actively probe hosts and may be unauthorized, disruptive, or detectable. In an agent context, this increases the chance an automated assistant could suggest or perform intrusive scans against third-party systems without adequate authorization checks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents `x dns set` as a DNS configuration capability and notes it is experimental, but it does not clearly warn that changing DNS modifies system network settings and can redirect traffic or break connectivity. In an agent setting, vague documentation around network reconfiguration can lead to unsafe or unintended system changes if the tool is invoked without explicit user consent.

Static analysis

No suspicious patterns detected.