このレポートには指定された言語の翻訳がありません。代わりに正規の英語レポートを表示しています。
バージョン付きセキュリティ評価
レポートID: SA-9E952417
7/23/2026, 5:48:18 AM
forensics-osquery セキュリティ評価 v10
スキルセキュリティ認証レポート
スキャナーバージョン 3.0.0 監査モデル: codex 最新の公開済みレポート
- スキル名
- forensics-osquery
- バージョン
- v0.1.0
- メンテナー
- AgentSecOps
- カバレッジ
- 11 スキャンされたファイル · 2,880 解析済み行数
- ポリシーバージョン
- skillstore-security-audit-policy-v1
確認済みの検出結果における最高重大度
高
27 件の確認済みセキュリティ検出結果に対応が必要です。
インストールのコンテキスト
現在のスキルページを確認
このページはレポートの証拠のみを要約しています。正規のインストール勧告は Skill ページで提供されます。
現在のスキルページを開くこのレポートは、マニフェストまたは ZIP をブロックも承認もしません。
The skill is a legitimate defensive osquery guide, and most static hits are false positives from detection SQL, Markdown, loopback addresses, and sensitive-path indicators. Confirmed risks are endpoint telemetry collection, privileged install or service commands, and an unbundled relative script instruction. Additional concerns include ineffective credential-file detection, potential registry secret logging, and unverified privileged package bootstrapping.
レポートの位置
最新の公開済みレポート
「最新」はレポートの順序を指し、アーティファクトの最新性を指すものではありません。
監査アテステーション
有効な証明
この完全に一致するレポートには公開証明があります。
人による検証
未検証
このレポートには人による検証は記録されていません。
カバレッジ
11 スキャンされたファイル · 2,880 解析済み行数
レビュー対象の項目を 42 件表示
制限事項
このレポートはランタイムまたはサンドボックスでの実行を主張するものではなく、副作用がないことを証明するものでもありません。
証拠チェーン
ソースバインディングからインストール契約まで証拠をたどってください。利用可能な証拠は検証を支援しますが、安全性を保証するものではありません。
ソース
コミットとパスにバインド済み
アーティファクト
コンテンツとツリーのハッシュがバインド済み
監査
完了
確認された機能
「確認」とは、このレポートで裏付けとなる証拠が記録されていることを意味します。「記録なし」は、機能が存在しないことを証明するものではありません。
スクリプトを含む
Skillに含まれるコードを実行する場合があります。
4 件の証拠箇所で確認
ネットワークアクセス
外部サービスに接続する場合があります。
29 件の証拠箇所で確認
ファイルシステムへのアクセス
ローカルファイルの読み取りまたは書き込みを行う可能性があります。
29 件の証拠箇所で確認
環境変数
プロセス環境から値を読み取る可能性があります。
1 件の証拠箇所で確認
外部コマンド
Skillの外部にあるコマンドまたはプログラムを呼び出す場合があります。
51 件の証拠箇所で確認
機能レビュー項目 (15)
高
sudo privilege escalation
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $OSQUERY_KEY
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo apt update
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo apt install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
curl -L https://pkg.osquery.io/rpm/GPG | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo yum-config-manager --add-repo https://pkg.osquery.io/rpm/osquery-s3-rpm.repo
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo yum install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo systemctl start osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo systemctl enable osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo osqueryd --verbose --config_path=/etc/osquery/osquery.conf
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
- Run osqueryi with sudo/admin privileges: `sudo osqueryi`
The instruction launches an interactive osquery shell with root privileges, exposing sensitive tables and requiring explicit authorization.
中
Hardcoded IP address
address: 0.0.0.0:8080
The Fleet example binds the server to 0.0.0.0:8080, exposing it on every network interface unless firewall and access controls restrict it.
中
Shell command substitution
**Execute triage**: `./scripts/osquery_triage.sh > incident_triage_$(date +%Y%m%d_%H%M%S).json`
The command executes a relative triage script with shell substitution, but the referenced scripts directory is not bundled and could resolve to an unintended local file.
リスク指摘
確認済みのセキュリティ上の懸念事項は、引き続きレビューが必要な項目と分けて表示されます。
確認済みのセキュリティ上の懸念 (27)
RISK-001 高
Systemd service enablement
sudo systemctl enable osqueryd
The documented command enables osqueryd at boot with root privileges, creating a persistent system service that requires explicit approval.
RISK-002 高
macOS launch agent/daemon
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command loads a privileged daemon, creating persistent monitoring behavior that requires explicit approval.
RISK-003 高
macOS launch agent/daemon
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command unloads a privileged daemon and changes endpoint monitoring state, which requires explicit approval.
RISK-004 高
assets/forensic-packs/credential-access.conf:18-21references/mitre-attack-queries.md:317-328SKILL.md:112-120
Ineffective Credential-File Access Detection
The credential-file detector joins process_memory_map and treats mapped paths as file-access evidence. Password files are normally read, not memory-mapped, so the query can miss real access.
All three examples use process_memory_map as a proxy for file reads, which does not generally record ordinary reads of password files.
RISK-005 高
Potential Registry Secret Logging
A scheduled query selects registry data from keys containing Credentials or Password. With result logging enabled, plaintext credential-like values could enter osquery logs.
The query explicitly selects the data column every hour, and the bundled configuration enables filesystem result logging.
RISK-006 高
Unverified Privileged Package Bootstrap
The deployment guide imports repository trust material and installs packages as root without a documented fingerprint, checksum, or pinned-version verification step.
The commands fetch trust material over the network and immediately use privileged package tooling without an independent integrity check.
RISK-007 中
Unbundled Relative Script Execution
The workflow instructs users to execute ./scripts/osquery_triage.sh, but the reported package contains no scripts directory. A same-named local file could be executed unintentionally.
The command and script claims are explicit, while the code-filled file structure lists no scripts directory or script files.
RISK-008 中
Copyable Placeholder Database Password
The FleetDM example includes a fixed fleet_password value without an adjacent instruction to replace it, increasing the chance of an insecure copied configuration.
The password is visibly a placeholder, but the example gives no local replacement or secret-management requirement.
RISK-009 低
System reconnaissance
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-010 低
System reconnaissance
"query": "SELECT pid, name, cmdline, uid FROM processes WHERE name = 'sudo' AND cmdline NOT LIKE '%-
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-011 低
System reconnaissance
"query": "SELECT path, filename, mode, uid, gid FROM file WHERE filename LIKE 'id_%' AND path LIKE '
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-012 低
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-013 低
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.local_address, ps.local_port, ps.remote_addres
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-014 低
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path, p.cmdline FROM listening_
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-015 低
System reconnaissance
"query": "SELECT path, filename, size, mtime, uid, gid FROM file WHERE (path LIKE '/etc/%' OR path L
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-016 低
System reconnaissance
"query": "SELECT u.username, g.groupname FROM users u JOIN user_groups ug ON u.uid = ug.uid JOIN gro
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-017 低
System reconnaissance
"query": "SELECT p.pid, p.name, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM processe
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-018 低
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-019 低
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-020 低
System reconnaissance
"query": "SELECT pid, name, cmdline, remote_address FROM process_open_sockets ps JOIN processes p ON
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-021 低
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-022 低
System reconnaissance
"host_identifier": "hostname",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-023 低
System reconnaissance
"query": "SELECT hostname, cpu_brand, physical_memory, hardware_model FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-024 低
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-025 低
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.protocol, p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-026 低
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path FROM listening_ports lp LE
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
RISK-027 低
System reconnaissance
"SELECT uuid AS host_uuid FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
是正措置
この監査で推奨される修正が記録されています。これらを適用する責任はメンテナーにあります。
- FIX-001高Potential registry secret loggingRemove the registry data column, narrow approved keys, and redact sensitive values before logs leave the endpoint.
- FIX-002高Credential-file detector uses process_memory_mapUse supported file event or operating-system audit telemetry, then test the detector against controlled password-file reads.
- FIX-003高Privileged package bootstrap lacks independent verificationUse a scoped signed-by keyring, verify the full key fingerprint or package checksum, and pin reviewed package versions.
- FIX-004中Referenced triage scripts are absentBundle reviewed scripts with integrity metadata or remove execution instructions and provide complete read-only commands instead.
- FIX-005中FleetDM example uses a fixed placeholder passwordReplace the value with a secret-manager reference and state that deployments must generate a unique credential.
- FIX-006低Scheduled endpoint telemetry can contain sensitive dataDocument authorization, least privilege, encryption, access control, retention, and redaction requirements beside every deployable pack.
専門家による証拠
不変の対象ID、スキャナーメタデータ、除外された一致項目、およびソースレベルの証拠。
アーティファクト主体
- Marketplace コミット
- 9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
- コンテンツハッシュ
- a322381bfd10eb856dfa18a1f13baf65676d340afc844369fa939a8ad76be504
- ツリーハッシュ
- ed49cf425abc81a0427d1880c9d6c4090d2ac88249ee2688ae0b9c1642284a9b
- Skill パス
- skills/agentsecops/forensics-osquery
- 監査ペイロードハッシュ
- 1c21dc0b8fc507a772e91caea6358873
分析メタデータ
監査モデル: codex
分析状態: 完了
対象範囲は、記録されたファイル、行、メソッド、および証拠に限定されます。ランタイムまたはサンドボックスでの実行は主張していません。
検証とエクスポート
マニフェストとロックファイルは、インストール成果物を暗号学的ハッシュに結び付けます。この完全性に関する主張は、セキュリティ評価とは別のものです。
監査アテステーション: active