Versioned security assessment

Report ID: SA-F9CB84FA

7/6/2026, 12:26:16 AM

analysis-tshark security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
analysis-tshark
Version
v7
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/analysis-tshark
Coverage
5 Files scanned · 2,158 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings in templates and reference documents are false positives from Markdown, examples, or defensive guidance. Confirmed risks remain in the CI curl-to-bash installer, privileged live packet capture, credential extraction workflows, and TLS key material handling. No prompt injection attempt was found in the reviewed static-analysis files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 2,158 Lines analyzed

43 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 37 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Observed in 18 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 112 evidence locations

Capability review items (38)
High
SKILL.md:38
sudo privilege escalation
sudo tshark -i eth0
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:41
sudo privilege escalation
sudo tshark -i eth0 -c 100 -w capture.pcap
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:87
sudo privilege escalation
sudo tshark -D
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:90
sudo privilege escalation
sudo tshark -i eth0
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:91
sudo privilege escalation
sudo tshark -i wlan0
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:94
sudo privilege escalation
sudo tshark -i any
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:97
sudo privilege escalation
sudo tshark -i eth0 -i wlan0
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:113
sudo privilege escalation
sudo tshark -i eth0
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:116
sudo privilege escalation
sudo tshark -i eth0 -c 1000
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:119
sudo privilege escalation
sudo tshark -i eth0 -a duration:60
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:122
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:125
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:141
sudo privilege escalation
sudo tshark -i eth0 -f "tcp port 80"
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:144
sudo privilege escalation
sudo tshark -i eth0 -f "host 192.168.1.100"
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:147
sudo privilege escalation
sudo tshark -i eth0 -f "net 192.168.1.0/24"
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:150
sudo privilege escalation
sudo tshark -i eth0 -f "tcp port 80 or tcp port 443"
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:153
sudo privilege escalation
sudo tshark -i eth0 -f "not port 22"
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:156
sudo privilege escalation
sudo tshark -i eth0 -f "tcp[tcpflags] & tcp-syn != 0"
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:441
sudo privilege escalation
sudo tshark -i eth0 -w incident_$(date +%Y%m%d_%H%M%S).pcap -a duration:300
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:458
sudo privilege escalation
sudo tshark -i eth0 -w malware_traffic.pcap
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:477
sudo privilege escalation
sudo tshark -i eth0 -Y "(http.authorization or ftp or pop or imap) and not tls" -T fields -e ip.src
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:509
sudo privilege escalation
sudo tshark -i mon0 -w wireless_capture.pcap
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:550
sudo privilege escalation
sudo tshark -i $INTERFACE -Y "$ALERT_FILTER" -T fields -e frame.time -e ip.src -e ip.dst -e http.hos
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:564-565
sudo privilege escalation
# Run with sudo
The text directs use of sudo for TShark troubleshooting. Even as guidance, it normalizes privileged packet capture and should require explicit confirmation.
High
SKILL.md:565
sudo privilege escalation
sudo tshark -i eth0
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:568
sudo privilege escalation
sudo usermod -a -G wireshark $USER
The troubleshooting guidance modifies local permissions or Linux capabilities for packet capture. This can grant persistent privileged network capture access beyond a single command.
High
SKILL.md:569
sudo privilege escalation
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/tshark
The troubleshooting guidance modifies local permissions or Linux capabilities for packet capture. This can grant persistent privileged network capture access beyond a single command.
High
SKILL.md:581-582
sudo privilege escalation
# List interfaces with sudo
The text directs use of sudo for TShark troubleshooting. Even as guidance, it normalizes privileged packet capture and should require explicit confirmation.
High
SKILL.md:582
sudo privilege escalation
sudo tshark -D
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:594
sudo privilege escalation
sudo tshark -i eth0 -f "not port 22" -w capture.pcap
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:597
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:600
sudo privilege escalation
sudo tshark -i eth0 -s 128 -w capture.pcap
The skill instructs running TShark with sudo on live interfaces. That grants packet capture privileges and can intercept sensitive traffic if used outside the authorized scope.
High
SKILL.md:195
HTTP/HTTPS request
tshark -r capture.pcap -Y "http.request.method == POST and (http contains \"password\" or http conta
The TShark filter extracts or searches HTTP POST and credential-related traffic from captures. This can expose sensitive user data and requires strict authorization and storage controls.
High
SKILL.md:480
HTTP/HTTPS request
tshark -r capture.pcap -Y "http.request.method == POST" -T fields -e http.file_data > post_data.txt
The TShark filter extracts or searches HTTP POST and credential-related traffic from captures. This can expose sensitive user data and requires strict authorization and storage controls.
High
SKILL.md:483
HTTP/HTTPS request
tshark -r capture.pcap -Y "http contains \"password\" or http contains \"passwd\"" -T fields -e ip.s
The TShark filter extracts or searches HTTP POST and credential-related traffic from captures. This can expose sensitive user data and requires strict authorization and storage controls.
Medium
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The URL feeds the curl-to-bash installer in the CI template. The hardcoded location is risky because the remote script is executed during a build.
Medium
SKILL.md:544
Unix shell invocation
#!/bin/bash
The section provides a Bash monitoring script that later runs privileged TShark and sends alert output. It is legitimate SOC automation but creates operational risk if copied without review.
Medium
SKILL.md:470
HTTP/HTTPS request
tshark -r malware_traffic.pcap -Y "http.request.method == POST" -T fields -e data.data
The TShark filter extracts or searches HTTP POST and credential-related traffic from captures. This can expose sensitive user data and requires strict authorization and storage controls.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template installs tfsec by piping a remote GitHub script directly into bash. This is a supply-chain risk because the downloaded script is executed without pinning or checksum verification.
RISK-002 High
SKILL.md:608
Certificate/key files
tshark -r capture.pcap -o tls.keylog_file:sslkeys.log -Y "http"
The command uses TLS key log or private key material to decrypt captured traffic. These files are sensitive and can expose plaintext sessions if mishandled.
RISK-003 High
SKILL.md:611
Certificate/key files
tshark -r capture.pcap -o tls.keys_list:192.168.1.100,443,http,/path/to/server.key
The command uses TLS key log or private key material to decrypt captured traffic. These files are sensitive and can expose plaintext sessions if mishandled.
RISK-004 High
SKILL.md:275-319SKILL.md:473-486
Dual-Use Credential Extraction From Captures
The skill explicitly teaches credential extraction from packet captures, including HTTP Basic Auth, FTP passwords, NTLM hashes, email logins, and HTTP POST data. This is valid for authorized forensics but can expose secrets if misused.
The cited sections are titled Credential Extraction and Credential Harvesting Detection and list specific filters for credentials and hashes. The authorization language reduces malicious intent but not the sensitivity of the capability.
RISK-005 High
SKILL.md:28-30SKILL.md:69-76SKILL.md:107-125
Privileged Live Packet Capture Capability
The skill guides live packet capture on network interfaces and warns that captured traffic may expose sensitive information. This can enable unauthorized monitoring if scope and consent are not enforced.
The file clearly describes packet capture, sensitive information exposure, and live capture commands. The skill includes authorization checks, so this is a controlled dual-use risk rather than overt malicious intent.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote script is piped directly to bash in the CI template.
    Replace the curl-to-bash installer with a pinned action, pinned package version, or checksum-verified download before execution.
  2. FIX-002
    High
    The skill presents many sudo packet capture commands as normal workflow steps.
    Add explicit confirmation gates, prefer offline pcap analysis first, and document least-privilege capture setup with rollback steps.
  3. FIX-003
    High
    Credential, hash, POST body, and TLS key material extraction can expose secrets.
    Move these steps behind an authorized incident-response warning and require redaction, encryption, retention, and access-control guidance in each workflow.
  4. FIX-004
    High
    Troubleshooting guidance grants persistent packet capture capabilities with setcap and group membership changes.
    Explain the security impact, limit the recommendation to approved hosts, and include commands or steps to remove the granted capability.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (5)
Critical
SKILL.md:607
Keylogger keywords
# Provide SSL key log file (requires SSLKEYLOGFILE environment variable)
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:608
Keylogger keywords
tshark -r capture.pcap -o tls.keylog_file:sslkeys.log -Y "http"
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
references/EXAMPLE.md:276
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/WORKFLOW_CHECKLIST.md:193
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
SKILL.md:355
C2 keywords
# Detect common C2 beaconing patterns
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable