Versioned security assessment
Report ID: SA-D46E6208
7/7/2026, 7:32:35 PM
analysis-tshark security assessment v8
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- analysis-tshark
- Version
- v8
- Maintainer
- AgentSecOps
- Coverage
- 6 Files scanned · 2,168 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
9 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static findings are false positives caused by Markdown code fences, defensive templates, or reference examples. Confirmed risks remain for privileged packet capture, TLS key material handling, credential extraction workflows, wireless/interface enumeration, shell automation, and a CI curl-to-bash installer pattern.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 2,168 Lines analyzed
43 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 37 evidence locations
Filesystem access
May read or write local files.
Observed in 1 evidence location
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 112 evidence locations
Capability review items (34)
High
sudo privilege escalation
sudo tshark -i eth0
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -c 100 -w capture.pcap
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -D
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i wlan0
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i any
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -i wlan0
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -c 1000
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -a duration:60
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -f "tcp port 80"
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -f "host 192.168.1.100"
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -f "net 192.168.1.0/24"
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -f "tcp port 80 or tcp port 443"
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -f "not port 22"
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -f "tcp[tcpflags] & tcp-syn != 0"
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -w incident_$(date +%Y%m%d_%H%M%S).pcap -a duration:300
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -w malware_traffic.pcap
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -Y "(http.authorization or ftp or pop or imap) and not tls" -T fields -e ip.src
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i mon0 -w wireless_capture.pcap
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i $INTERFACE -Y "$ALERT_FILTER" -T fields -e frame.time -e ip.src -e ip.dst -e http.hos
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
# Run with sudo
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo usermod -a -G wireshark $USER
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo setcap cap_net_raw,cap_net_admin+eip /usr/bin/tshark
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
# List interfaces with sudo
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -D
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -f "not port 22" -w capture.pcap
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -w capture.pcap -b filesize:100000 -b files:5
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
High
sudo privilege escalation
sudo tshark -i eth0 -s 128 -w capture.pcap
The skill instructs users to run TShark or related setup commands with sudo. Privileged packet capture and capability changes can expose sensitive traffic or modify host security posture.
Medium
Unix shell invocation
#!/bin/bash
The skill includes a Bash monitoring script that runs TShark and pipes captured alert data into logging and mail. It is example automation, but it is real shell execution guidance.
Low
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads an installer from an external GitHub URL at runtime. This is a real supply-chain risk because the same line executes the fetched content through a shell.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (9)
RISK-001 Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template uses a curl-to-bash pattern to execute a remote installer script directly. That creates a critical supply-chain execution risk if the template is copied into a workflow.
RISK-002 High
Certificate/key files
tshark -r capture.pcap -o tls.keylog_file:sslkeys.log -Y "http"
The TLS decryption example uses an SSL key log file, which is sensitive key material. Mishandling it can expose encrypted session contents.
RISK-003 High
Certificate/key files
tshark -r capture.pcap -o tls.keys_list:192.168.1.100,443,http,/path/to/server.key
The TLS keys list example references a server private key path. Private keys are sensitive and can compromise encrypted traffic if exposed.
RISK-004 High
Credential Extraction Guidance
The skill explicitly guides extraction of HTTP Basic authentication, FTP passwords, NTLM hashes, SMTP authentication, POP3 credentials, and IMAP logins from captures. This is valid for authorized forensics but creates high risk if used outside a defined investigation scope.
The section is titled credential extraction and contains direct workflows for multiple credential types. The surrounding text limits use to authorized forensics, but the capability is explicit.
RISK-005 High
Privileged Packet Capture of Sensitive Traffic
The skill directs live packet capture with elevated privileges and notes that captures can expose sensitive information. Broad packet capture can collect third-party traffic, credentials, and personal data if scope controls are weak.
The source repeatedly requires authorization and secure storage, which confirms the author understands the sensitivity. The live capture commands require elevated access and can collect broad traffic.
RISK-006 Medium
Automated Alert Email May Expose Capture Metadata
The monitoring script pipes selected TShark output into a log and emails the same alert line to a SOC address. Captured source, destination, host, and DNS values should be scrubbed or approved before automated distribution.
The script explicitly logs and emails captured network fields. The destination is a placeholder SOC address, so the risk depends on deployment context.
RISK-007 Low
System reconnaissance
tshark -r wireless_capture.pcap -Y "wlan.fc.type_subtype == 0x08" -T fields -e wlan.ssid -e wlan.bss
The wireless workflow enumerates SSIDs and BSSIDs from a capture. This is legitimate analysis, but it can reveal network identifiers and should stay within authorized scope.
RISK-008 Low
System reconnaissance
tshark -r wireless_capture.pcap -Y "wlan.fc.type_subtype == 0x04" -T fields -e wlan.sa -e wlan.ssid
The wireless workflow enumerates client probing activity and SSIDs from a capture. This can expose nearby network metadata, so it is a real low-level privacy risk.
RISK-009 Low
Network reconnaissance
ifconfig -a
The troubleshooting section uses local interface enumeration. It is common diagnostics, but it still performs host network discovery.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalRemote installer is piped directly into bash in the CI template.Replace curl-to-bash with a pinned package release, checksum verification, or a reviewed action version.
- FIX-002HighLive packet capture and setup examples rely on sudo or elevated capabilities.Add stronger guardrails for authorization, scope, least privilege, and rollback of group or capability changes.
- FIX-003HighCredential extraction workflows can expose passwords, hashes, cookies, and authentication data.Require explicit investigative purpose, redact outputs by default, and document retention and destruction steps.
- FIX-004HighTLS decryption examples require SSL key logs or private server keys.Warn users to store key material separately, restrict access, and delete temporary decryption artifacts after review.
- FIX-005MediumThe monitoring script emails captured network metadata automatically.Make recipients configurable, redact sensitive fields, and require approval before sending capture-derived data.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable