Skills crack-hashcat

📦

crack-hashcat

Name: crack-hashcat
Author: AgentSecOps

v0.1.0 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Audit Password Hashes with Hashcat

Password audits need repeatable hash identification, attack selection, and reporting. This skill guides authorized Hashcat workflows for recovery, policy testing, and defensive remediation.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "crack-hashcat" from https://skillstore.io/skills/agentsecops-crack-hashcat.md and its manifest at https://skillstore.io/api/skills/agentsecops-crack-hashcat/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-crack-hashcat.md Signed manifest GET /api/skills/agentsecops-crack-hashcat/manifest Signed lockfile GET /api/skills/agentsecops-crack-hashcat/lockfile

Test it

Using "crack-hashcat". An auditor asks for a first-pass plan for NTLM hashes.

Expected outcome:

The skill recommends confirming scope, selecting the NTLM mode, starting with a curated wordlist, tracking success rate, and protecting outputs.

Using "crack-hashcat". A responder needs to explain weak recovered passwords.

Expected outcome:

Summary of cracked percentage and affected account groups.
Common patterns such as seasons, names, and short numeric suffixes.
Recommended controls including longer passphrases, blocklists, and MFA.

Using "crack-hashcat". A team needs safer handling for cracked credentials.

Expected outcome:

The skill lists restricted storage, encrypted transfer, limited access, retention limits, and verified disposal steps.

Security Audit

Critical

v10 • 7/9/2026 Open versioned report

The audit confirmed critical issues around privileged system password hash extraction and remote installer piping to bash. Most other detections are documentation examples, rule templates, or reference URLs rather than executable package behavior. The skill remains high-risk because it provides dual-use password cracking workflows and handles cracked credentials.

Files scanned

2,039

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (7)

Critical

assets/ci-config-template.yml:240

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The CI template downloads a remote installer and pipes it directly to bash. This creates a supply-chain execution path without pinning or integrity verification.

Critical

SKILL.md:119

System password file access

# From /etc/shadow (Linux)

The referenced section directs users to extract hashes from /etc/shadow. Accessing system password files is a critical credential exposure risk even when framed as auditing.

Critical

SKILL.md:120

System password file access

sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt

The referenced section directs users to extract hashes from /etc/shadow. Accessing system password files is a critical credential exposure risk even when framed as auditing.

Critical

SKILL.md:341

System password file access

# Extract hashes from /etc/shadow

The referenced section directs users to extract hashes from /etc/shadow. Accessing system password files is a critical credential exposure risk even when framed as auditing.

Critical

SKILL.md:342

System password file access

sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt

The referenced section directs users to extract hashes from /etc/shadow. Accessing system password files is a critical credential exposure risk even when framed as auditing.

High

SKILL.md:27-29 SKILL.md:327-385

Dual-use Password Cracking Workflow

The skill provides end-to-end Hashcat guidance for cracking password hashes, including NTLM, WPA2, and Kerberos examples. Authorization warnings are present, but the workflow can enable credential abuse if used outside scope.

The cited sections describe password recovery, attack modes, and concrete domain, Wi-Fi, and Kerberos cracking workflows. The authorization language lowers malicious certainty but not dual-use risk.

High

SKILL.md:268-276 SKILL.md:303-313

Sensitive Cracked Password Artifact Handling

The skill shows outputting cracked credentials to files and displaying usernames with passwords. These artifacts can expose live credentials if stored, shared, or retained without strict controls.

The results section includes viewing and exporting cracked passwords, while the audit section acknowledges artifact handling needs. This is a real data exposure risk with some documented mitigations.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical

SKILL.md:120

sudo privilege escalation

sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt

The skill instructs use of sudo to read system password hash material. That is privileged credential access and can expose sensitive local account hashes.

Critical

SKILL.md:342

sudo privilege escalation

sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt

The skill instructs use of sudo to read system password hash material. That is privileged credential access and can expose sensitive local account hashes.

High

assets/ci-config-template.yml:164

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow passes GITHUB_TOKEN into a third-party action environment. This is common CI behavior, but it exposes a repository token to action runtime code.

Low

assets/ci-config-template.yml:240

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The hardcoded URL fetches an installer script during CI. The risk is real because it is paired with direct shell execution on the next operation.

Risk Factors

⚙️ External commands (50)

🌐 Network access (23)

📁 Filesystem access (2)

assets/ci-config-template.yml:323 assets/ci-config-template.yml:323

🔑 Env variables (23)

⚡ Contains scripts (2)

references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell patternSystem password file access×4

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentsecops-crack-hashcat/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-crack-hashcat/security.svg)](https://skillstore.io/skills/agentsecops-crack-hashcat?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-crack-hashcat?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-crack-hashcat/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-crack-hashcat.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). crack-hashcat security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-crack-hashcat/audits/10

BibTeX citation

@techreport{agentsecops-agentsecops-crack-hashcat-2026,
  author = {AgentSecOps},
  title = {crack-hashcat security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/agentsecops-crack-hashcat/audits/10},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "crack-hashcat security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/agentsecops-crack-hashcat/audits/10"
identifiers:
  - type: other
    value: "skillstore:agentsecops-crack-hashcat:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Run an Authorized Password Audit

Plan a scoped Hashcat audit, choose attack modes, and summarize weak password patterns.

Support Forensic Recovery

Recover passwords from approved evidence hashes while documenting chain of custody and handling requirements.

Improve Credential Controls

Turn cracked password results into policy, storage, and multi-factor authentication recommendations.

Try These Prompts

Identify Hash Type

I have an authorized hash sample from a lab system. Help me identify likely Hashcat modes and safe next steps without exposing the secret.

Plan Audit Attack

Create an authorized Hashcat audit plan for these hash types and constraints. Include attack modes, resource limits, logging, and evidence handling.

Tune Cracking Session

Review my authorized Hashcat session settings and suggest safe tuning for workload, devices, checkpoints, and result protection.

Write Remediation Report

Draft a password audit findings report from these authorized results. Focus on patterns, risk, policy changes, storage controls, and MFA recommendations.