Versioned security assessment

Report ID: SA-0FD502CF

7/6/2026, 12:37:42 AM

crack-hashcat security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
crack-hashcat
Version
v7
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat
Coverage
5 Files scanned · 2,029 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

7 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static hits in templates and reference files are documentation examples or Markdown formatting false positives. Confirmed risks include remote installer execution in CI and direct instructions to access system password hash files. Semantic review also identifies broad credential extraction, cracking, and plaintext cracked password handling risks.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

5 Files scanned · 2,029 Lines analyzed

13 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 23 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Observed in 18 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 62 evidence locations

Capability review items (6)
High
SKILL.md:120
sudo privilege escalation
sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt
The skill instructs use of sudo to read /etc/shadow and write extracted password hashes. That is privileged credential material access and can be abused outside authorized audits.
High
SKILL.md:342
sudo privilege escalation
sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt
The skill instructs use of sudo with unshadow against /etc/passwd and /etc/shadow. This requires elevated access to sensitive password hash data.
Low
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded URL is part of a remote installer download in CI. The network reference is risky in context because it feeds the pipe-to-shell install path.
Low
assets/rule-template.yaml:147
Python environment access
- Python: os.environ.get('API_KEY')
Static analysis identified a potentially risky pattern and context was insufficient to dismiss it. Kept fail-closed for review.
Low
assets/rule-template.yaml:162
Python environment access
api_key = os.environ.get('API_KEY')
Static analysis identified a potentially risky pattern and context was insufficient to dismiss it. Kept fail-closed for review.
Low
references/EXAMPLE.md:423
Python environment access
VALID_API_KEY = os.environ.get('API_KEY')
Static analysis identified a potentially risky pattern and context was insufficient to dismiss it. Kept fail-closed for review.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads an installer from raw GitHub and pipes it directly to bash. This is a real supply-chain risk because remote content executes without pinning or checksum verification.
RISK-002 Critical
SKILL.md:119
System password file access
# From /etc/shadow (Linux)
The line introduces extraction from /etc/shadow, a system password hash store. This is sensitive credential-access guidance even when framed for audits.
RISK-003 Critical
SKILL.md:120
System password file access
sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt
The command directly reads /etc/shadow with sudo and saves usable hashes. This is high-impact credential material collection.
RISK-004 Critical
SKILL.md:341
System password file access
# Extract hashes from /etc/shadow
The line explicitly describes extracting hashes from /etc/shadow. That file contains protected password hashes and should not be accessed without strict authorization.
RISK-005 Critical
SKILL.md:342
System password file access
sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt
The command combines /etc/passwd and /etc/shadow into a crackable hash file. This is direct preparation of privileged credential material for cracking.
RISK-006 Critical
SKILL.md:119-123SKILL.md:327-335SKILL.md:377-385
Credential Hash Extraction and Cracking Workflow
The skill instructs users to extract password hashes from /etc/shadow, NTDS.dit, Kerberos tickets, and WPA handshakes, then crack them with Hashcat. Even with authorization warnings, this is high-risk credential-access capability if misused.
The cited workflow contains direct operational commands for extracting and cracking credential hashes from operating system, Active Directory, Kerberos, and wireless sources.
RISK-007 High
SKILL.md:268-276SKILL.md:297-313
Plaintext Cracked Password Output Handling
The skill shows commands that display cracked passwords and export them to plaintext files. This creates sensitive credential exposure risk unless storage, retention, and redaction controls are enforced.
The referenced lines include showing and exporting cracked passwords, followed by general secure storage and deletion guidance. The sensitive-output risk is concrete even though defensive controls are mentioned.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Direct system password hash extraction examples
    Replace /etc/shadow and NTDS extraction commands with authorization-gated guidance that requires users to provide approved hash files.
  2. FIX-002
    Critical
    Remote installer piped to shell
    Use a pinned package, trusted action, fixed release, or checksum verification instead of downloading a script and piping it to bash.
  3. FIX-003
    High
    Plaintext cracked password export
    Avoid writing cracked passwords to plaintext. Require encrypted storage, access control, short retention, and redacted reporting.
  4. FIX-004
    High
    Dangerous workflow scope control
    Add refusal criteria for unauthorized cracking and require scope, owner, and evidence handling confirmation before command-level guidance.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
High
references/EXAMPLE.md:276
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/WORKFLOW_CHECKLIST.md:193
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable