Versioned security assessment

Report ID: SA-1C237B90

7/7/2026, 8:21:03 PM

crack-hashcat security assessment v8

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
crack-hashcat
Version
v8
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/crack-hashcat
Coverage
6 Files scanned · 2,039 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

7 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings in the auxiliary templates are false positives from documentation examples, placeholder rules, or CI sample code. The core SKILL.md content is confirmed high risk because it teaches credential hash extraction and Hashcat cracking workflows, including protected system password files. No prompt injection attempt was found in the reviewed files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

6 Files scanned · 2,039 Lines analyzed

15 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 23 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Observed in 18 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 62 evidence locations

Capability review items (8)
Critical
SKILL.md:120
sudo privilege escalation
sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt
The skill instructs users to run sudo commands that read /etc/shadow and combine password databases. This is credential-hash extraction from a protected system file and is high impact outside a strict authorized scope.
Critical
SKILL.md:342
sudo privilege escalation
sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt
The skill instructs users to run sudo commands that read /etc/shadow and combine password databases. This is credential-hash extraction from a protected system file and is high impact outside a strict authorized scope.
Medium
SKILL.md:416
Shell command substitution
TOTAL=$(wc -l < hashes.txt)
The generated report script uses shell command substitution, including a Hashcat result count. The commands are fixed, but they operate on sensitive cracking artifacts and should be reviewed before use.
Medium
SKILL.md:417
Shell command substitution
CRACKED=$(hashcat -m 1000 hashes.txt --show | wc -l)
The generated report script uses shell command substitution, including a Hashcat result count. The commands are fixed, but they operate on sensitive cracking artifacts and should be reviewed before use.
Medium
SKILL.md:418
Shell command substitution
PERCENT=$((CRACKED * 100 / TOTAL))
The generated report script uses shell command substitution, including a Hashcat result count. The commands are fixed, but they operate on sensitive cracking artifacts and should be reviewed before use.
Medium
SKILL.md:392
Unix shell invocation
#!/bin/bash
The skill includes bash scripts intended to process cracked password audit artifacts. The scripts are local examples, but they still encourage shell execution around sensitive results.
Medium
SKILL.md:415
Unix shell invocation
#!/bin/bash
The skill includes bash scripts intended to process cracked password audit artifacts. The scripts are local examples, but they still encourage shell execution around sensitive results.
Low
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote installer from GitHub as part of a shell pipeline. The URL itself is legitimate, but the network dependency supports the confirmed pipe-to-shell risk.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template pipes a remote install script directly into bash. If copied into a workflow, this creates a supply-chain execution risk without pinning or verification.
RISK-002 Critical
SKILL.md:119
System password file access
# From /etc/shadow (Linux)
The cited section explicitly targets /etc/shadow or /etc/passwd for password hash extraction. Accessing these files is credential access behavior that must be tightly controlled.
RISK-003 Critical
SKILL.md:120
System password file access
sudo cat /etc/shadow | grep -v "^#" | grep -v ":\*:" | grep -v ":!:" > shadow_hashes.txt
The cited section explicitly targets /etc/shadow or /etc/passwd for password hash extraction. Accessing these files is credential access behavior that must be tightly controlled.
RISK-004 Critical
SKILL.md:341
System password file access
# Extract hashes from /etc/shadow
The cited section explicitly targets /etc/shadow or /etc/passwd for password hash extraction. Accessing these files is credential access behavior that must be tightly controlled.
RISK-005 Critical
SKILL.md:342
System password file access
sudo unshadow /etc/passwd /etc/shadow > linux_hashes.txt
The cited section explicitly targets /etc/shadow or /etc/passwd for password hash extraction. Accessing these files is credential access behavior that must be tightly controlled.
RISK-006 Critical
SKILL.md:119-123SKILL.md:327-342
Credential Hash Extraction Workflow
The skill teaches extraction of Linux shadow hashes and Active Directory NTDS hashes before cracking. This is credential access tradecraft even though the skill includes authorization warnings.
The cited lines directly describe collecting /etc/shadow, /etc/passwd, NTDS.dit, and SYSTEM hive material. Those artifacts contain credential hashes suitable for offline cracking.
RISK-007 High
SKILL.md:130-179SKILL.md:351-385
Password Cracking Tradecraft Guidance
The skill provides practical workflows for dictionary, mask, hybrid, WPA2, and Kerberos ticket cracking. This can support legitimate audits, but it also enables credential attacks if used outside scope.
The cited sections list concrete Hashcat attack modes and target formats, including WPA2 and Kerberos material. The context is clearly operational cracking guidance, not abstract policy discussion.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    The skill includes commands that extract hashes from /etc/shadow, /etc/passwd, and Active Directory database material.
    Remove direct extraction commands or replace them with non-operational guidance that requires documented authorization and synthetic lab data.
  2. FIX-002
    Critical
    The CI template uses a remote install script piped directly to bash.
    Replace the pipe-to-shell installer with a pinned release artifact, checksum verification, or package manager installation.
  3. FIX-003
    High
    The skill gives operational cracking workflows for several credential sources.
    Add an explicit preflight gate requiring scope, owner approval, retention limits, and safe handling before any command examples are shown.
  4. FIX-004
    Medium
    Generic template files create many static security hits unrelated to this Hashcat skill.
    Remove unused templates from the package or clearly separate them from runtime skill guidance.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable