Versioned security assessment

Report ID: SA-C7A5CB4C

7/5/2026, 2:24:40 AM

detection-sigma security assessment v8

Skill Security Certification Report

Audit History

Audit model: codex Historical report

Skill name: detection-sigma
Version: v8
Maintainer: AgentSecOps
Source: github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/detection-sigma
Coverage: 13 Files scanned · 2,873 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static hits are false positives caused by Sigma detection examples, ATT&CK labels, markdown command snippets, and reference links. One real documentation risk remains in the Splunk deployment example because it pairs placeholder credentials with disabled TLS verification. No prompt injection or malicious data-exfiltration intent was found in the reviewed skill files.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

13 Files scanned · 2,873 Lines analyzed

2 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 21 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 131 evidence locations

Capability review items (1)

Medium

references/backend-support.md:277

Python HTTP libraries

response = requests.post(url, auth=auth, data=data, verify=False)

The requests.post example sends authenticated Splunk deployment data with TLS verification disabled in the surrounding snippet. It is documentation rather than active code, so the risk is guidance-level.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium

references/backend-support.md:265-277

Insecure SIEM Deployment Example

The Splunk deployment snippet uses placeholder admin credentials and disables TLS certificate verification. If copied into production, it could weaken authentication and expose SIEM API traffic.

The cited snippet directly shows a hardcoded credential tuple and verify=False on an authenticated API request. It is documentation rather than active code, so impact is limited to unsafe guidance.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
Medium
Insecure Splunk deployment example

Remove the hardcoded admin/password tuple and verify=False. Show certificate validation and credentials loaded from an approved secret manager instead.
FIX-002
Low
Referenced helper scripts are not packaged with the skill

Either include the referenced scripts or clearly label them as external examples that users must provide in their own environment.
FIX-003
Low
Security-sensitive examples can be mistaken for executable attack content

Keep examples clearly labeled as defensive Sigma patterns and avoid unnecessary executable-looking snippets in reference material.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (11)

Critical

assets/rule-templates/credential-access.yml:71

Windows Credential Manager

# - '\vaultcmd.exe'

Force-confirmed sensitive/critical static finding; AI dismissal overridden.

Critical

assets/rule-templates/credential-access.yml:72

Windows Credential Manager

# - '\cmdkey.exe'

Force-confirmed sensitive/critical static finding; AI dismissal overridden.

Critical

assets/rule-templates/credential-access.yml:50

Windows SAM/registry hive access

# - 'HKLM\SAM'

Force-confirmed sensitive/critical static finding; AI dismissal overridden.

Critical

references/mitre-attack-mapping.md:312

Ransomware keywords

**Description**: Ransomware encryption activity

Force-confirmed blocker/critical static finding; AI dismissal overridden.

Critical

multiple:1

[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access

This combination is common in credential stealers and RATs

Force-confirmed obfuscation/critical static finding; AI dismissal overridden.

Critical

multiple:1

[HEURISTIC] DANGEROUS COMBINATION: Network + Credentials + Evasion techniques

This combination suggests data exfiltration with anti-detection

Force-confirmed obfuscation/critical static finding; AI dismissal overridden.

High

references/mitre-attack-mapping.md:320

Ransomware file extensions

- '.encrypted'