📦
Audit History
forensics-osquery - 10 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v10 Latest | Jul 23, 2026, 05:48 AM | 27 confirmed | 15 | No capability change |
| v9 | Jul 7, 2026, 08:48 PM | 1 confirmed | 0 | No capability change |
| v8 | Jul 5, 2026, 02:48 AM | 1 confirmed | 0 | No capability change |
| v7 | Jul 5, 2026, 02:48 AM | 1 confirmed | 0 | Env variablesContains scripts |
| v6 | Jun 28, 2026, 05:33 AM | No confirmed findings | 2 | No capability change |
| v5 | Jan 16, 2026, 03:40 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 03:40 PM | No confirmed findings | 0 | External commandsFilesystem accessNetwork access |
| v3 | Jan 10, 2026, 10:33 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 10:33 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 10:33 AM | No confirmed findings | 0 | Baseline |
Audit version 10 Latest
Jul 23, 2026, 05:48 AM
The skill is a legitimate defensive osquery guide, and most static hits are false positives from detection SQL, Markdown, loopback addresses, and sensitive-path indicators. Confirmed risks are endpoint telemetry collection, privileged install or service commands, and an unbundled relative script instruction. Additional concerns include ineffective credential-file detection, potential registry secret logging, and unverified privileged package bootstrapping.
11
Files scanned
2,880
Lines analyzed
47
Review items
0
False positives ignored
Confirmed security concerns (27)
High
Systemd service enablement
sudo systemctl enable osqueryd
The documented command enables osqueryd at boot with root privileges, creating a persistent system service that requires explicit approval.
High
macOS launch agent/daemon
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command loads a privileged daemon, creating persistent monitoring behavior that requires explicit approval.
High
macOS launch agent/daemon
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command unloads a privileged daemon and changes endpoint monitoring state, which requires explicit approval.
High
assets/forensic-packs/credential-access.conf:18-21references/mitre-attack-queries.md:317-328SKILL.md:112-120
Ineffective Credential-File Access Detection
The credential-file detector joins process_memory_map and treats mapped paths as file-access evidence. Password files are normally read, not memory-mapped, so the query can miss real access.
All three examples use process_memory_map as a proxy for file reads, which does not generally record ordinary reads of password files.
High
Potential Registry Secret Logging
A scheduled query selects registry data from keys containing Credentials or Password. With result logging enabled, plaintext credential-like values could enter osquery logs.
The query explicitly selects the data column every hour, and the bundled configuration enables filesystem result logging.
High
Unverified Privileged Package Bootstrap
The deployment guide imports repository trust material and installs packages as root without a documented fingerprint, checksum, or pinned-version verification step.
The commands fetch trust material over the network and immediately use privileged package tooling without an independent integrity check.
Medium
Unbundled Relative Script Execution
The workflow instructs users to execute ./scripts/osquery_triage.sh, but the reported package contains no scripts directory. A same-named local file could be executed unintentionally.
The command and script claims are explicit, while the code-filled file structure lists no scripts directory or script files.
Medium
Copyable Placeholder Database Password
The FleetDM example includes a fixed fleet_password value without an adjacent instruction to replace it, increasing the chance of an insecure copied configuration.
The password is visibly a placeholder, but the example gives no local replacement or secret-management requirement.
Low
System reconnaissance
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT pid, name, cmdline, uid FROM processes WHERE name = 'sudo' AND cmdline NOT LIKE '%-
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT path, filename, mode, uid, gid FROM file WHERE filename LIKE 'id_%' AND path LIKE '
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.local_address, ps.local_port, ps.remote_addres
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path, p.cmdline FROM listening_
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT path, filename, size, mtime, uid, gid FROM file WHERE (path LIKE '/etc/%' OR path L
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT u.username, g.groupname FROM users u JOIN user_groups ug ON u.uid = ug.uid JOIN gro
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT p.pid, p.name, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM processe
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT pid, name, cmdline, remote_address FROM process_open_sockets ps JOIN processes p ON
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"host_identifier": "hostname",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT hostname, cpu_brand, physical_memory, hardware_model FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.protocol, p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path FROM listening_ports lp LE
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
System reconnaissance
"SELECT uuid AS host_uuid FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $OSQUERY_KEY
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo apt update
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo apt install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
curl -L https://pkg.osquery.io/rpm/GPG | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo yum-config-manager --add-repo https://pkg.osquery.io/rpm/osquery-s3-rpm.repo
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo yum install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo systemctl start osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo systemctl enable osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
sudo osqueryd --verbose --config_path=/etc/osquery/osquery.conf
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
sudo privilege escalation
- Run osqueryi with sudo/admin privileges: `sudo osqueryi`
The instruction launches an interactive osquery shell with root privileges, exposing sensitive tables and requiring explicit authorization.
Medium
Hardcoded IP address
address: 0.0.0.0:8080
The Fleet example binds the server to 0.0.0.0:8080, exposing it on every network interface unless firewall and access controls restrict it.
Medium
Shell command substitution
**Execute triage**: `./scripts/osquery_triage.sh > incident_triage_$(date +%Y%m%d_%H%M%S).json`
The command executes a relative triage script with shell substitution, but the referenced scripts directory is not bundled and could resolve to an unintended local file.
Risk Factors
⚙️ External commands (50)
assets/forensic-packs/credential-access.conf:91 assets/forensic-packs/credential-access.conf:94 assets/forensic-packs/persistence-hunt.conf:67 references/mitre-attack-queries.md:42 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:51 references/mitre-attack-queries.md:53 references/mitre-attack-queries.md:58 references/mitre-attack-queries.md:118 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:71 references/mitre-attack-queries.md:76 references/mitre-attack-queries.md:195 references/osqueryd-deployment.md:65 references/osqueryd-deployment.md:69 references/osqueryd-deployment.md:453 references/osqueryd-deployment.md:30 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:36 references/osqueryd-deployment.md:37 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:50 references/osqueryd-deployment.md:426 references/osqueryd-deployment.md:429 references/osqueryd-deployment.md:432 references/osqueryd-deployment.md:435 references/osqueryd-deployment.md:442 references/osqueryd-deployment.md:445 references/osqueryd-deployment.md:448 references/osqueryd-deployment.md:485 SKILL.md:45-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-95 SKILL.md:95-112 SKILL.md:112-120 SKILL.md:120-137 SKILL.md:137-149 SKILL.md:149-152 SKILL.md:152-164 SKILL.md:164-176 SKILL.md:176-193 SKILL.md:193-206 SKILL.md:206-224 SKILL.md:224-239 SKILL.md:239-253 SKILL.md:253-259 SKILL.md:259-271 SKILL.md:271-277
📁 Filesystem access (29)
assets/forensic-packs/credential-access.conf:86 assets/forensic-packs/ir-triage.conf:64 assets/forensic-packs/lateral-movement.conf:54 assets/forensic-packs/lateral-movement.conf:60 assets/forensic-packs/persistence-hunt.conf:97 assets/forensic-packs/persistence-hunt.conf:13 assets/forensic-packs/persistence-hunt.conf:37 assets/forensic-packs/persistence-hunt.conf:55 assets/forensic-packs/persistence-hunt.conf:67 assets/osquery.conf:48 references/mitre-attack-queries.md:217 references/mitre-attack-queries.md:297 references/mitre-attack-queries.md:110 references/mitre-attack-queries.md:135 references/mitre-attack-queries.md:175 references/mitre-attack-queries.md:176 references/mitre-attack-queries.md:214 references/mitre-attack-queries.md:215 references/mitre-attack-queries.md:228 references/mitre-attack-queries.md:295 references/mitre-attack-queries.md:296 references/osqueryd-deployment.md:152 references/osqueryd-deployment.md:250 references/table-guide.md:162 references/table-guide.md:163 references/table-guide.md:310 SKILL.md:148 SKILL.md:210 SKILL.md:216
🔑 Env variables (1)
🌐 Network access (29)
assets/forensic-packs/ir-triage.conf:39 assets/forensic-packs/ir-triage.conf:44 assets/forensic-packs/lateral-movement.conf:43 assets/osquery.conf:53 assets/osquery.conf:58 references/mitre-attack-queries.md:509 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:60 references/osqueryd-deployment.md:67 references/osqueryd-deployment.md:119 references/osqueryd-deployment.md:191 references/osqueryd-deployment.md:319 references/osqueryd-deployment.md:325 references/osqueryd-deployment.md:328 references/table-guide.md:47 references/table-guide.md:91 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:488 SKILL.md:489 SKILL.md:490 SKILL.md:491 SKILL.md:492 SKILL.md:56 SKILL.md:181 SKILL.md:188
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystemd service enablementmacOS launch agent/daemonmacOS launch agent/daemon
Audited by: codex
Jul 7, 2026, 08:48 PM
I found no prompt injection or hidden automation in the reviewed files. Most static findings are defensive osquery queries, Markdown examples, or administrator deployment guidance. The main remaining risk is that authorized osquery use can expose sensitive endpoint data.
11
Files scanned
2,880
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Privileged Forensic Data Collection
The skill states that osquery can access password hashes, private keys, and process memory. This is legitimate DFIR context, but outputs need strict authorization, storage, and redaction controls.
The security considerations section explicitly names sensitive data types and root or administrator access. This confirms a real operational data exposure risk even though the content is defensive.
Risk Factors
⚙️ External commands (87)
assets/forensic-packs/credential-access.conf:91 assets/forensic-packs/credential-access.conf:94 assets/forensic-packs/persistence-hunt.conf:67 references/mitre-attack-queries.md:42 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:51 references/mitre-attack-queries.md:53 references/mitre-attack-queries.md:58 references/mitre-attack-queries.md:118 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:71 references/mitre-attack-queries.md:76 references/mitre-attack-queries.md:195 references/osqueryd-deployment.md:65 references/osqueryd-deployment.md:69 references/osqueryd-deployment.md:453 references/osqueryd-deployment.md:30 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:36 references/osqueryd-deployment.md:37 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:50 references/osqueryd-deployment.md:426 references/osqueryd-deployment.md:429 references/osqueryd-deployment.md:432 references/osqueryd-deployment.md:435 references/osqueryd-deployment.md:442 references/osqueryd-deployment.md:445 references/osqueryd-deployment.md:448 references/osqueryd-deployment.md:485 SKILL.md:45-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-95 SKILL.md:95-112 SKILL.md:112-120 SKILL.md:120-137 SKILL.md:137-149 SKILL.md:149-152 SKILL.md:152-164 SKILL.md:164-176 SKILL.md:176-193 SKILL.md:193-206 SKILL.md:206-224 SKILL.md:224-239 SKILL.md:239-253 SKILL.md:253-259 SKILL.md:259-271 SKILL.md:271-277 SKILL.md:277-288 SKILL.md:288-296 SKILL.md:296-300 SKILL.md:300 SKILL.md:306-307 SKILL.md:307-308 SKILL.md:308-309 SKILL.md:309-313 SKILL.md:313-314 SKILL.md:314-315 SKILL.md:315-316 SKILL.md:316-320 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:325-333 SKILL.md:333-348 SKILL.md:348-354 SKILL.md:354-370 SKILL.md:370-376 SKILL.md:376-391 SKILL.md:391-405 SKILL.md:405-413 SKILL.md:413-436 SKILL.md:436-437 SKILL.md:437-448 SKILL.md:448-453 SKILL.md:453-463 SKILL.md:463 SKILL.md:95 SKILL.md:95 SKILL.md:340 SKILL.md:340 SKILL.md:453 SKILL.md:476
📁 Filesystem access (29)
assets/forensic-packs/credential-access.conf:86 assets/forensic-packs/ir-triage.conf:64 assets/forensic-packs/lateral-movement.conf:54 assets/forensic-packs/lateral-movement.conf:60 assets/forensic-packs/persistence-hunt.conf:97 assets/forensic-packs/persistence-hunt.conf:13 assets/forensic-packs/persistence-hunt.conf:37 assets/forensic-packs/persistence-hunt.conf:55 assets/forensic-packs/persistence-hunt.conf:67 assets/osquery.conf:48 references/mitre-attack-queries.md:217 references/mitre-attack-queries.md:297 references/mitre-attack-queries.md:110 references/mitre-attack-queries.md:135 references/mitre-attack-queries.md:175 references/mitre-attack-queries.md:176 references/mitre-attack-queries.md:214 references/mitre-attack-queries.md:215 references/mitre-attack-queries.md:228 references/mitre-attack-queries.md:295 references/mitre-attack-queries.md:296 references/osqueryd-deployment.md:152 references/osqueryd-deployment.md:250 references/table-guide.md:162 references/table-guide.md:163 references/table-guide.md:310 SKILL.md:148 SKILL.md:210 SKILL.md:216
🔑 Env variables (1)
🌐 Network access (29)
assets/forensic-packs/ir-triage.conf:39 assets/forensic-packs/ir-triage.conf:44 assets/forensic-packs/lateral-movement.conf:43 assets/osquery.conf:53 assets/osquery.conf:58 references/mitre-attack-queries.md:509 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:60 references/osqueryd-deployment.md:67 references/osqueryd-deployment.md:119 references/osqueryd-deployment.md:191 references/osqueryd-deployment.md:319 references/osqueryd-deployment.md:325 references/osqueryd-deployment.md:328 references/table-guide.md:47 references/table-guide.md:91 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:488 SKILL.md:489 SKILL.md:490 SKILL.md:491 SKILL.md:492 SKILL.md:56 SKILL.md:181 SKILL.md:188
Audited by: codex
Jul 5, 2026, 02:48 AM
AI review adjudicated all 286 static alerts as false positives caused by osquery detection strings, query filters, and Markdown examples. No evidence found of prompt injection, automatic malware execution, or data exfiltration intent. The skill remains sensitive because authorized osquery workflows can collect privileged endpoint evidence.
10
Files scanned
2,870
Lines analyzed
6
Review items
32
False positives ignored
Confirmed security concerns (1)
Medium
Sensitive Forensic Data Collection Requires Controls
The skill explicitly notes that osquery can access password hashes, private keys, and process memory. This is legitimate for DFIR but requires strict authorization, encryption, and access logging.
The security considerations directly describe sensitive data access and privileged use. The surrounding content frames it as authorized incident response, so this is governance risk rather than malicious intent.
Static false positives ignored (32)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Critical
SSH directory access
"query": "SELECT path, filename, mode, uid, gid FROM file WHERE filename LIKE 'id_%' AND path LIKE '
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows Credential Manager
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%Get-Credential%' OR cmdline
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows DPAPI access
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%dpapi%' OR cmdline LIKE '%Cr
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows DPAPI access
"description": "Windows DPAPI credential access",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows SAM/registry hive access
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
System password file access
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%/etc/shadow%' AND name NOT I
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
"description": "Unauthorized /etc/shadow access",
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Sudoers file access
"query": "SELECT path, mtime, ctime FROM file WHERE path IN ('/etc/sudoers', '/etc/sudoers.d') OR pa
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SSH directory access
"query": "SELECT path, filename, mtime, size FROM file WHERE path LIKE '/home/%/.ssh/authorized_keys
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
SSH directory access
"query": "SELECT path, filename, mtime, size FROM file WHERE path LIKE '/home/%/.ssh/known_hosts' OR
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
System password file access
### T1003.008 - /etc/passwd and /etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
WHERE pm.path IN ('/etc/shadow', '/etc/passwd', '/etc/master.passwd')
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransomware keywords
### Scenario 2: Ransomware Investigation
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransomware keywords
Identify ransomware indicators:
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransom message keywords
-- Look for ransom note files
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransom message keywords
WHERE filename LIKE '%DECRYPT%' OR filename LIKE '%README%' OR filename LIKE '%RANSOM%';
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
OR (pm.path = '/etc/shadow' OR pm.path LIKE '%SAM%');
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Sudoers file access
SELECT * FROM file WHERE path = '/etc/sudoers' AND mtime > (strftime('%s', 'now') - 86400);
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
Network scanning tools
"query": "SELECT pid, name, path, cmdline FROM processes WHERE name IN ('nmap', 'masscan', 'nc', 'ne
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
"query": "SELECT * FROM launchd WHERE run_at_load = 1 AND (path LIKE '%/tmp/%' OR path LIKE '%/Users
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
C2 keywords
### T1041 - Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
OR path LIKE '%/Users/%/Library/LaunchAgents/%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Secure file deletion
OR cmdline LIKE '%shred%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
WHERE cmdline LIKE '%nmap%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
OR cmdline LIKE '%masscan%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
OR name IN ('nmap', 'masscan', 'nc', 'netcat');
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
"ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Systemd service enablement
sudo systemctl enable osqueryd
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Ransomware file extensions
WHERE filename LIKE '%.locked' OR filename LIKE '%.encrypted' OR filename LIKE '%.crypto';
Force-confirmed blocker/high static finding; AI dismissal overridden.
Risk Factors
⚙️ External commands (87)
assets/forensic-packs/credential-access.conf:91 assets/forensic-packs/credential-access.conf:94 assets/forensic-packs/persistence-hunt.conf:67 references/mitre-attack-queries.md:42 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:51 references/mitre-attack-queries.md:53 references/mitre-attack-queries.md:58 references/mitre-attack-queries.md:118 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:71 references/mitre-attack-queries.md:76 references/mitre-attack-queries.md:195 references/osqueryd-deployment.md:65 references/osqueryd-deployment.md:69 references/osqueryd-deployment.md:453 references/osqueryd-deployment.md:30 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:36 references/osqueryd-deployment.md:37 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:50 references/osqueryd-deployment.md:426 references/osqueryd-deployment.md:429 references/osqueryd-deployment.md:432 references/osqueryd-deployment.md:435 references/osqueryd-deployment.md:442 references/osqueryd-deployment.md:445 references/osqueryd-deployment.md:448 references/osqueryd-deployment.md:485 SKILL.md:45-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-95 SKILL.md:95-112 SKILL.md:112-120 SKILL.md:120-137 SKILL.md:137-149 SKILL.md:149-152 SKILL.md:152-164 SKILL.md:164-176 SKILL.md:176-193 SKILL.md:193-206 SKILL.md:206-224 SKILL.md:224-239 SKILL.md:239-253 SKILL.md:253-259 SKILL.md:259-271 SKILL.md:271-277 SKILL.md:277-288 SKILL.md:288-296 SKILL.md:296-300 SKILL.md:300 SKILL.md:306-307 SKILL.md:307-308 SKILL.md:308-309 SKILL.md:309-313 SKILL.md:313-314 SKILL.md:314-315 SKILL.md:315-316 SKILL.md:316-320 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:325-333 SKILL.md:333-348 SKILL.md:348-354 SKILL.md:354-370 SKILL.md:370-376 SKILL.md:376-391 SKILL.md:391-405 SKILL.md:405-413 SKILL.md:413-436 SKILL.md:436-437 SKILL.md:437-448 SKILL.md:448-453 SKILL.md:453-463 SKILL.md:463 SKILL.md:95 SKILL.md:95 SKILL.md:340 SKILL.md:340 SKILL.md:453 SKILL.md:476
📁 Filesystem access (29)
assets/forensic-packs/credential-access.conf:86 assets/forensic-packs/ir-triage.conf:64 assets/forensic-packs/lateral-movement.conf:54 assets/forensic-packs/lateral-movement.conf:60 assets/forensic-packs/persistence-hunt.conf:97 assets/forensic-packs/persistence-hunt.conf:13 assets/forensic-packs/persistence-hunt.conf:37 assets/forensic-packs/persistence-hunt.conf:55 assets/forensic-packs/persistence-hunt.conf:67 assets/osquery.conf:48 references/mitre-attack-queries.md:217 references/mitre-attack-queries.md:297 references/mitre-attack-queries.md:110 references/mitre-attack-queries.md:135 references/mitre-attack-queries.md:175 references/mitre-attack-queries.md:176 references/mitre-attack-queries.md:214 references/mitre-attack-queries.md:215 references/mitre-attack-queries.md:228 references/mitre-attack-queries.md:295 references/mitre-attack-queries.md:296 references/osqueryd-deployment.md:152 references/osqueryd-deployment.md:250 references/table-guide.md:162 references/table-guide.md:163 references/table-guide.md:310 SKILL.md:148 SKILL.md:210 SKILL.md:216
🔑 Env variables (1)
🌐 Network access (29)
assets/forensic-packs/ir-triage.conf:39 assets/forensic-packs/ir-triage.conf:44 assets/forensic-packs/lateral-movement.conf:43 assets/osquery.conf:53 assets/osquery.conf:58 references/mitre-attack-queries.md:509 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:60 references/osqueryd-deployment.md:67 references/osqueryd-deployment.md:119 references/osqueryd-deployment.md:191 references/osqueryd-deployment.md:319 references/osqueryd-deployment.md:325 references/osqueryd-deployment.md:328 references/table-guide.md:47 references/table-guide.md:91 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:488 SKILL.md:489 SKILL.md:490 SKILL.md:491 SKILL.md:492 SKILL.md:56 SKILL.md:181 SKILL.md:188
Audited by: codex
Jul 5, 2026, 02:48 AM
AI review adjudicated all 286 static alerts as false positives caused by osquery detection strings, query filters, and Markdown examples. No evidence found of prompt injection, automatic malware execution, or data exfiltration intent. The skill remains sensitive because authorized osquery workflows can collect privileged endpoint evidence.
10
Files scanned
2,870
Lines analyzed
6
Review items
32
False positives ignored
Confirmed security concerns (1)
Medium
Sensitive Forensic Data Collection Requires Controls
The skill explicitly notes that osquery can access password hashes, private keys, and process memory. This is legitimate for DFIR but requires strict authorization, encryption, and access logging.
The security considerations directly describe sensitive data access and privileged use. The surrounding content frames it as authorized incident response, so this is governance risk rather than malicious intent.
Static false positives ignored (32)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Critical
SSH directory access
"query": "SELECT path, filename, mode, uid, gid FROM file WHERE filename LIKE 'id_%' AND path LIKE '
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows Credential Manager
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%Get-Credential%' OR cmdline
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows DPAPI access
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%dpapi%' OR cmdline LIKE '%Cr
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows DPAPI access
"description": "Windows DPAPI credential access",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows SAM/registry hive access
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
System password file access
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%/etc/shadow%' AND name NOT I
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
"description": "Unauthorized /etc/shadow access",
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Sudoers file access
"query": "SELECT path, mtime, ctime FROM file WHERE path IN ('/etc/sudoers', '/etc/sudoers.d') OR pa
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SSH directory access
"query": "SELECT path, filename, mtime, size FROM file WHERE path LIKE '/home/%/.ssh/authorized_keys
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
SSH directory access
"query": "SELECT path, filename, mtime, size FROM file WHERE path LIKE '/home/%/.ssh/known_hosts' OR
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
System password file access
### T1003.008 - /etc/passwd and /etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
WHERE pm.path IN ('/etc/shadow', '/etc/passwd', '/etc/master.passwd')
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransomware keywords
### Scenario 2: Ransomware Investigation
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransomware keywords
Identify ransomware indicators:
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransom message keywords
-- Look for ransom note files
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransom message keywords
WHERE filename LIKE '%DECRYPT%' OR filename LIKE '%README%' OR filename LIKE '%RANSOM%';
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
System password file access
OR (pm.path = '/etc/shadow' OR pm.path LIKE '%SAM%');
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Sudoers file access
SELECT * FROM file WHERE path = '/etc/sudoers' AND mtime > (strftime('%s', 'now') - 86400);
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
Network scanning tools
"query": "SELECT pid, name, path, cmdline FROM processes WHERE name IN ('nmap', 'masscan', 'nc', 'ne
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
"query": "SELECT * FROM launchd WHERE run_at_load = 1 AND (path LIKE '%/tmp/%' OR path LIKE '%/Users
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
C2 keywords
### T1041 - Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
OR path LIKE '%/Users/%/Library/LaunchAgents/%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Secure file deletion
OR cmdline LIKE '%shred%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
WHERE cmdline LIKE '%nmap%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
OR cmdline LIKE '%masscan%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
OR name IN ('nmap', 'masscan', 'nc', 'netcat');
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
"ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Systemd service enablement
sudo systemctl enable osqueryd
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
macOS launch agent/daemon
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Ransomware file extensions
WHERE filename LIKE '%.locked' OR filename LIKE '%.encrypted' OR filename LIKE '%.crypto';
Force-confirmed blocker/high static finding; AI dismissal overridden.
Risk Factors
⚙️ External commands (87)
assets/forensic-packs/credential-access.conf:91 assets/forensic-packs/credential-access.conf:94 assets/forensic-packs/persistence-hunt.conf:67 references/mitre-attack-queries.md:42 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:51 references/mitre-attack-queries.md:53 references/mitre-attack-queries.md:58 references/mitre-attack-queries.md:118 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:71 references/mitre-attack-queries.md:76 references/mitre-attack-queries.md:195 references/osqueryd-deployment.md:65 references/osqueryd-deployment.md:69 references/osqueryd-deployment.md:453 references/osqueryd-deployment.md:30 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:36 references/osqueryd-deployment.md:37 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:50 references/osqueryd-deployment.md:426 references/osqueryd-deployment.md:429 references/osqueryd-deployment.md:432 references/osqueryd-deployment.md:435 references/osqueryd-deployment.md:442 references/osqueryd-deployment.md:445 references/osqueryd-deployment.md:448 references/osqueryd-deployment.md:485 SKILL.md:45-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-95 SKILL.md:95-112 SKILL.md:112-120 SKILL.md:120-137 SKILL.md:137-149 SKILL.md:149-152 SKILL.md:152-164 SKILL.md:164-176 SKILL.md:176-193 SKILL.md:193-206 SKILL.md:206-224 SKILL.md:224-239 SKILL.md:239-253 SKILL.md:253-259 SKILL.md:259-271 SKILL.md:271-277 SKILL.md:277-288 SKILL.md:288-296 SKILL.md:296-300 SKILL.md:300 SKILL.md:306-307 SKILL.md:307-308 SKILL.md:308-309 SKILL.md:309-313 SKILL.md:313-314 SKILL.md:314-315 SKILL.md:315-316 SKILL.md:316-320 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:325-333 SKILL.md:333-348 SKILL.md:348-354 SKILL.md:354-370 SKILL.md:370-376 SKILL.md:376-391 SKILL.md:391-405 SKILL.md:405-413 SKILL.md:413-436 SKILL.md:436-437 SKILL.md:437-448 SKILL.md:448-453 SKILL.md:453-463 SKILL.md:463 SKILL.md:95 SKILL.md:95 SKILL.md:340 SKILL.md:340 SKILL.md:453 SKILL.md:476
📁 Filesystem access (29)
assets/forensic-packs/credential-access.conf:86 assets/forensic-packs/ir-triage.conf:64 assets/forensic-packs/lateral-movement.conf:54 assets/forensic-packs/lateral-movement.conf:60 assets/forensic-packs/persistence-hunt.conf:97 assets/forensic-packs/persistence-hunt.conf:13 assets/forensic-packs/persistence-hunt.conf:37 assets/forensic-packs/persistence-hunt.conf:55 assets/forensic-packs/persistence-hunt.conf:67 assets/osquery.conf:48 references/mitre-attack-queries.md:217 references/mitre-attack-queries.md:297 references/mitre-attack-queries.md:110 references/mitre-attack-queries.md:135 references/mitre-attack-queries.md:175 references/mitre-attack-queries.md:176 references/mitre-attack-queries.md:214 references/mitre-attack-queries.md:215 references/mitre-attack-queries.md:228 references/mitre-attack-queries.md:295 references/mitre-attack-queries.md:296 references/osqueryd-deployment.md:152 references/osqueryd-deployment.md:250 references/table-guide.md:162 references/table-guide.md:163 references/table-guide.md:310 SKILL.md:148 SKILL.md:210 SKILL.md:216
🔑 Env variables (1)
🌐 Network access (29)
assets/forensic-packs/ir-triage.conf:39 assets/forensic-packs/ir-triage.conf:44 assets/forensic-packs/lateral-movement.conf:43 assets/osquery.conf:53 assets/osquery.conf:58 references/mitre-attack-queries.md:509 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:60 references/osqueryd-deployment.md:67 references/osqueryd-deployment.md:119 references/osqueryd-deployment.md:191 references/osqueryd-deployment.md:319 references/osqueryd-deployment.md:325 references/osqueryd-deployment.md:328 references/table-guide.md:47 references/table-guide.md:91 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:488 SKILL.md:489 SKILL.md:490 SKILL.md:491 SKILL.md:492 SKILL.md:56 SKILL.md:181 SKILL.md:188
Audited by: codex
Jun 28, 2026, 05:33 AM
Static analysis found many command, credential, filesystem, and network indicators, but review shows they are mostly osquery detection queries and defensive documentation. The skill is not malicious, but it can guide privileged endpoint collection that exposes sensitive files, process details, registry data, and network activity, so users need clear operational controls.
10
Files scanned
2,870
Lines analyzed
5
Review items
3
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
SKILL.md:292-294assets/forensic-packs/credential-access.conf:18-24assets/forensic-packs/credential-access.conf:40-46assets/forensic-packs/credential-access.conf:85-99
Privileged Forensic Queries Can Expose Sensitive Data
TRUE_POSITIVE: The skill explicitly documents that osquery can access sensitive system information, including password hashes, private keys, and process memory. The credential-access pack also queries password files, credential-related filenames, browser credential access indicators, SSH key locations, and registry credential storage. This is appropriate for incident response, but results require strict authorization, storage protection, and sharing controls.
The sensitive data access is documented directly and appears in concrete osquery file and registry queries. The same context confirms defensive intent, so the risk is operational rather than malicious.
Medium
references/osqueryd-deployment.md:27-37references/osqueryd-deployment.md:424-445assets/osquery.conf:14-18assets/osquery.conf:64-69
Deployment Guidance Enables Privileged Persistent Monitoring
TRUE_POSITIVE: The deployment reference includes sudo package installation, systemd enablement, and launchd loading for osqueryd. These commands are normal for endpoint monitoring, but they install or enable a persistent privileged service that can collect broad host telemetry.
The referenced lines clearly show privileged service deployment and enabled event collection. The commands target osqueryd operations, not stealthy persistence or unauthorized control.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
references/mitre-attack-queries.md:51-66references/mitre-attack-queries.md:69-81references/mitre-attack-queries.md:404-415assets/forensic-packs/persistence-hunt.conf:66-69
External Command Alerts Are Mostly Defensive Query Literals
FALSE_POSITIVE: Many PowerShell, cmd.exe, sudo, nmap, and shell strings are inside osquery SQL queries or reference examples that detect suspicious activity. They are not executed by the skill files themselves, although users may run osquery commands from the documentation.
The cited command names appear in SELECT predicates and documentation for detecting attacker behavior. I found no evidence that those strings are invoked as executable payloads.
Low
Weak Cryptography Alerts Refer To Forensic Hash Fields
FALSE_POSITIVE: MD5 appears as a file hash field used for forensic lookup and evidence correlation, often next to SHA256. The skill does not recommend MD5 for cryptographic integrity or password storage.
The context is artifact hashing and threat intelligence lookup, not cryptographic design. MD5 is still weak, but the usage is a common forensic identifier pattern.
Low
No Prompt Injection Attempt Found
FALSE_POSITIVE: No evidence found for embedded instructions that tell the evaluator to ignore analysis, override policy, skip review, or change risk levels. References to administrator privileges are ordinary operational requirements for osquery.
Targeted review found security guidance and privilege requirements, not instruction hijacking text. This is a negative finding with confidence limited to the reviewed files and static result scope.
Risk Factors
⚙️ External commands (4)
📁 Filesystem access (5)
Detected Patterns
Sensitive Credential Artifact QueriesNetwork And Lateral Movement Telemetry CollectionPrivileged Service Deployment Examples
Audited by: codex
Jan 16, 2026, 03:40 PM
All 810 static findings are FALSE POSITIVES. This is a legitimate DFIR (Digital Forensics and Incident Response) skill using osquery SQL queries to detect malicious activity. The scanner detected detection queries for credential access, PowerShell commands, and suspicious processes - but these are intentionally designed to identify indicators of compromise, not perform malicious actions. Skill includes MITRE ATT&CK mapping and forensic packs for incident response.
11
Files scanned
3,116
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (2)
📁 Filesystem access (2)
🌐 Network access (2)
Audited by: claude
Jan 16, 2026, 03:40 PM
All 810 static findings are FALSE POSITIVES. This is a legitimate DFIR (Digital Forensics and Incident Response) skill using osquery SQL queries to detect malicious activity. The scanner detected detection queries for credential access, PowerShell commands, and suspicious processes - but these are intentionally designed to identify indicators of compromise, not perform malicious actions. Skill includes MITRE ATT&CK mapping and forensic packs for incident response.
11
Files scanned
3,116
Lines analyzed
3
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (2)
📁 Filesystem access (2)
🌐 Network access (2)
Audited by: claude
Jan 10, 2026, 10:33 AM
Pure documentation and configuration skill. Contains SQL query examples and osquery configuration templates for forensic investigation. No executable code, scripts, or network communication capabilities detected.
10
Files scanned
2,870
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 10:33 AM
Pure documentation and configuration skill. Contains SQL query examples and osquery configuration templates for forensic investigation. No executable code, scripts, or network communication capabilities detected.
10
Files scanned
2,870
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 10:33 AM
Pure documentation and configuration skill. Contains SQL query examples and osquery configuration templates for forensic investigation. No executable code, scripts, or network communication capabilities detected.
10
Files scanned
2,870
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude