Versioned security assessment

Report ID: SA-512E3B5E

7/5/2026, 2:48:00 AM

forensics-osquery security assessment v8

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
forensics-osquery
Version
v8
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/forensics-osquery
Coverage
10 Files scanned · 2,870 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

AI review adjudicated all 286 static alerts as false positives caused by osquery detection strings, query filters, and Markdown examples. No evidence found of prompt injection, automatic malware execution, or data exfiltration intent. The skill remains sensitive because authorized osquery workflows can collect privileged endpoint evidence.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

10 Files scanned · 2,870 Lines analyzed

1 item shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 4 evidence locations

Network access

May connect to external services.

Observed in 29 evidence locations

Filesystem access

May read or write local files.

Observed in 29 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 84 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:292-294
Sensitive Forensic Data Collection Requires Controls
The skill explicitly notes that osquery can access password hashes, private keys, and process memory. This is legitimate for DFIR but requires strict authorization, encryption, and access logging.
The security considerations directly describe sensitive data access and privileged use. The surrounding content frames it as authorized incident response, so this is governance risk rather than malicious intent.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Sensitive endpoint evidence can be exposed in query results.
    Keep authorization, encryption, sanitization, and access logging guidance near every pack usage workflow.
  2. FIX-002
    Medium
    Credential-access queries can produce sensitive metadata.
    Document expected outputs and require review before sharing raw exports outside the response team.
  3. FIX-003
    Low
    Broad scheduled queries can create operational noise.
    Recommend lab testing, result limits, and environment-specific allowlists before fleet deployment.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (32)
Critical
assets/forensic-packs/credential-access.conf:86
SSH directory access
"query": "SELECT path, filename, mode, uid, gid FROM file WHERE filename LIKE 'id_%' AND path LIKE '
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:92
Windows Credential Manager
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%Get-Credential%' OR cmdline
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:57
Windows DPAPI access
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%dpapi%' OR cmdline LIKE '%Cr
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:59
Windows DPAPI access
"description": "Windows DPAPI credential access",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:19
Windows SAM/registry hive access
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:19
System password file access
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:24
System password file access
"query": "SELECT pid, name, cmdline FROM processes WHERE cmdline LIKE '%/etc/shadow%' AND name NOT I
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:26
System password file access
"description": "Unauthorized /etc/shadow access",
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/credential-access.conf:80
Sudoers file access
"query": "SELECT path, mtime, ctime FROM file WHERE path IN ('/etc/sudoers', '/etc/sudoers.d') OR pa
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/lateral-movement.conf:54
SSH directory access
"query": "SELECT path, filename, mtime, size FROM file WHERE path LIKE '/home/%/.ssh/authorized_keys
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
assets/forensic-packs/lateral-movement.conf:60
SSH directory access
"query": "SELECT path, filename, mtime, size FROM file WHERE path LIKE '/home/%/.ssh/known_hosts' OR
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
references/mitre-attack-queries.md:317
System password file access
### T1003.008 - /etc/passwd and /etc/shadow
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
references/mitre-attack-queries.md:326
System password file access
WHERE pm.path IN ('/etc/shadow', '/etc/passwd', '/etc/master.passwd')
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:350
Ransomware keywords
### Scenario 2: Ransomware Investigation
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:352
Ransomware keywords
Identify ransomware indicators:
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:363
Ransom message keywords
-- Look for ransom note files
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:365
Ransom message keywords
WHERE filename LIKE '%DECRYPT%' OR filename LIKE '%README%' OR filename LIKE '%RANSOM%';
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:119
System password file access
OR (pm.path = '/etc/shadow' OR pm.path LIKE '%SAM%');
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:390
Sudoers file access
SELECT * FROM file WHERE path = '/etc/sudoers' AND mtime > (strftime('%s', 'now') - 86400);
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
assets/forensic-packs/lateral-movement.conf:100
Network scanning tools
"query": "SELECT pid, name, path, cmdline FROM processes WHERE name IN ('nmap', 'masscan', 'nc', 'ne
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
assets/forensic-packs/persistence-hunt.conf:37
macOS launch agent/daemon
"query": "SELECT * FROM launchd WHERE run_at_load = 1 AND (path LIKE '%/tmp/%' OR path LIKE '%/Users
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-queries.md:500
C2 keywords
### T1041 - Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-queries.md:229
macOS launch agent/daemon
OR path LIKE '%/Users/%/Library/LaunchAgents/%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-queries.md:265
Secure file deletion
OR cmdline LIKE '%shred%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-queries.md:411
Network scanning tools
WHERE cmdline LIKE '%nmap%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-queries.md:412
Network scanning tools
OR cmdline LIKE '%masscan%'
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-queries.md:415
Network scanning tools
OR name IN ('nmap', 'masscan', 'nc', 'netcat');
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/osqueryd-deployment.md:127
Malware type keywords
"ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/osqueryd-deployment.md:429
Systemd service enablement
sudo systemctl enable osqueryd
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/osqueryd-deployment.md:442
macOS launch agent/daemon
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/osqueryd-deployment.md:445
macOS launch agent/daemon
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
SKILL.md:369
Ransomware file extensions
WHERE filename LIKE '%.locked' OR filename LIKE '%.encrypted' OR filename LIKE '%.crypto';
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable