📦
Audit History
ir-velociraptor - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 23, 2026, 06:05 AM | 8 confirmed | 34 | No capability change |
| v8 | Jul 7, 2026, 08:59 PM | 5 confirmed | 32 | No capability change |
| v7 | Jul 6, 2026, 12:42 AM | 5 confirmed | 33 | No capability change |
| v6 | Jun 28, 2026, 05:41 AM | 7 confirmed | 0 | No capability change |
| v5 | Jan 16, 2026, 03:43 PM | No confirmed findings | 0 | No capability change |
| v4 | Jan 16, 2026, 03:43 PM | No confirmed findings | 0 | Network accessExternal commandsFilesystem accessEnv variablesContains scripts |
| v3 | Jan 10, 2026, 10:42 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 10, 2026, 10:42 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 10, 2026, 10:42 AM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 23, 2026, 06:05 AM
Most static alerts are documentation syntax, placeholders, or read-only defensive queries. Confirmed risks include remote script execution, privileged deployment, broad network exposure, and sensitive temporary files. CI bypasses and insecure deployment examples require correction before publication.
13
Files scanned
4,899
Lines analyzed
47
Review items
0
False positives ignored
Confirmed security concerns (8)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a mutable remote script and pipes it directly to Bash. A compromised source can execute arbitrary code on the runner.
High
Systemd service enablement
sudo systemctl enable velociraptor
The guide enables a persistent Velociraptor service at system startup. This changes host persistence and expands the impact of a compromised binary or configuration.
High
Systemd service enablement
sudo systemctl enable velociraptor-client
The guide enables a persistent Velociraptor service at system startup. This changes host persistence and expands the impact of a compromised binary or configuration.
High
assets/ci-config-template.yml:54-61assets/ci-config-template.yml:116-128assets/ci-config-template.yml:228-235
Security scan failures are suppressed
The CI template appends success fallbacks to several scanners. Tool failures and some findings can pass without an enforced security gate.
The template visibly uses success fallbacks after Semgrep, Safety, npm audit, and Checkov commands. Several jobs lack a reliable later failure check.
High
Privileged binary installation lacks integrity verification
The deployment guide downloads a Velociraptor executable and moves it into a privileged executable path without verifying a checksum or signature.
The displayed sequence performs wget, chmod, and sudo mv. No integrity verification appears between download and privileged installation.
High
Mutable CI action can execute upstream changes
The CI template runs the Trivy action from its mutable master branch. Future upstream changes can execute in repository workflows without review.
The action reference is explicitly aquasecurity/trivy-action@master. A branch is mutable and does not provide immutable supply-chain pinning.
High
NFS evidence store disables root squashing
The NFS example exports the evidence datastore with no_root_squash. A compromised root client can write files as root on the server.
The export option no_root_squash is explicit on line 385. This removes a standard NFS protection for remote root users.
High
Malware sample handling lacks isolation controls
The ransomware workflow directs analysts to extract binary samples without specifying quarantine, encrypted packaging, or isolated analysis requirements.
The workflow explicitly requests ransomware binary extraction. The surrounding steps do not state containment controls for handling executable malware samples.
Capability review items (34)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Git platform tokens
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow passes GITHUB_TOKEN to a third-party action while the workflow has write permissions. A compromised mutable action could misuse repository access.
High
PowerShell invocation
```powershell
The fenced PowerShell example installs and starts Velociraptor as a persistent Windows service. Following it performs real privileged endpoint modification.
High
sudo privilege escalation
sudo mv velociraptor-v0.72.3-linux-amd64 /usr/local/bin/velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor.service <<'EOF'
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo useradd -r -s /bin/false velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo mkdir -p /etc/velociraptor /var/lib/velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo chown -R velociraptor:velociraptor /etc/velociraptor /var/lib/velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo systemctl daemon-reload
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo systemctl enable velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo systemctl start velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo apt install certbot
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo certbot certonly --standalone \
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
# Install: sudo dpkg -i velociraptor-client.deb
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo cp velociraptor /usr/local/bin/
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo cp client.config.yaml /etc/velociraptor/
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor-client.service <<'EOF'
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo systemctl enable velociraptor-client
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo systemctl start velociraptor-client
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo apt install nfs-kernel-server
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo mkdir -p /export/velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo chown nobody:nogroup /export/velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo mount -t nfs nfs-server:/export/velociraptor /var/lib/velociraptor
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8000 -j ACCEPT
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -s 10.0.0.0/8 -j ACCEPT
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -j DROP
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
High
sudo privilege escalation
sudo iptables-save > /etc/iptables/rules.v4
This deployment instruction uses sudo to change packages, system files, services, mounts, or firewall state. It requires explicit authorization and host-specific review.
Medium
references/deployment-guide.md:117references/deployment-guide.md:122references/deployment-guide.md:132
Hardcoded IP address · 3 occurrences
bind_address: 0.0.0.0
The example binds the API to every interface. Without a separate access control, administrative functions may be reachable from unintended networks.
Medium
Hardcoded IP address
/export/velociraptor 10.0.1.0/24(rw,sync,no_subtree_check,no_root_squash)
The NFS example hardcodes a trusted subnet and combines it with no_root_squash. A compromised client in that range can obtain root-level file access.
Medium
Hardcoded IP address
sudo iptables -A INPUT -p tcp --dport 8889 -s 10.0.0.0/8 -j ACCEPT
The firewall example trusts the entire 10.0.0.0/8 range for GUI access. That range may be much broader than the intended management network.
Medium
Temp directory access
config client > /tmp/client.config.yaml
The guide writes generated client configuration into a shared temporary directory. Weak permissions or local races could expose or replace sensitive configuration.
Low
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The external URL supplies a script that is executed immediately by Bash. Trust in the remote branch and delivery path is security-critical.
Low
Hardcoded URL
wget https://github.com/Velocidex/velociraptor/releases/download/v0.72/velociraptor-v0.72.3-linux-am
The guide downloads an executable for privileged installation without checksum or signature verification. A replaced release artifact could gain root execution.
Risk Factors
🌐 Network access (50)
assets/artifact-template.yaml:126 assets/artifact-template.yaml:127 assets/artifact-template.yaml:132 assets/ci-config-template.yml:240 assets/hunt-template.yaml:138 assets/hunt-template.yaml:138 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 references/artifact-development.md:594 references/artifact-development.md:595 references/artifact-development.md:410 references/artifact-development.md:411 references/deployment-guide.md:77 references/deployment-guide.md:110 references/deployment-guide.md:200 references/deployment-guide.md:325 references/deployment-guide.md:117 references/deployment-guide.md:122 references/deployment-guide.md:126 references/deployment-guide.md:127 references/deployment-guide.md:128 references/deployment-guide.md:132 references/deployment-guide.md:357 references/deployment-guide.md:358 references/deployment-guide.md:359 references/deployment-guide.md:370 references/deployment-guide.md:371 references/deployment-guide.md:372 references/deployment-guide.md:385 references/deployment-guide.md:411 references/mitre-attack-mapping.md:419 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:43 SKILL.md:48 SKILL.md:329 SKILL.md:330
⚙️ External commands (50)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 assets/hunt-template.yaml:36 assets/hunt-template.yaml:115 assets/hunt-template.yaml:183 references/artifact-development.md:105 references/artifact-development.md:509 references/artifact-development.md:512 references/deployment-guide.md:285-290 references/deployment-guide.md:520 references/deployment-guide.md:278 references/deployment-guide.md:515 references/deployment-guide.md:81 references/deployment-guide.md:145 references/deployment-guide.md:173 references/deployment-guide.md:176 references/deployment-guide.md:177 references/deployment-guide.md:180 references/deployment-guide.md:181 references/deployment-guide.md:182 references/deployment-guide.md:215 references/deployment-guide.md:218 references/deployment-guide.md:272 references/deployment-guide.md:295 references/deployment-guide.md:296 references/deployment-guide.md:299 references/deployment-guide.md:315 references/deployment-guide.md:316 references/deployment-guide.md:380 references/deployment-guide.md:381 references/deployment-guide.md:382 references/deployment-guide.md:388 references/deployment-guide.md:408 references/deployment-guide.md:411 references/deployment-guide.md:412 references/deployment-guide.md:415 references/mitre-attack-mapping.md:59 references/mitre-attack-mapping.md:65 references/mitre-attack-mapping.md:68 references/mitre-attack-mapping.md:69 references/mitre-attack-mapping.md:73 references/mitre-attack-mapping.md:77 references/mitre-attack-mapping.md:165 references/mitre-attack-mapping.md:188
📁 Filesystem access (3)
🔑 Env variables (25)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/deployment-guide.md:231 references/deployment-guide.md:236 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternSystemd service enablementSystemd service enablement
Audited by: codex
Jul 7, 2026, 08:59 PM
Most static findings are false positives caused by defensive Velociraptor examples, VQL detection patterns, MITRE terminology, and placeholder configuration. I confirmed risks in the deployment and CI guidance, including remote script execution, privileged service installation, broad network binding, temporary client config handling, webhook secret placement, and insecure NFS guidance. No prompt injection attempt was found in the reviewed files.
13
Files scanned
4,899
Lines analyzed
42
Review items
0
False positives ignored
Confirmed security concerns (5)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The template executes a downloaded shell script with `curl | bash`, which can run arbitrary upstream code in CI. This is a direct supply-chain execution risk.
High
Systemd service enablement
sudo systemctl enable velociraptor
The guide enables Velociraptor server or client services to start at boot. Persistent service installation is legitimate here but security-sensitive and should require explicit approval.
High
Systemd service enablement
sudo systemctl enable velociraptor-client
The guide enables Velociraptor server or client services to start at boot. Persistent service installation is legitimate here but security-sensitive and should require explicit approval.
High
assets/ci-config-template.yml:57assets/ci-config-template.yml:119assets/ci-config-template.yml:197assets/ci-config-template.yml:230assets/ci-config-template.yml:240
Unpinned CI Tool Installation
The CI template installs security tools and actions from mutable package names, branches, or remote scripts. Pin versions, prefer verified actions, and verify release checksums before execution.
Multiple CI steps install tools without version pins or integrity checks, and one action tracks a mutable branch. The file is a reusable template, so this insecure pattern could be copied into production pipelines.
High
Insecure NFS Export Option
The deployment guide shows an NFS export using no_root_squash for Velociraptor storage. This can allow remote root access to retain root privileges on the shared export.
The no_root_squash option is present directly in the example export line. This is a well-known NFS hardening issue and is not covered by the static hardcoded-IP pattern.
Capability review items (32)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The URL is used as the source for a remote install script that is immediately executed by the CI job. A mutable remote script creates supply-chain risk.
High
sudo privilege escalation
sudo mv velociraptor-v0.72.3-linux-amd64 /usr/local/bin/velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor.service <<'EOF'
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo useradd -r -s /bin/false velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo mkdir -p /etc/velociraptor /var/lib/velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo chown -R velociraptor:velociraptor /etc/velociraptor /var/lib/velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo systemctl daemon-reload
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo systemctl enable velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo systemctl start velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo apt install certbot
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo certbot certonly --standalone \
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
# Install: sudo dpkg -i velociraptor-client.deb
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo cp velociraptor /usr/local/bin/
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo cp client.config.yaml /etc/velociraptor/
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor-client.service <<'EOF'
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo systemctl enable velociraptor-client
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo systemctl start velociraptor-client
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo apt install nfs-kernel-server
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo mkdir -p /export/velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo chown nobody:nogroup /export/velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo mount -t nfs nfs-server:/export/velociraptor /var/lib/velociraptor
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8000 -j ACCEPT
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -s 10.0.0.0/8 -j ACCEPT
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -j DROP
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
High
sudo privilege escalation
sudo iptables-save > /etc/iptables/rules.v4
This deployment step asks the user to run privileged system commands. The commands are legitimate for installation, but they can alter host state, services, packages, or firewall rules.
Medium
Hardcoded URL
webhook: "https://hooks.slack.com/services/..."
The template places a Slack webhook URL directly in configuration. Even as a placeholder, this pattern encourages storing webhook secrets in files.
Medium
Slack webhook
webhook: "https://hooks.slack.com/services/..."
Slack webhook URLs are bearer secrets when real values are inserted. The template should reference a secret store instead of a literal webhook field.
Medium
Hardcoded URL
wget https://github.com/Velocidex/velociraptor/releases/download/v0.72/velociraptor-v0.72.3-linux-am
The guide downloads a Velociraptor binary from an external release URL without checksum verification in the shown step. This is legitimate deployment guidance but needs integrity checks.
Medium
references/deployment-guide.md:117references/deployment-guide.md:122references/deployment-guide.md:132
Hardcoded IP address · 3 occurrences
bind_address: 0.0.0.0
The example binds a Velociraptor service to 0.0.0.0, exposing it on all interfaces unless firewall and access controls are correct. That is a real deployment hardening risk.
Medium
Temp directory access
config client > /tmp/client.config.yaml
The guide writes a client configuration to /tmp, which may expose enrollment or server connection details on shared systems. Use a restricted directory and permissions.
Risk Factors
🌐 Network access (54)
assets/artifact-template.yaml:126 assets/artifact-template.yaml:127 assets/artifact-template.yaml:132 assets/ci-config-template.yml:240 assets/hunt-template.yaml:138 assets/hunt-template.yaml:138 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 references/artifact-development.md:594 references/artifact-development.md:595 references/artifact-development.md:410 references/artifact-development.md:411 references/deployment-guide.md:77 references/deployment-guide.md:110 references/deployment-guide.md:200 references/deployment-guide.md:325 references/deployment-guide.md:117 references/deployment-guide.md:122 references/deployment-guide.md:126 references/deployment-guide.md:127 references/deployment-guide.md:128 references/deployment-guide.md:132 references/deployment-guide.md:357 references/deployment-guide.md:358 references/deployment-guide.md:359 references/deployment-guide.md:370 references/deployment-guide.md:371 references/deployment-guide.md:372 references/deployment-guide.md:385 references/deployment-guide.md:411 references/mitre-attack-mapping.md:419 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:43 SKILL.md:48 SKILL.md:329 SKILL.md:330 SKILL.md:331 SKILL.md:332 SKILL.md:333 SKILL.md:48
⚙️ External commands (99)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 assets/hunt-template.yaml:36 assets/hunt-template.yaml:115 assets/hunt-template.yaml:183 references/artifact-development.md:105 references/artifact-development.md:509 references/artifact-development.md:512 references/deployment-guide.md:285-290 references/deployment-guide.md:520 references/deployment-guide.md:278 references/deployment-guide.md:515 references/deployment-guide.md:81 references/deployment-guide.md:145 references/deployment-guide.md:173 references/deployment-guide.md:176 references/deployment-guide.md:177 references/deployment-guide.md:180 references/deployment-guide.md:181 references/deployment-guide.md:182 references/deployment-guide.md:215 references/deployment-guide.md:218 references/deployment-guide.md:272 references/deployment-guide.md:295 references/deployment-guide.md:296 references/deployment-guide.md:299 references/deployment-guide.md:315 references/deployment-guide.md:316 references/deployment-guide.md:380 references/deployment-guide.md:381 references/deployment-guide.md:382 references/deployment-guide.md:388 references/deployment-guide.md:408 references/deployment-guide.md:411 references/deployment-guide.md:412 references/deployment-guide.md:415 references/mitre-attack-mapping.md:59 references/mitre-attack-mapping.md:65 references/mitre-attack-mapping.md:68 references/mitre-attack-mapping.md:69 references/mitre-attack-mapping.md:73 references/mitre-attack-mapping.md:77 references/mitre-attack-mapping.md:165 references/mitre-attack-mapping.md:188 references/mitre-attack-mapping.md:91 references/mitre-attack-mapping.md:94 references/vql-patterns.md:28 references/vql-patterns.md:476 SKILL.md:41-50 SKILL.md:50-54 SKILL.md:54-66 SKILL.md:66-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-88 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-127 SKILL.md:127-137 SKILL.md:137-145 SKILL.md:145-151 SKILL.md:151-157 SKILL.md:157-169 SKILL.md:169-175 SKILL.md:175-181 SKILL.md:181-187 SKILL.md:187-194 SKILL.md:194-202 SKILL.md:202-221 SKILL.md:221-244 SKILL.md:244-245 SKILL.md:245-253 SKILL.md:253-284 SKILL.md:284-286 SKILL.md:286-293 SKILL.md:293-303 SKILL.md:303-308 SKILL.md:308-310 SKILL.md:310-311 SKILL.md:311-312 SKILL.md:312-314 SKILL.md:314-316 SKILL.md:316-317 SKILL.md:317-318 SKILL.md:318-319 SKILL.md:319-321 SKILL.md:321-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:111 SKILL.md:149 SKILL.md:193 SKILL.md:209
📁 Filesystem access (3)
🔑 Env variables (25)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/deployment-guide.md:231 references/deployment-guide.md:236 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternSystemd service enablementSystemd service enablement
Audited by: codex
Jul 6, 2026, 12:42 AM
Most static detections are defensive Velociraptor, MITRE, and security-rule examples rather than hidden malicious behavior. Confirmed risks are concentrated in operational templates: curl-to-shell CI installation, privileged service and firewall commands, broad network binding, /tmp client configuration output, and broad endpoint collection defaults.
12
Files scanned
4,889
Lines analyzed
43
Review items
35
False positives ignored
Confirmed security concerns (5)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The template uses a curl-to-bash installer pattern. Executing unaudited remote code in CI can compromise build credentials and artifacts.
High
Systemd service enablement
sudo systemctl enable velociraptor
The guide enables a persistent Velociraptor server service. This is legitimate administration, but persistent privileged services need explicit authorization and hardening.
High
Systemd service enablement
sudo systemctl enable velociraptor-client
The guide enables a persistent Velociraptor client service. Client persistence across endpoints is expected for DFIR, but it is high impact if run outside approved scope.
Medium
Broad Endpoint Collection Requires Authorization
The offline collector template gathers process, network, persistence, event log, file timeline, USB, and optional browser history evidence. This is appropriate for DFIR, but it can collect sensitive user and system data without technical enforcement of authorization.
The collector artifact list and the skill security notes both acknowledge broad evidence and sensitive data collection. The risk is contextual misuse, not hidden malicious code.
Medium
Default Hunt Template Targets All Clients
The hunt template sets include_all to true before listing narrower label and operating system filters. If copied without adjustment, a hunt can run across all enrolled endpoints and create operational or privacy impact.
The target section explicitly includes all clients and only later shows optional exclusions. This is a realistic configuration risk for production hunts.
Capability review items (33)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
This line downloads an installer script from GitHub and executes it through a shell pipeline. That creates a supply-chain risk if the remote script or transport is compromised.
High
PowerShell invocation
```powershell
The PowerShell block installs and starts a Windows Velociraptor service. This is expected deployment guidance, but it changes endpoint persistence and requires administrator approval.
High
sudo privilege escalation
sudo mv velociraptor-v0.72.3-linux-amd64 /usr/local/bin/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor.service <<'EOF'
This command writes a systemd unit under /etc/systemd/system. Creating persistent services is a high-impact administrative action even when used for legitimate DFIR deployment.
High
sudo privilege escalation
sudo useradd -r -s /bin/false velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo mkdir -p /etc/velociraptor /var/lib/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo chown -R velociraptor:velociraptor /etc/velociraptor /var/lib/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo systemctl daemon-reload
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo systemctl enable velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo systemctl start velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo apt install certbot
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo certbot certonly --standalone \
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
# Install: sudo dpkg -i velociraptor-client.deb
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo cp velociraptor /usr/local/bin/
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo cp client.config.yaml /etc/velociraptor/
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor-client.service <<'EOF'
This command writes a client systemd unit that runs Velociraptor as root. Endpoint persistence as root must be explicitly approved and hardened.
High
sudo privilege escalation
sudo systemctl enable velociraptor-client
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo systemctl start velociraptor-client
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo apt install nfs-kernel-server
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo mkdir -p /export/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo chown nobody:nogroup /export/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
sudo privilege escalation
sudo mount -t nfs nfs-server:/export/velociraptor /var/lib/velociraptor
This command mounts shared storage into the Velociraptor datastore path. Incorrect NFS permissions can expose evidence or corrupt forensic data.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8000 -j ACCEPT
This command changes host firewall policy for the Velociraptor frontend. Opening service ports is a real network exposure and should be scoped tightly.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -s 10.0.0.0/8 -j ACCEPT
This command permits GUI access from a broad private network range. Administrative console access should be restricted to a narrow management network.
High
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -j DROP
This command changes firewall policy for the GUI service. The deny rule is useful, but copied firewall changes still require careful ordering and validation.
High
sudo privilege escalation
sudo iptables-save > /etc/iptables/rules.v4
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
Hardcoded IP address
/export/velociraptor 10.0.1.0/24(rw,sync,no_subtree_check,no_root_squash)
The NFS export example combines a fixed subnet with no_root_squash. If copied, it can permit root-level writes from clients to shared Velociraptor storage.
Medium
Unix shell invocation
#!/bin/bash
The shell script backs up Velociraptor datastore and configuration files. It is operationally valid, but copied scripts must protect sensitive server configuration and backup paths.
Medium
Hardcoded URL
wget https://github.com/Velocidex/velociraptor/releases/download/v0.72/velociraptor-v0.72.3-linux-am
The guide downloads a Velociraptor binary from a release URL without showing checksum or signature verification. That is a real supply-chain hardening gap for deployment instructions.
Medium
references/deployment-guide.md:117references/deployment-guide.md:122references/deployment-guide.md:132
Hardcoded IP address · 3 occurrences
bind_address: 0.0.0.0
The API bind address is set to 0.0.0.0, which exposes the service on all interfaces if copied. Administrative services should bind to a management interface or localhost where possible.
Medium
Temp directory access
config client > /tmp/client.config.yaml
The client configuration is written to /tmp, which can expose enrollment material or deployment configuration on shared systems. A restricted temporary directory is safer.
Static false positives ignored (35)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Critical
Browser credential files
"C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Login Data",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows DPAPI access
- `Windows.Forensics.DPAPI`
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows SAM/registry hive access
"C:/Windows/System32/config/SAM",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows SAM/registry hive access
"C:/Windows/System32/config/SYSTEM",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Windows SAM/registry hive access
"C:/Windows/System32/config/SECURITY"
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
Ransomware keywords
### Pattern: Ransomware Investigation
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransomware keywords
6. Extract: Ransomware binary samples for malware analysis
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
C2 keywords
- "Connections to known C2 infrastructure"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
C2 keywords
192.0.2.1,C2 Server
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/**
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
C2 keywords
- [Command and Control](#command-and-control)
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
C2 keywords
### T1041: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access · 2 occurrences
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access · 2 occurrences
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnce/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Microsoft/Windows/CurrentVersion/Run/*"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/*")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows Defender/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Policies/Microsoft/Windows Defender/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/WinDefend/**"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
OR FullPath =~ "(?i)(cmd|shell|upload|backdoor|c99)"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Microsoft/Windows/CurrentVersion/Run/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/*"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Windows/AppInit_DLLs",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Microsoft/Windows NT/CurrentVersion/Windows/AppInit_DLLs"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access · 2 occurrences
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/**/ImagePath")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Enum/USBSTOR/**/FriendlyName")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Windows registry access
FROM glob(globs="HKEY_LOCAL_MACHINE/SOFTWARE/**", accessor="registry")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.
Risk Factors
🌐 Network access (54)
assets/artifact-template.yaml:126 assets/artifact-template.yaml:127 assets/artifact-template.yaml:132 assets/ci-config-template.yml:240 assets/hunt-template.yaml:138 assets/hunt-template.yaml:138 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 references/artifact-development.md:594 references/artifact-development.md:595 references/artifact-development.md:410 references/artifact-development.md:411 references/deployment-guide.md:77 references/deployment-guide.md:110 references/deployment-guide.md:200 references/deployment-guide.md:325 references/deployment-guide.md:117 references/deployment-guide.md:122 references/deployment-guide.md:126 references/deployment-guide.md:127 references/deployment-guide.md:128 references/deployment-guide.md:132 references/deployment-guide.md:357 references/deployment-guide.md:358 references/deployment-guide.md:359 references/deployment-guide.md:370 references/deployment-guide.md:371 references/deployment-guide.md:372 references/deployment-guide.md:385 references/deployment-guide.md:411 references/mitre-attack-mapping.md:419 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:43 SKILL.md:48 SKILL.md:329 SKILL.md:330 SKILL.md:331 SKILL.md:332 SKILL.md:333 SKILL.md:48
⚙️ External commands (99)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 assets/hunt-template.yaml:36 assets/hunt-template.yaml:115 assets/hunt-template.yaml:183 references/artifact-development.md:105 references/artifact-development.md:509 references/artifact-development.md:512 references/deployment-guide.md:285-290 references/deployment-guide.md:520 references/deployment-guide.md:278 references/deployment-guide.md:515 references/deployment-guide.md:81 references/deployment-guide.md:145 references/deployment-guide.md:173 references/deployment-guide.md:176 references/deployment-guide.md:177 references/deployment-guide.md:180 references/deployment-guide.md:181 references/deployment-guide.md:182 references/deployment-guide.md:215 references/deployment-guide.md:218 references/deployment-guide.md:272 references/deployment-guide.md:295 references/deployment-guide.md:296 references/deployment-guide.md:299 references/deployment-guide.md:315 references/deployment-guide.md:316 references/deployment-guide.md:380 references/deployment-guide.md:381 references/deployment-guide.md:382 references/deployment-guide.md:388 references/deployment-guide.md:408 references/deployment-guide.md:411 references/deployment-guide.md:412 references/deployment-guide.md:415 references/mitre-attack-mapping.md:59 references/mitre-attack-mapping.md:65 references/mitre-attack-mapping.md:68 references/mitre-attack-mapping.md:69 references/mitre-attack-mapping.md:73 references/mitre-attack-mapping.md:77 references/mitre-attack-mapping.md:165 references/mitre-attack-mapping.md:188 references/mitre-attack-mapping.md:91 references/mitre-attack-mapping.md:94 references/vql-patterns.md:28 references/vql-patterns.md:476 SKILL.md:41-50 SKILL.md:50-54 SKILL.md:54-66 SKILL.md:66-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-88 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-127 SKILL.md:127-137 SKILL.md:137-145 SKILL.md:145-151 SKILL.md:151-157 SKILL.md:157-169 SKILL.md:169-175 SKILL.md:175-181 SKILL.md:181-187 SKILL.md:187-194 SKILL.md:194-202 SKILL.md:202-221 SKILL.md:221-244 SKILL.md:244-245 SKILL.md:245-253 SKILL.md:253-284 SKILL.md:284-286 SKILL.md:286-293 SKILL.md:293-303 SKILL.md:303-308 SKILL.md:308-310 SKILL.md:310-311 SKILL.md:311-312 SKILL.md:312-314 SKILL.md:314-316 SKILL.md:316-317 SKILL.md:317-318 SKILL.md:318-319 SKILL.md:319-321 SKILL.md:321-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:111 SKILL.md:149 SKILL.md:193 SKILL.md:209
📁 Filesystem access (3)
🔑 Env variables (25)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/deployment-guide.md:231 references/deployment-guide.md:236 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternSystemd service enablementSystemd service enablement
Audited by: codex
Jun 28, 2026, 05:41 AM
Static findings are mostly explained by the skill being a Velociraptor DFIR guide, not by hidden malicious code. However, the content includes templates for broad endpoint collection, credential-adjacent artifact discovery, privileged service deployment, webhook notification, and shell-based installation patterns, so publication should require human review and strong warnings.
12
Files scanned
4,889
Lines analyzed
12
Review items
2
False positives ignored
Confirmed security concerns (7)
High
assets/offline-collector-config.yaml:20-79references/mitre-attack-mapping.md:315-331references/mitre-attack-mapping.md:335-350SKILL.md:227-235
Sensitive Endpoint and Credential-Adjacent Collection
The skill provides offline collector and MITRE mapping examples that can gather endpoint process, network, persistence, event log, file timeline, SAM hive, and browser credential-store evidence. This is expected for authorized DFIR, but it is high risk because misuse can expose sensitive host and user data.
The cited files explicitly describe sensitive evidence collection and warn that VQL can collect credentials, PII, and sensitive files. Legitimate incident response use is clear, but the data exposure risk is real.
High
references/deployment-guide.md:141-182references/deployment-guide.md:275-289references/deployment-guide.md:292-299references/deployment-guide.md:405-415
Privileged Deployment and Persistence-Like Service Instructions
Deployment guidance includes sudo commands, systemd service creation and enablement, Windows service installation, firewall changes, and NFS storage configuration. These are normal for Velociraptor administration but can create persistent privileged endpoint or server components if used outside approved scope.
The commands are administrative deployment steps rather than covert persistence. The risk remains high because they modify privileged services and host network controls.
High
Pipe-to-Shell Install Pattern in CI Template
The CI template installs tfsec with curl piped directly to bash. This pattern executes remote content without pinning or verification and was correctly flagged as dangerous, even though it appears in a template rather than active runtime code.
The line directly pipes a downloaded installer to bash. The context is a GitHub Actions template, but the supply-chain risk is concrete if copied into production CI.
Medium
Broad Hunt and Command Execution Templates
The hunt template and quick-start examples include Velociraptor commands that create hunts, monitor results, and export endpoint data. These are legitimate DFIR workflows, but mistakes in target labels, parameters, or authorization can collect data at enterprise scale.
The commands are explicit and operational. The examples do not show malicious intent, so medium severity is appropriate when paired with the high-risk data collection findings.
Medium
assets/hunt-template.yaml:137-139assets/artifact-template.yaml:124-132references/deployment-guide.md:345-359
Webhook, URL, and Example Network Endpoints
Several network findings are placeholders or documentation links, including a Slack webhook placeholder and example URLs. These are mostly safe as examples, but users could accidentally commit real webhook URLs or route investigation data to external services.
The URLs are placeholders or public documentation in the reviewed snippets. The remaining risk is operational leakage if users replace placeholders with real secrets in shared templates.
Medium
assets/ci-config-template.yml:30-34assets/ci-config-template.yml:161-164assets/ci-config-template.yml:317-323
CI Token and Filesystem Access in Workflow Template
The CI workflow uses the GitHub token for security scanning and reads a generated report before posting a pull request comment. This is a common workflow pattern, but it requires least-privilege permissions and careful handling of report content.
The token and filesystem access are visible and semantically legitimate for GitHub Actions. Risk depends on repository permissions and whether report content can contain untrusted text.
Low
Reconnaissance Keywords Are Expected For Forensic Queries
System, network, registry, and USB enumeration queries are core Velociraptor forensic techniques. They are not hidden reconnaissance behavior in the skill itself, but they should run only within an authorized investigation.
The query intent is clearly defensive evidence collection. The risk is contextual misuse, not a false claim about the files containing enumeration logic.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Cryptography Alerts Are Mostly Documentation False Positives
Many weak cryptography alerts are caused by security-rule examples, artifact metadata, or text about hashing. The reviewed artifact template uses SHA256, and the security rule template explains weak crypto detection rather than using weak algorithms in the skill.
The cited context shows documentation and detection rules rather than executable weak cryptographic operations. Other static weak-crypto hits should still be treated as review signals in this security domain.
Low
Educational Vulnerability Examples Trigger Script and Secret Rules
The example reference includes intentionally vulnerable XSS snippets and secure API-key handling examples. These are educational examples, not active application code executed by the skill.
The lines are inside markdown examples that explain vulnerable and safer patterns. They do not create a runtime XSS or secret-exfiltration path in this skill.
Risk Factors
🌐 Network access (4)
⚙️ External commands (4)
📁 Filesystem access (3)
🔑 Env variables (3)
⚡ Contains scripts (2)
Detected Patterns
Remote Installer Piped to ShellOffline Collector for Broad Endpoint EvidenceCredential Store and SAM Hive Discovery PatternsPrivileged Service InstallationExternal Notification Webhook Placeholder
Audited by: codex
Jan 16, 2026, 03:43 PM
Pure documentation skill containing only markdown reference files and YAML templates for the legitimate open-source Velociraptor DFIR platform. All patterns detected are false positives: VQL queries (not shell commands), detection patterns (not C2 code), forensic artifacts (not credential theft), and documentation links. This is incident response documentation for security professionals.
13
Files scanned
5,140
Lines analyzed
5
Review items
0
False positives ignored
Risk Factors
🌐 Network access (55)
assets/artifact-template.yaml:126 assets/artifact-template.yaml:127 assets/artifact-template.yaml:132 assets/ci-config-template.yml:240 assets/hunt-template.yaml:138 assets/hunt-template.yaml:138 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 references/artifact-development.md:594 references/artifact-development.md:595 references/artifact-development.md:627 references/artifact-development.md:410 references/artifact-development.md:411 references/deployment-guide.md:77 references/deployment-guide.md:110 references/deployment-guide.md:200 references/deployment-guide.md:325 references/deployment-guide.md:117 references/deployment-guide.md:122 references/deployment-guide.md:126 references/deployment-guide.md:127 references/deployment-guide.md:128 references/deployment-guide.md:132 references/deployment-guide.md:357 references/deployment-guide.md:358 references/deployment-guide.md:359 references/deployment-guide.md:370 references/deployment-guide.md:371 references/deployment-guide.md:372 references/deployment-guide.md:385 references/deployment-guide.md:411 references/mitre-attack-mapping.md:419 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:43 SKILL.md:48 SKILL.md:329 SKILL.md:330 SKILL.md:331 SKILL.md:332 SKILL.md:333 SKILL.md:48
⚙️ External commands (424)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 assets/hunt-template.yaml:36 assets/hunt-template.yaml:115 assets/hunt-template.yaml:183 references/artifact-development.md:17-51 references/artifact-development.md:51-72 references/artifact-development.md:72-78 references/artifact-development.md:78-82 references/artifact-development.md:82-88 references/artifact-development.md:88-92 references/artifact-development.md:92-98 references/artifact-development.md:98-102 references/artifact-development.md:102-108 references/artifact-development.md:108-112 references/artifact-development.md:112-123 references/artifact-development.md:123-127 references/artifact-development.md:127-135 references/artifact-development.md:135-143 references/artifact-development.md:143-150 references/artifact-development.md:150-156 references/artifact-development.md:156-164 references/artifact-development.md:164-170 references/artifact-development.md:170-183 references/artifact-development.md:183-191 references/artifact-development.md:191-203 references/artifact-development.md:203-209 references/artifact-development.md:209-222 references/artifact-development.md:222-228 references/artifact-development.md:228-246 references/artifact-development.md:246-252 references/artifact-development.md:252-268 references/artifact-development.md:268-274 references/artifact-development.md:274-289 references/artifact-development.md:289-295 references/artifact-development.md:295-322 references/artifact-development.md:322-326 references/artifact-development.md:326-353 references/artifact-development.md:353-357 references/artifact-development.md:357-398 references/artifact-development.md:398-402 references/artifact-development.md:402-435 references/artifact-development.md:435-439 references/artifact-development.md:439-472 references/artifact-development.md:472-478 references/artifact-development.md:478-485 references/artifact-development.md:485-489 references/artifact-development.md:489-501 references/artifact-development.md:501-507 references/artifact-development.md:507-517 references/artifact-development.md:517-537 references/artifact-development.md:537-546 references/artifact-development.md:546-550 references/artifact-development.md:550-562 references/artifact-development.md:562-566 references/artifact-development.md:566-576 references/artifact-development.md:576-582 references/artifact-development.md:582-596 references/artifact-development.md:596-602 references/artifact-development.md:602-608 references/artifact-development.md:608-612 references/artifact-development.md:612-618 references/artifact-development.md:105 references/artifact-development.md:509 references/artifact-development.md:512 references/deployment-guide.md:38-40 references/deployment-guide.md:40-43 references/deployment-guide.md:43-47 references/deployment-guide.md:47-50 references/deployment-guide.md:50-54 references/deployment-guide.md:54-75 references/deployment-guide.md:75-82 references/deployment-guide.md:82-86 references/deployment-guide.md:86-98 references/deployment-guide.md:98-102 references/deployment-guide.md:102-139 references/deployment-guide.md:139-143 references/deployment-guide.md:143-183 references/deployment-guide.md:183-187 references/deployment-guide.md:187-195 references/deployment-guide.md:195-199 references/deployment-guide.md:199-202 references/deployment-guide.md:202-207 references/deployment-guide.md:207-210 references/deployment-guide.md:210-213 references/deployment-guide.md:213-224 references/deployment-guide.md:224-227 references/deployment-guide.md:227-237 references/deployment-guide.md:237-243 references/deployment-guide.md:243-247 references/deployment-guide.md:247-253 references/deployment-guide.md:253-261 references/deployment-guide.md:261-265 references/deployment-guide.md:265-273 references/deployment-guide.md:273-278 references/deployment-guide.md:278-284 references/deployment-guide.md:285-290 references/deployment-guide.md:290-293 references/deployment-guide.md:293-317 references/deployment-guide.md:317-321 references/deployment-guide.md:321-339 references/deployment-guide.md:339-346 references/deployment-guide.md:346-373 references/deployment-guide.md:373-378 references/deployment-guide.md:378-389 references/deployment-guide.md:389-392 references/deployment-guide.md:392-399 references/deployment-guide.md:399-406 references/deployment-guide.md:406-416 references/deployment-guide.md:416-419 references/deployment-guide.md:419-426 references/deployment-guide.md:426-431 references/deployment-guide.md:431-443 references/deployment-guide.md:443-456 references/deployment-guide.md:456-468 references/deployment-guide.md:468-471 references/deployment-guide.md:471-480 references/deployment-guide.md:480-487 references/deployment-guide.md:487-498 references/deployment-guide.md:498-501 references/deployment-guide.md:501-509 references/deployment-guide.md:509-514 references/deployment-guide.md:514-536 references/deployment-guide.md:536-539 references/deployment-guide.md:539-551 references/deployment-guide.md:551-556 references/deployment-guide.md:556-564 references/deployment-guide.md:564-567 references/deployment-guide.md:567-576 references/deployment-guide.md:576-583 references/deployment-guide.md:583-600 references/deployment-guide.md:600-603 references/deployment-guide.md:603-615 references/deployment-guide.md:615-636 references/deployment-guide.md:636-639 references/deployment-guide.md:639-652 references/deployment-guide.md:652-657 references/deployment-guide.md:520 references/deployment-guide.md:514-536 references/deployment-guide.md:278 references/deployment-guide.md:515 references/deployment-guide.md:81 references/deployment-guide.md:145 references/deployment-guide.md:173 references/deployment-guide.md:176 references/deployment-guide.md:177 references/deployment-guide.md:180 references/deployment-guide.md:181 references/deployment-guide.md:182 references/deployment-guide.md:215 references/deployment-guide.md:218 references/deployment-guide.md:272 references/deployment-guide.md:295 references/deployment-guide.md:296 references/deployment-guide.md:299 references/deployment-guide.md:315 references/deployment-guide.md:316 references/deployment-guide.md:380 references/deployment-guide.md:381 references/deployment-guide.md:382 references/deployment-guide.md:388 references/deployment-guide.md:408 references/deployment-guide.md:411 references/deployment-guide.md:412 references/deployment-guide.md:415 references/EXAMPLE.md:54-74 references/EXAMPLE.md:74-95 references/EXAMPLE.md:95-108 references/EXAMPLE.md:108-111 references/EXAMPLE.md:111-118 references/EXAMPLE.md:118-122 references/EXAMPLE.md:122-129 references/EXAMPLE.md:129-135 references/EXAMPLE.md:135-151 references/EXAMPLE.md:151-154 references/EXAMPLE.md:154-162 references/EXAMPLE.md:162-296 references/EXAMPLE.md:296-306 references/EXAMPLE.md:306-309 references/EXAMPLE.md:309-318 references/EXAMPLE.md:318-333 references/EXAMPLE.md:333-342 references/EXAMPLE.md:342-346 references/EXAMPLE.md:346-354 references/EXAMPLE.md:354-358 references/EXAMPLE.md:358-361 references/EXAMPLE.md:361-371 references/EXAMPLE.md:371-404 references/EXAMPLE.md:404-414 references/EXAMPLE.md:414-447 references/EXAMPLE.md:447-451 references/EXAMPLE.md:451-472 references/EXAMPLE.md:472-476 references/EXAMPLE.md:476-537 references/mitre-attack-mapping.md:23 references/mitre-attack-mapping.md:24 references/mitre-attack-mapping.md:27-41 references/mitre-attack-mapping.md:41-46 references/mitre-attack-mapping.md:46-47 references/mitre-attack-mapping.md:47-50 references/mitre-attack-mapping.md:50-61 references/mitre-attack-mapping.md:61-68 references/mitre-attack-mapping.md:68-69 references/mitre-attack-mapping.md:69-72 references/mitre-attack-mapping.md:72-81 references/mitre-attack-mapping.md:81-86 references/mitre-attack-mapping.md:86-87 references/mitre-attack-mapping.md:87-90 references/mitre-attack-mapping.md:90-100 references/mitre-attack-mapping.md:100-105 references/mitre-attack-mapping.md:105-106 references/mitre-attack-mapping.md:106-109 references/mitre-attack-mapping.md:109-120 references/mitre-attack-mapping.md:120-127 references/mitre-attack-mapping.md:127-128 references/mitre-attack-mapping.md:128-131 references/mitre-attack-mapping.md:131-145 references/mitre-attack-mapping.md:145-150 references/mitre-attack-mapping.md:150-151 references/mitre-attack-mapping.md:151-154 references/mitre-attack-mapping.md:154-168 references/mitre-attack-mapping.md:168-173 references/mitre-attack-mapping.md:173-176 references/mitre-attack-mapping.md:176-189 references/mitre-attack-mapping.md:189-196 references/mitre-attack-mapping.md:196-199 references/mitre-attack-mapping.md:199-212 references/mitre-attack-mapping.md:212-217 references/mitre-attack-mapping.md:217-220 references/mitre-attack-mapping.md:220-228 references/mitre-attack-mapping.md:228-235 references/mitre-attack-mapping.md:235-238 references/mitre-attack-mapping.md:238-246 references/mitre-attack-mapping.md:246-251 references/mitre-attack-mapping.md:251-252 references/mitre-attack-mapping.md:252-255 references/mitre-attack-mapping.md:255-270 references/mitre-attack-mapping.md:270-275 references/mitre-attack-mapping.md:275-276 references/mitre-attack-mapping.md:276-279 references/mitre-attack-mapping.md:279-291 references/mitre-attack-mapping.md:291-298 references/mitre-attack-mapping.md:298-299 references/mitre-attack-mapping.md:299-302 references/mitre-attack-mapping.md:302-313 references/mitre-attack-mapping.md:313-318 references/mitre-attack-mapping.md:318-319 references/mitre-attack-mapping.md:319-322 references/mitre-attack-mapping.md:322-333 references/mitre-attack-mapping.md:333-338 references/mitre-attack-mapping.md:338-339 references/mitre-attack-mapping.md:339-342 references/mitre-attack-mapping.md:342-352 references/mitre-attack-mapping.md:352-359 references/mitre-attack-mapping.md:359-360 references/mitre-attack-mapping.md:360-363 references/mitre-attack-mapping.md:363-370 references/mitre-attack-mapping.md:370-375 references/mitre-attack-mapping.md:375-378 references/mitre-attack-mapping.md:378-385 references/mitre-attack-mapping.md:385-390 references/mitre-attack-mapping.md:390-393 references/mitre-attack-mapping.md:393-399 references/mitre-attack-mapping.md:399-406 references/mitre-attack-mapping.md:406-407 references/mitre-attack-mapping.md:407-410 references/mitre-attack-mapping.md:410-421 references/mitre-attack-mapping.md:421-426 references/mitre-attack-mapping.md:426-429 references/mitre-attack-mapping.md:429-439 references/mitre-attack-mapping.md:439-444 references/mitre-attack-mapping.md:444-445 references/mitre-attack-mapping.md:445-448 references/mitre-attack-mapping.md:448-460 references/mitre-attack-mapping.md:460-467 references/mitre-attack-mapping.md:467-468 references/mitre-attack-mapping.md:468-471 references/mitre-attack-mapping.md:471-485 references/mitre-attack-mapping.md:485-490 references/mitre-attack-mapping.md:490-491 references/mitre-attack-mapping.md:491-494 references/mitre-attack-mapping.md:494-500 references/mitre-attack-mapping.md:500-507 references/mitre-attack-mapping.md:507-508 references/mitre-attack-mapping.md:508-511 references/mitre-attack-mapping.md:511-523 references/mitre-attack-mapping.md:523-528 references/mitre-attack-mapping.md:528-529 references/mitre-attack-mapping.md:529-532 references/mitre-attack-mapping.md:532-540 references/mitre-attack-mapping.md:540-547 references/mitre-attack-mapping.md:547-548 references/mitre-attack-mapping.md:548-551 references/mitre-attack-mapping.md:551-563 references/mitre-attack-mapping.md:563-568 references/mitre-attack-mapping.md:568-571 references/mitre-attack-mapping.md:571-582 references/mitre-attack-mapping.md:582-587 references/mitre-attack-mapping.md:587-588 references/mitre-attack-mapping.md:588-591 references/mitre-attack-mapping.md:591-597 references/mitre-attack-mapping.md:59 references/mitre-attack-mapping.md:65 references/mitre-attack-mapping.md:68 references/mitre-attack-mapping.md:69 references/mitre-attack-mapping.md:73 references/mitre-attack-mapping.md:77 references/mitre-attack-mapping.md:165 references/mitre-attack-mapping.md:188 references/mitre-attack-mapping.md:91 references/mitre-attack-mapping.md:94 references/vql-patterns.md:21-36 references/vql-patterns.md:36-40 references/vql-patterns.md:40-57 references/vql-patterns.md:57-61 references/vql-patterns.md:61-71 references/vql-patterns.md:71-77 references/vql-patterns.md:77-92 references/vql-patterns.md:92-96 references/vql-patterns.md:96-107 references/vql-patterns.md:107-111 references/vql-patterns.md:111-128 references/vql-patterns.md:128-134 references/vql-patterns.md:134-148 references/vql-patterns.md:148-152 references/vql-patterns.md:152-165 references/vql-patterns.md:165-169 references/vql-patterns.md:169-178 references/vql-patterns.md:178-184 references/vql-patterns.md:184-198 references/vql-patterns.md:198-202 references/vql-patterns.md:202-213 references/vql-patterns.md:213-217 references/vql-patterns.md:217-227 references/vql-patterns.md:227-233 references/vql-patterns.md:233-243 references/vql-patterns.md:243-247 references/vql-patterns.md:247-259 references/vql-patterns.md:259-265 references/vql-patterns.md:265-276 references/vql-patterns.md:276-280 references/vql-patterns.md:280-289 references/vql-patterns.md:289-293 references/vql-patterns.md:293-302 references/vql-patterns.md:302-308 references/vql-patterns.md:308-332 references/vql-patterns.md:332-336 references/vql-patterns.md:336-344 references/vql-patterns.md:344-350 references/vql-patterns.md:350-362 references/vql-patterns.md:362-366 references/vql-patterns.md:366-376 references/vql-patterns.md:376-380 references/vql-patterns.md:380-390 references/vql-patterns.md:390-396 references/vql-patterns.md:396-410 references/vql-patterns.md:410-414 references/vql-patterns.md:414-421 references/vql-patterns.md:421-425 references/vql-patterns.md:425-436 references/vql-patterns.md:436-442 references/vql-patterns.md:442-460 references/vql-patterns.md:460-464 references/vql-patterns.md:464-471 references/vql-patterns.md:471-475 references/vql-patterns.md:475-488 references/vql-patterns.md:488-494 references/vql-patterns.md:494-512 references/vql-patterns.md:512-516 references/vql-patterns.md:516-535 references/vql-patterns.md:28 references/vql-patterns.md:476 references/WORKFLOW_CHECKLIST.md:74 SKILL.md:41-50 SKILL.md:50-54 SKILL.md:54-66 SKILL.md:66-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-88 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-127 SKILL.md:127-137 SKILL.md:137-145 SKILL.md:145-151 SKILL.md:151-157 SKILL.md:157-169 SKILL.md:169-175 SKILL.md:175-181 SKILL.md:181-187 SKILL.md:187-194 SKILL.md:194-202 SKILL.md:202-221 SKILL.md:221-244 SKILL.md:244-245 SKILL.md:245-253 SKILL.md:253-284 SKILL.md:284-286 SKILL.md:286-293 SKILL.md:293-303 SKILL.md:303-308 SKILL.md:308-310 SKILL.md:310-311 SKILL.md:311-312 SKILL.md:312-314 SKILL.md:314-316 SKILL.md:316-317 SKILL.md:317-318 SKILL.md:318-319 SKILL.md:319-321 SKILL.md:321-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:111 SKILL.md:149 SKILL.md:193 SKILL.md:209
📁 Filesystem access (3)
🔑 Env variables (29)
assets/ci-config-template.yml:164 assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/deployment-guide.md:231 references/deployment-guide.md:236 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Audited by: claude
Jan 16, 2026, 03:43 PM
Pure documentation skill containing only markdown reference files and YAML templates for the legitimate open-source Velociraptor DFIR platform. All patterns detected are false positives: VQL queries (not shell commands), detection patterns (not C2 code), forensic artifacts (not credential theft), and documentation links. This is incident response documentation for security professionals.
13
Files scanned
5,140
Lines analyzed
5
Review items
0
False positives ignored
Risk Factors
🌐 Network access (55)
assets/artifact-template.yaml:126 assets/artifact-template.yaml:127 assets/artifact-template.yaml:132 assets/ci-config-template.yml:240 assets/hunt-template.yaml:138 assets/hunt-template.yaml:138 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 references/artifact-development.md:594 references/artifact-development.md:595 references/artifact-development.md:627 references/artifact-development.md:410 references/artifact-development.md:411 references/deployment-guide.md:77 references/deployment-guide.md:110 references/deployment-guide.md:200 references/deployment-guide.md:325 references/deployment-guide.md:117 references/deployment-guide.md:122 references/deployment-guide.md:126 references/deployment-guide.md:127 references/deployment-guide.md:128 references/deployment-guide.md:132 references/deployment-guide.md:357 references/deployment-guide.md:358 references/deployment-guide.md:359 references/deployment-guide.md:370 references/deployment-guide.md:371 references/deployment-guide.md:372 references/deployment-guide.md:385 references/deployment-guide.md:411 references/mitre-attack-mapping.md:419 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:43 SKILL.md:48 SKILL.md:329 SKILL.md:330 SKILL.md:331 SKILL.md:332 SKILL.md:333 SKILL.md:48
⚙️ External commands (424)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 assets/hunt-template.yaml:36 assets/hunt-template.yaml:115 assets/hunt-template.yaml:183 references/artifact-development.md:17-51 references/artifact-development.md:51-72 references/artifact-development.md:72-78 references/artifact-development.md:78-82 references/artifact-development.md:82-88 references/artifact-development.md:88-92 references/artifact-development.md:92-98 references/artifact-development.md:98-102 references/artifact-development.md:102-108 references/artifact-development.md:108-112 references/artifact-development.md:112-123 references/artifact-development.md:123-127 references/artifact-development.md:127-135 references/artifact-development.md:135-143 references/artifact-development.md:143-150 references/artifact-development.md:150-156 references/artifact-development.md:156-164 references/artifact-development.md:164-170 references/artifact-development.md:170-183 references/artifact-development.md:183-191 references/artifact-development.md:191-203 references/artifact-development.md:203-209 references/artifact-development.md:209-222 references/artifact-development.md:222-228 references/artifact-development.md:228-246 references/artifact-development.md:246-252 references/artifact-development.md:252-268 references/artifact-development.md:268-274 references/artifact-development.md:274-289 references/artifact-development.md:289-295 references/artifact-development.md:295-322 references/artifact-development.md:322-326 references/artifact-development.md:326-353 references/artifact-development.md:353-357 references/artifact-development.md:357-398 references/artifact-development.md:398-402 references/artifact-development.md:402-435 references/artifact-development.md:435-439 references/artifact-development.md:439-472 references/artifact-development.md:472-478 references/artifact-development.md:478-485 references/artifact-development.md:485-489 references/artifact-development.md:489-501 references/artifact-development.md:501-507 references/artifact-development.md:507-517 references/artifact-development.md:517-537 references/artifact-development.md:537-546 references/artifact-development.md:546-550 references/artifact-development.md:550-562 references/artifact-development.md:562-566 references/artifact-development.md:566-576 references/artifact-development.md:576-582 references/artifact-development.md:582-596 references/artifact-development.md:596-602 references/artifact-development.md:602-608 references/artifact-development.md:608-612 references/artifact-development.md:612-618 references/artifact-development.md:105 references/artifact-development.md:509 references/artifact-development.md:512 references/deployment-guide.md:38-40 references/deployment-guide.md:40-43 references/deployment-guide.md:43-47 references/deployment-guide.md:47-50 references/deployment-guide.md:50-54 references/deployment-guide.md:54-75 references/deployment-guide.md:75-82 references/deployment-guide.md:82-86 references/deployment-guide.md:86-98 references/deployment-guide.md:98-102 references/deployment-guide.md:102-139 references/deployment-guide.md:139-143 references/deployment-guide.md:143-183 references/deployment-guide.md:183-187 references/deployment-guide.md:187-195 references/deployment-guide.md:195-199 references/deployment-guide.md:199-202 references/deployment-guide.md:202-207 references/deployment-guide.md:207-210 references/deployment-guide.md:210-213 references/deployment-guide.md:213-224 references/deployment-guide.md:224-227 references/deployment-guide.md:227-237 references/deployment-guide.md:237-243 references/deployment-guide.md:243-247 references/deployment-guide.md:247-253 references/deployment-guide.md:253-261 references/deployment-guide.md:261-265 references/deployment-guide.md:265-273 references/deployment-guide.md:273-278 references/deployment-guide.md:278-284 references/deployment-guide.md:285-290 references/deployment-guide.md:290-293 references/deployment-guide.md:293-317 references/deployment-guide.md:317-321 references/deployment-guide.md:321-339 references/deployment-guide.md:339-346 references/deployment-guide.md:346-373 references/deployment-guide.md:373-378 references/deployment-guide.md:378-389 references/deployment-guide.md:389-392 references/deployment-guide.md:392-399 references/deployment-guide.md:399-406 references/deployment-guide.md:406-416 references/deployment-guide.md:416-419 references/deployment-guide.md:419-426 references/deployment-guide.md:426-431 references/deployment-guide.md:431-443 references/deployment-guide.md:443-456 references/deployment-guide.md:456-468 references/deployment-guide.md:468-471 references/deployment-guide.md:471-480 references/deployment-guide.md:480-487 references/deployment-guide.md:487-498 references/deployment-guide.md:498-501 references/deployment-guide.md:501-509 references/deployment-guide.md:509-514 references/deployment-guide.md:514-536 references/deployment-guide.md:536-539 references/deployment-guide.md:539-551 references/deployment-guide.md:551-556 references/deployment-guide.md:556-564 references/deployment-guide.md:564-567 references/deployment-guide.md:567-576 references/deployment-guide.md:576-583 references/deployment-guide.md:583-600 references/deployment-guide.md:600-603 references/deployment-guide.md:603-615 references/deployment-guide.md:615-636 references/deployment-guide.md:636-639 references/deployment-guide.md:639-652 references/deployment-guide.md:652-657 references/deployment-guide.md:520 references/deployment-guide.md:514-536 references/deployment-guide.md:278 references/deployment-guide.md:515 references/deployment-guide.md:81 references/deployment-guide.md:145 references/deployment-guide.md:173 references/deployment-guide.md:176 references/deployment-guide.md:177 references/deployment-guide.md:180 references/deployment-guide.md:181 references/deployment-guide.md:182 references/deployment-guide.md:215 references/deployment-guide.md:218 references/deployment-guide.md:272 references/deployment-guide.md:295 references/deployment-guide.md:296 references/deployment-guide.md:299 references/deployment-guide.md:315 references/deployment-guide.md:316 references/deployment-guide.md:380 references/deployment-guide.md:381 references/deployment-guide.md:382 references/deployment-guide.md:388 references/deployment-guide.md:408 references/deployment-guide.md:411 references/deployment-guide.md:412 references/deployment-guide.md:415 references/EXAMPLE.md:54-74 references/EXAMPLE.md:74-95 references/EXAMPLE.md:95-108 references/EXAMPLE.md:108-111 references/EXAMPLE.md:111-118 references/EXAMPLE.md:118-122 references/EXAMPLE.md:122-129 references/EXAMPLE.md:129-135 references/EXAMPLE.md:135-151 references/EXAMPLE.md:151-154 references/EXAMPLE.md:154-162 references/EXAMPLE.md:162-296 references/EXAMPLE.md:296-306 references/EXAMPLE.md:306-309 references/EXAMPLE.md:309-318 references/EXAMPLE.md:318-333 references/EXAMPLE.md:333-342 references/EXAMPLE.md:342-346 references/EXAMPLE.md:346-354 references/EXAMPLE.md:354-358 references/EXAMPLE.md:358-361 references/EXAMPLE.md:361-371 references/EXAMPLE.md:371-404 references/EXAMPLE.md:404-414 references/EXAMPLE.md:414-447 references/EXAMPLE.md:447-451 references/EXAMPLE.md:451-472 references/EXAMPLE.md:472-476 references/EXAMPLE.md:476-537 references/mitre-attack-mapping.md:23 references/mitre-attack-mapping.md:24 references/mitre-attack-mapping.md:27-41 references/mitre-attack-mapping.md:41-46 references/mitre-attack-mapping.md:46-47 references/mitre-attack-mapping.md:47-50 references/mitre-attack-mapping.md:50-61 references/mitre-attack-mapping.md:61-68 references/mitre-attack-mapping.md:68-69 references/mitre-attack-mapping.md:69-72 references/mitre-attack-mapping.md:72-81 references/mitre-attack-mapping.md:81-86 references/mitre-attack-mapping.md:86-87 references/mitre-attack-mapping.md:87-90 references/mitre-attack-mapping.md:90-100 references/mitre-attack-mapping.md:100-105 references/mitre-attack-mapping.md:105-106 references/mitre-attack-mapping.md:106-109 references/mitre-attack-mapping.md:109-120 references/mitre-attack-mapping.md:120-127 references/mitre-attack-mapping.md:127-128 references/mitre-attack-mapping.md:128-131 references/mitre-attack-mapping.md:131-145 references/mitre-attack-mapping.md:145-150 references/mitre-attack-mapping.md:150-151 references/mitre-attack-mapping.md:151-154 references/mitre-attack-mapping.md:154-168 references/mitre-attack-mapping.md:168-173 references/mitre-attack-mapping.md:173-176 references/mitre-attack-mapping.md:176-189 references/mitre-attack-mapping.md:189-196 references/mitre-attack-mapping.md:196-199 references/mitre-attack-mapping.md:199-212 references/mitre-attack-mapping.md:212-217 references/mitre-attack-mapping.md:217-220 references/mitre-attack-mapping.md:220-228 references/mitre-attack-mapping.md:228-235 references/mitre-attack-mapping.md:235-238 references/mitre-attack-mapping.md:238-246 references/mitre-attack-mapping.md:246-251 references/mitre-attack-mapping.md:251-252 references/mitre-attack-mapping.md:252-255 references/mitre-attack-mapping.md:255-270 references/mitre-attack-mapping.md:270-275 references/mitre-attack-mapping.md:275-276 references/mitre-attack-mapping.md:276-279 references/mitre-attack-mapping.md:279-291 references/mitre-attack-mapping.md:291-298 references/mitre-attack-mapping.md:298-299 references/mitre-attack-mapping.md:299-302 references/mitre-attack-mapping.md:302-313 references/mitre-attack-mapping.md:313-318 references/mitre-attack-mapping.md:318-319 references/mitre-attack-mapping.md:319-322 references/mitre-attack-mapping.md:322-333 references/mitre-attack-mapping.md:333-338 references/mitre-attack-mapping.md:338-339 references/mitre-attack-mapping.md:339-342 references/mitre-attack-mapping.md:342-352 references/mitre-attack-mapping.md:352-359 references/mitre-attack-mapping.md:359-360 references/mitre-attack-mapping.md:360-363 references/mitre-attack-mapping.md:363-370 references/mitre-attack-mapping.md:370-375 references/mitre-attack-mapping.md:375-378 references/mitre-attack-mapping.md:378-385 references/mitre-attack-mapping.md:385-390 references/mitre-attack-mapping.md:390-393 references/mitre-attack-mapping.md:393-399 references/mitre-attack-mapping.md:399-406 references/mitre-attack-mapping.md:406-407 references/mitre-attack-mapping.md:407-410 references/mitre-attack-mapping.md:410-421 references/mitre-attack-mapping.md:421-426 references/mitre-attack-mapping.md:426-429 references/mitre-attack-mapping.md:429-439 references/mitre-attack-mapping.md:439-444 references/mitre-attack-mapping.md:444-445 references/mitre-attack-mapping.md:445-448 references/mitre-attack-mapping.md:448-460 references/mitre-attack-mapping.md:460-467 references/mitre-attack-mapping.md:467-468 references/mitre-attack-mapping.md:468-471 references/mitre-attack-mapping.md:471-485 references/mitre-attack-mapping.md:485-490 references/mitre-attack-mapping.md:490-491 references/mitre-attack-mapping.md:491-494 references/mitre-attack-mapping.md:494-500 references/mitre-attack-mapping.md:500-507 references/mitre-attack-mapping.md:507-508 references/mitre-attack-mapping.md:508-511 references/mitre-attack-mapping.md:511-523 references/mitre-attack-mapping.md:523-528 references/mitre-attack-mapping.md:528-529 references/mitre-attack-mapping.md:529-532 references/mitre-attack-mapping.md:532-540 references/mitre-attack-mapping.md:540-547 references/mitre-attack-mapping.md:547-548 references/mitre-attack-mapping.md:548-551 references/mitre-attack-mapping.md:551-563 references/mitre-attack-mapping.md:563-568 references/mitre-attack-mapping.md:568-571 references/mitre-attack-mapping.md:571-582 references/mitre-attack-mapping.md:582-587 references/mitre-attack-mapping.md:587-588 references/mitre-attack-mapping.md:588-591 references/mitre-attack-mapping.md:591-597 references/mitre-attack-mapping.md:59 references/mitre-attack-mapping.md:65 references/mitre-attack-mapping.md:68 references/mitre-attack-mapping.md:69 references/mitre-attack-mapping.md:73 references/mitre-attack-mapping.md:77 references/mitre-attack-mapping.md:165 references/mitre-attack-mapping.md:188 references/mitre-attack-mapping.md:91 references/mitre-attack-mapping.md:94 references/vql-patterns.md:21-36 references/vql-patterns.md:36-40 references/vql-patterns.md:40-57 references/vql-patterns.md:57-61 references/vql-patterns.md:61-71 references/vql-patterns.md:71-77 references/vql-patterns.md:77-92 references/vql-patterns.md:92-96 references/vql-patterns.md:96-107 references/vql-patterns.md:107-111 references/vql-patterns.md:111-128 references/vql-patterns.md:128-134 references/vql-patterns.md:134-148 references/vql-patterns.md:148-152 references/vql-patterns.md:152-165 references/vql-patterns.md:165-169 references/vql-patterns.md:169-178 references/vql-patterns.md:178-184 references/vql-patterns.md:184-198 references/vql-patterns.md:198-202 references/vql-patterns.md:202-213 references/vql-patterns.md:213-217 references/vql-patterns.md:217-227 references/vql-patterns.md:227-233 references/vql-patterns.md:233-243 references/vql-patterns.md:243-247 references/vql-patterns.md:247-259 references/vql-patterns.md:259-265 references/vql-patterns.md:265-276 references/vql-patterns.md:276-280 references/vql-patterns.md:280-289 references/vql-patterns.md:289-293 references/vql-patterns.md:293-302 references/vql-patterns.md:302-308 references/vql-patterns.md:308-332 references/vql-patterns.md:332-336 references/vql-patterns.md:336-344 references/vql-patterns.md:344-350 references/vql-patterns.md:350-362 references/vql-patterns.md:362-366 references/vql-patterns.md:366-376 references/vql-patterns.md:376-380 references/vql-patterns.md:380-390 references/vql-patterns.md:390-396 references/vql-patterns.md:396-410 references/vql-patterns.md:410-414 references/vql-patterns.md:414-421 references/vql-patterns.md:421-425 references/vql-patterns.md:425-436 references/vql-patterns.md:436-442 references/vql-patterns.md:442-460 references/vql-patterns.md:460-464 references/vql-patterns.md:464-471 references/vql-patterns.md:471-475 references/vql-patterns.md:475-488 references/vql-patterns.md:488-494 references/vql-patterns.md:494-512 references/vql-patterns.md:512-516 references/vql-patterns.md:516-535 references/vql-patterns.md:28 references/vql-patterns.md:476 references/WORKFLOW_CHECKLIST.md:74 SKILL.md:41-50 SKILL.md:50-54 SKILL.md:54-66 SKILL.md:66-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-88 SKILL.md:88-89 SKILL.md:89-90 SKILL.md:90-127 SKILL.md:127-137 SKILL.md:137-145 SKILL.md:145-151 SKILL.md:151-157 SKILL.md:157-169 SKILL.md:169-175 SKILL.md:175-181 SKILL.md:181-187 SKILL.md:187-194 SKILL.md:194-202 SKILL.md:202-221 SKILL.md:221-244 SKILL.md:244-245 SKILL.md:245-253 SKILL.md:253-284 SKILL.md:284-286 SKILL.md:286-293 SKILL.md:293-303 SKILL.md:303-308 SKILL.md:308-310 SKILL.md:310-311 SKILL.md:311-312 SKILL.md:312-314 SKILL.md:314-316 SKILL.md:316-317 SKILL.md:317-318 SKILL.md:318-319 SKILL.md:319-321 SKILL.md:321-323 SKILL.md:323-324 SKILL.md:324-325 SKILL.md:111 SKILL.md:149 SKILL.md:193 SKILL.md:209
📁 Filesystem access (3)
🔑 Env variables (29)
assets/ci-config-template.yml:164 assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/deployment-guide.md:231 references/deployment-guide.md:236 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Audited by: claude
Jan 10, 2026, 10:42 AM
Pure documentation skill containing only markdown reference files and YAML templates. No executable code, no network calls, no file system access, no command execution. Legitimate Velociraptor DFIR documentation for incident response professionals.
12
Files scanned
4,778
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 10:42 AM
Pure documentation skill containing only markdown reference files and YAML templates. No executable code, no network calls, no file system access, no command execution. Legitimate Velociraptor DFIR documentation for incident response professionals.
12
Files scanned
4,778
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 10, 2026, 10:42 AM
Pure documentation skill containing only markdown reference files and YAML templates. No executable code, no network calls, no file system access, no command execution. Legitimate Velociraptor DFIR documentation for incident response professionals.
12
Files scanned
4,778
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude