Versioned security assessment

Report ID: SA-916F41D2

6/28/2026, 5:41:01 AM

ir-velociraptor security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ir-velociraptor
Version
v6
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/ir-velociraptor
Coverage
12 Files scanned · 4,889 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

7 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static findings are mostly explained by the skill being a Velociraptor DFIR guide, not by hidden malicious code. However, the content includes templates for broad endpoint collection, credential-adjacent artifact discovery, privileged service deployment, webhook notification, and shell-based installation patterns, so publication should require human review and strong warnings.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

12 Files scanned · 4,889 Lines analyzed

7 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 4 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Observed in 3 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 4 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 High
assets/offline-collector-config.yaml:20-79references/mitre-attack-mapping.md:315-331references/mitre-attack-mapping.md:335-350SKILL.md:227-235
Sensitive Endpoint and Credential-Adjacent Collection
The skill provides offline collector and MITRE mapping examples that can gather endpoint process, network, persistence, event log, file timeline, SAM hive, and browser credential-store evidence. This is expected for authorized DFIR, but it is high risk because misuse can expose sensitive host and user data.
The cited files explicitly describe sensitive evidence collection and warn that VQL can collect credentials, PII, and sensitive files. Legitimate incident response use is clear, but the data exposure risk is real.
RISK-002 High
references/deployment-guide.md:141-182references/deployment-guide.md:275-289references/deployment-guide.md:292-299references/deployment-guide.md:405-415
Privileged Deployment and Persistence-Like Service Instructions
Deployment guidance includes sudo commands, systemd service creation and enablement, Windows service installation, firewall changes, and NFS storage configuration. These are normal for Velociraptor administration but can create persistent privileged endpoint or server components if used outside approved scope.
The commands are administrative deployment steps rather than covert persistence. The risk remains high because they modify privileged services and host network controls.
RISK-003 High
assets/ci-config-template.yml:237-240
Pipe-to-Shell Install Pattern in CI Template
The CI template installs tfsec with curl piped directly to bash. This pattern executes remote content without pinning or verification and was correctly flagged as dangerous, even though it appears in a template rather than active runtime code.
The line directly pipes a downloaded installer to bash. The context is a GitHub Actions template, but the supply-chain risk is concrete if copied into production CI.
RISK-004 Medium
SKILL.md:52-65assets/hunt-template.yaml:186-210assets/hunt-template.yaml:39-60
Broad Hunt and Command Execution Templates
The hunt template and quick-start examples include Velociraptor commands that create hunts, monitor results, and export endpoint data. These are legitimate DFIR workflows, but mistakes in target labels, parameters, or authorization can collect data at enterprise scale.
The commands are explicit and operational. The examples do not show malicious intent, so medium severity is appropriate when paired with the high-risk data collection findings.
RISK-005 Medium
assets/hunt-template.yaml:137-139assets/artifact-template.yaml:124-132references/deployment-guide.md:345-359
Webhook, URL, and Example Network Endpoints
Several network findings are placeholders or documentation links, including a Slack webhook placeholder and example URLs. These are mostly safe as examples, but users could accidentally commit real webhook URLs or route investigation data to external services.
The URLs are placeholders or public documentation in the reviewed snippets. The remaining risk is operational leakage if users replace placeholders with real secrets in shared templates.
RISK-006 Medium
assets/ci-config-template.yml:30-34assets/ci-config-template.yml:161-164assets/ci-config-template.yml:317-323
CI Token and Filesystem Access in Workflow Template
The CI workflow uses the GitHub token for security scanning and reads a generated report before posting a pull request comment. This is a common workflow pattern, but it requires least-privilege permissions and careful handling of report content.
The token and filesystem access are visible and semantically legitimate for GitHub Actions. Risk depends on repository permissions and whether report content can contain untrusted text.
RISK-007 Low
SKILL.md:153-169references/vql-patterns.md:180-197references/vql-patterns.md:412-420
Reconnaissance Keywords Are Expected For Forensic Queries
System, network, registry, and USB enumeration queries are core Velociraptor forensic techniques. They are not hidden reconnaissance behavior in the skill itself, but they should run only within an authorized investigation.
The query intent is clearly defensive evidence collection. The risk is contextual misuse, not a false claim about the files containing enumeration logic.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
assets/artifact-template.yaml:45-48assets/rule-template.yaml:235-286SKILL.md:227-231
Weak Cryptography Alerts Are Mostly Documentation False Positives
Many weak cryptography alerts are caused by security-rule examples, artifact metadata, or text about hashing. The reviewed artifact template uses SHA256, and the security rule template explains weak crypto detection rather than using weak algorithms in the skill.
The cited context shows documentation and detection rules rather than executable weak cryptographic operations. Other static weak-crypto hits should still be treated as review signals in this security domain.
Low
references/EXAMPLE.md:133-140references/EXAMPLE.md:415-425
Educational Vulnerability Examples Trigger Script and Secret Rules
The example reference includes intentionally vulnerable XSS snippets and secure API-key handling examples. These are educational examples, not active application code executed by the skill.
The lines are inside markdown examples that explain vulnerable and safer patterns. They do not create a runtime XSS or secret-exfiltration path in this skill.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable