Versioned security assessment

Report ID: SA-CF96DC82

7/6/2026, 12:42:10 AM

ir-velociraptor security assessment v7

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
ir-velociraptor
Version
v7
Maintainer
AgentSecOps
Source
github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/ir-velociraptor
Coverage
12 Files scanned · 4,889 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

5 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static detections are defensive Velociraptor, MITRE, and security-rule examples rather than hidden malicious behavior. Confirmed risks are concentrated in operational templates: curl-to-shell CI installation, privileged service and firewall commands, broad network binding, /tmp client configuration output, and broad endpoint collection defaults.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

12 Files scanned · 4,889 Lines analyzed

38 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 2 evidence locations

Network access

May connect to external services.

Observed in 52 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Observed in 20 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 99 evidence locations

Capability review items (33)
High
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
This line downloads an installer script from GitHub and executes it through a shell pipeline. That creates a supply-chain risk if the remote script or transport is compromised.
High
references/deployment-guide.md:278
PowerShell invocation
```powershell
The PowerShell block installs and starts a Windows Velociraptor service. This is expected deployment guidance, but it changes endpoint persistence and requires administrator approval.
High
references/deployment-guide.md:81
sudo privilege escalation
sudo mv velociraptor-v0.72.3-linux-amd64 /usr/local/bin/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:145
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor.service <<'EOF'
This command writes a systemd unit under /etc/systemd/system. Creating persistent services is a high-impact administrative action even when used for legitimate DFIR deployment.
High
references/deployment-guide.md:173
sudo privilege escalation
sudo useradd -r -s /bin/false velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:176
sudo privilege escalation
sudo mkdir -p /etc/velociraptor /var/lib/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:177
sudo privilege escalation
sudo chown -R velociraptor:velociraptor /etc/velociraptor /var/lib/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:180
sudo privilege escalation
sudo systemctl daemon-reload
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:181
sudo privilege escalation
sudo systemctl enable velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:182
sudo privilege escalation
sudo systemctl start velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:215
sudo privilege escalation
sudo apt install certbot
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:218
sudo privilege escalation
sudo certbot certonly --standalone \
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:272
sudo privilege escalation
# Install: sudo dpkg -i velociraptor-client.deb
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:295
sudo privilege escalation
sudo cp velociraptor /usr/local/bin/
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:296
sudo privilege escalation
sudo cp client.config.yaml /etc/velociraptor/
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:299
sudo privilege escalation
sudo cat > /etc/systemd/system/velociraptor-client.service <<'EOF'
This command writes a client systemd unit that runs Velociraptor as root. Endpoint persistence as root must be explicitly approved and hardened.
High
references/deployment-guide.md:315
sudo privilege escalation
sudo systemctl enable velociraptor-client
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:316
sudo privilege escalation
sudo systemctl start velociraptor-client
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:380
sudo privilege escalation
sudo apt install nfs-kernel-server
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:381
sudo privilege escalation
sudo mkdir -p /export/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:382
sudo privilege escalation
sudo chown nobody:nogroup /export/velociraptor
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:388
sudo privilege escalation
sudo mount -t nfs nfs-server:/export/velociraptor /var/lib/velociraptor
This command mounts shared storage into the Velociraptor datastore path. Incorrect NFS permissions can expose evidence or corrupt forensic data.
High
references/deployment-guide.md:408
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8000 -j ACCEPT
This command changes host firewall policy for the Velociraptor frontend. Opening service ports is a real network exposure and should be scoped tightly.
High
references/deployment-guide.md:411
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -s 10.0.0.0/8 -j ACCEPT
This command permits GUI access from a broad private network range. Administrative console access should be restricted to a narrow management network.
High
references/deployment-guide.md:412
sudo privilege escalation
sudo iptables -A INPUT -p tcp --dport 8889 -j DROP
This command changes firewall policy for the GUI service. The deny rule is useful, but copied firewall changes still require careful ordering and validation.
High
references/deployment-guide.md:415
sudo privilege escalation
sudo iptables-save > /etc/iptables/rules.v4
This is a concrete sudo command that modifies system binaries, services, storage, certificates, or firewall state. It is legitimate Velociraptor administration but remains a privileged operation requiring operator review.
High
references/deployment-guide.md:385
Hardcoded IP address
/export/velociraptor 10.0.1.0/24(rw,sync,no_subtree_check,no_root_squash)
The NFS export example combines a fixed subnet with no_root_squash. If copied, it can permit root-level writes from clients to shared Velociraptor storage.
Medium
references/deployment-guide.md:515
Unix shell invocation
#!/bin/bash
The shell script backs up Velociraptor datastore and configuration files. It is operationally valid, but copied scripts must protect sensitive server configuration and backup paths.
Medium
references/deployment-guide.md:77
Hardcoded URL
wget https://github.com/Velocidex/velociraptor/releases/download/v0.72/velociraptor-v0.72.3-linux-am
The guide downloads a Velociraptor binary from a release URL without showing checksum or signature verification. That is a real supply-chain hardening gap for deployment instructions.
Medium
references/deployment-guide.md:117
Hardcoded IP address
bind_address: 0.0.0.0
The API bind address is set to 0.0.0.0, which exposes the service on all interfaces if copied. Administrative services should bind to a management interface or localhost where possible.
Medium
references/deployment-guide.md:122
Hardcoded IP address
bind_address: 0.0.0.0
The GUI bind address is set to 0.0.0.0, which can expose the console broadly. The example needs stronger default binding guidance before publication.
Medium
references/deployment-guide.md:132
Hardcoded IP address
bind_address: 0.0.0.0
The frontend bind address listens on all interfaces. That can be appropriate for clients, but it is still a network exposure requiring firewall and TLS controls.
Medium
references/deployment-guide.md:246
Temp directory access
config client > /tmp/client.config.yaml
The client configuration is written to /tmp, which can expose enrollment material or deployment configuration on shared systems. A restricted temporary directory is safer.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (5)

RISK-001 Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The template uses a curl-to-bash installer pattern. Executing unaudited remote code in CI can compromise build credentials and artifacts.
RISK-002 High
references/deployment-guide.md:181
Systemd service enablement
sudo systemctl enable velociraptor
The guide enables a persistent Velociraptor server service. This is legitimate administration, but persistent privileged services need explicit authorization and hardening.
RISK-003 High
references/deployment-guide.md:315
Systemd service enablement
sudo systemctl enable velociraptor-client
The guide enables a persistent Velociraptor client service. Client persistence across endpoints is expected for DFIR, but it is high impact if run outside approved scope.
RISK-004 Medium
assets/offline-collector-config.yaml:20-79SKILL.md:229-231
Broad Endpoint Collection Requires Authorization
The offline collector template gathers process, network, persistence, event log, file timeline, USB, and optional browser history evidence. This is appropriate for DFIR, but it can collect sensitive user and system data without technical enforcement of authorization.
The collector artifact list and the skill security notes both acknowledge broad evidence and sensitive data collection. The risk is contextual misuse, not hidden malicious code.
RISK-005 Medium
assets/hunt-template.yaml:40-57
Default Hunt Template Targets All Clients
The hunt template sets include_all to true before listing narrower label and operating system filters. If copied without adjustment, a hunt can run across all enrolled endpoints and create operational or privacy impact.
The target section explicitly includes all clients and only later shows optional exclusions. This is a realistic configuration risk for production hunts.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly into bash in the CI template.
    Replace curl-to-shell with a pinned package or release asset, verify checksums or signatures, and document the trust boundary.
  2. FIX-002
    High
    Deployment guidance includes many privileged commands and persistent service enablement steps.
    Add explicit approval gates, least-privilege defaults, rollback steps, and warnings before systemd, firewall, and service installation commands.
  3. FIX-003
    High
    Several examples bind services broadly or expose shared storage with risky defaults.
    Prefer management-interface binding, narrow firewall source ranges, TLS verification, and remove no_root_squash from NFS examples.
  4. FIX-004
    Medium
    Client configuration is written to /tmp in the deployment guide.
    Write client configuration to a restricted directory, set strict file permissions, and remove temporary files after packaging.
  5. FIX-005
    Medium
    Collector and hunt templates can gather sensitive endpoint data at broad scope.
    Default to scoped labels, require documented authorization, minimize artifacts, and encrypt evidence archives by default.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (35)
Critical
references/mitre-attack-mapping.md:347
Browser credential files
"C:/Users/*/AppData/Local/Google/Chrome/User Data/*/Login Data",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
references/mitre-attack-mapping.md:338
Windows DPAPI access
- `Windows.Forensics.DPAPI`
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
references/mitre-attack-mapping.md:328
Windows SAM/registry hive access
"C:/Windows/System32/config/SAM",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
references/mitre-attack-mapping.md:329
Windows SAM/registry hive access
"C:/Windows/System32/config/SYSTEM",
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
references/mitre-attack-mapping.md:330
Windows SAM/registry hive access
"C:/Windows/System32/config/SECURITY"
Force-confirmed sensitive/critical static finding; AI dismissal overridden.
Critical
SKILL.md:241
Ransomware keywords
### Pattern: Ransomware Investigation
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
SKILL.md:248
Ransomware keywords
6. Extract: Ransomware binary samples for malware analysis
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
assets/hunt-template.yaml:112
C2 keywords
- "Connections to known C2 infrastructure"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/artifact-development.md:410
C2 keywords
192.0.2.1,C2 Server
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/artifact-development.md:446
Windows registry access
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/**
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/EXAMPLE.md:276
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:16
C2 keywords
- [Command and Control](#command-and-control)
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:504
C2 keywords
### T1041: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:138
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:139
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnce/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:141
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Microsoft/Windows/CurrentVersion/Run/*"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:161
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/*")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:262
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows Defender/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:263
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Policies/Microsoft/Windows Defender/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/mitre-attack-mapping.md:264
Windows registry access
"HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/WinDefend/**"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:164
Malware type keywords
OR FullPath =~ "(?i)(cmd|shell|upload|backdoor|c99)"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:191
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:192
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnce/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:194
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Microsoft/Windows/CurrentVersion/Run/*",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:195
Windows registry access
"HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/*"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:207
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:208
Windows registry access
"HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/**",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:223
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Windows/AppInit_DLLs",
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:224
Windows registry access
"HKEY_LOCAL_MACHINE/SOFTWARE/WOW6432Node/Microsoft/Windows NT/CurrentVersion/Windows/AppInit_DLLs"
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:311
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:318
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/**/ImagePath")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:419
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Enum/USBSTOR/**/FriendlyName")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/vql-patterns.md:531
Windows registry access
FROM glob(globs="HKEY_LOCAL_MACHINE/SOFTWARE/**", accessor="registry")
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
references/WORKFLOW_CHECKLIST.md:193
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
SKILL.md:192
Windows registry access
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*")
Force-confirmed blocker/high static finding; AI dismissal overridden.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable