📦

ffind

Name: ffind
Author: BrownFineSecurity

Content revision r2 High Risk ⚙️ External commands📁 Filesystem access

Analyze Firmware Filesystems with ffind

Firmware images can hide filesystems and security artifacts that are difficult to locate. This skill guides ffind analysis, type detection, and optional filesystem extraction.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "ffind" from https://skillstore.io/skills/brownfinesecurity-ffind.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-ffind/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/brownfinesecurity-ffind.md Signed manifest GET /api/skills/brownfinesecurity-ffind/manifest Signed lockfile GET /api/skills/brownfinesecurity-ffind/lockfile

Test it

Using "ffind". Analyze router-firmware.bin without extracting files.

Expected outcome:

The analysis identifies the main file categories, highlights embedded filesystem signatures, and recommends whether deeper extraction is warranted.

Using "ffind". Extract supported filesystems from device.img into a controlled workspace.

Expected outcome:

The response verifies the correct ffind binary and dependencies, explains privilege requirements, requests confirmation, and summarizes extracted locations after completion.

Using "ffind". Compare two firmware images and show all detected types.

Expected outcome:

A concise inventory for each image.
A comparison of filesystem and artifact differences.
Suggested directories or binaries for further review.

Security Audit

High Risk

v10 • 7/23/2026 Open versioned report

Eighteen external-command alerts are false positives caused by Markdown formatting, not Ruby backtick execution. Four sudo instructions are confirmed because extraction runs firmware tooling with root privileges; two temporary extraction paths add shared-directory risk. No prompt injection, exfiltration, or hidden execution instructions were found.

Files scanned

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

SKILL.md:36-40 SKILL.md:49-52

Privileged parsing of untrusted firmware images

The workflow combines filesystem extraction from firmware with sudo. Crafted input reaches filesystem tooling with root privileges, increasing host impact if parsing fails.

The documented workflow explicitly combines firmware input, filesystem extraction, and sudo. Exploitability depends on ffind and its external parser implementations.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:39

sudo privilege escalation

- Requires sudo privileges for extraction

Line 39 states that extraction requires sudo. This gives firmware extraction tooling root privileges, increasing host impact if input or parsing is unsafe.

High

SKILL.md:51

sudo privilege escalation

sudo ffind /path/to/firmware.bin -e

Line 51 explicitly runs ffind extraction through sudo. The command grants full root privileges while processing a firmware image.

High

SKILL.md:61

sudo privilege escalation

sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction

Line 61 explicitly runs extraction through sudo and writes into /tmp. This combines root execution with writes to a shared filesystem area.

High

SKILL.md:67

sudo privilege escalation

- Extraction requires root/sudo privileges

Line 67 repeats that extraction requires root or sudo privileges. Privileged processing of firmware is a real operational security risk.

Medium

SKILL.md:40

Temp directory access

- Default extraction location: `/tmp/ffind_<timestamp>`

Line 40 documents extraction into shared /tmp while extraction requires sudo. Safety depends on secure private-directory creation, which the skill does not establish.

Medium

SKILL.md:61

Temp directory access

sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction

Line 61 directs root extraction to the fixed shared path /tmp/my-extraction. Existing symlinks or attacker-controlled contents could redirect writes unless ffind protects the path.

Risk Factors

⚙️ External commands (22)

📁 Filesystem access (2)

SKILL.md:40 SKILL.md:61

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/brownfinesecurity-ffind/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/brownfinesecurity-ffind/security.svg)](https://skillstore.io/skills/brownfinesecurity-ffind?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/brownfinesecurity-ffind?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-ffind/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-ffind.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

BrownFineSecurity. (2026). ffind security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-ffind/audits/10

BibTeX citation

@techreport{brownfinesecurity-brownfinesecurity-ffind-2026,
  author = {BrownFineSecurity},
  title = {ffind security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/brownfinesecurity-ffind/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ffind security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "BrownFineSecurity"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/brownfinesecurity-ffind/audits/10"
identifiers:
  - type: other
    value: "skillstore:brownfinesecurity-ffind:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Triage a firmware image

Identify embedded file types and security artifacts before deciding whether extraction is necessary.

Extract an IoT root filesystem

Extract a supported filesystem into a controlled directory for configuration and binary review.

Compare firmware build contents

Analyze several images with consistent options and summarize differences in detected file types.

Try These Prompts

Identify firmware artifacts

Analyze [firmware path] with ffind. Report detected artifact types, do not extract files, and verify that the iothackbot ffind binary is selected.

Show every detected type

Analyze [path] with ffind and include all file types. Summarize the main categories and note any filesystem images.

Prepare a controlled extraction

Prepare to extract supported filesystems from [firmware path] into [output directory]. Verify dependencies, explain sudo use, and request confirmation before execution.

Compare multiple firmware images

Analyze [image one] and [image two] with verbose output. Compare detected filesystems and security artifacts, then recommend targeted follow-up inspection.

Best Practices

Verify the absolute path and help output of the iothackbot ffind binary before analysis.
Start with unprivileged type detection and request explicit confirmation before any sudo extraction.
Use a private output directory inside an isolated environment when processing untrusted firmware.

Avoid

Do not run an unverified ffind command because The Sleuth Kit provides a different binary with the same name.
Do not extract untrusted images as root directly on a production workstation.
Do not write privileged extraction output into a fixed shared temporary directory.

Frequently Asked Questions

What does this skill analyze?

It analyzes files and directories, identifies file types, and highlights artifacts relevant to firmware and IoT security review.

Which filesystems can it extract?

The documented extraction support covers ext2, ext3, ext4, and F2FS filesystems.

Does basic analysis require sudo?

The instructions require sudo for extraction, not for ordinary file-type analysis.

Which external tools are required?

Extraction depends on e2fsprogs, f2fs-tools, and util-linux.

How do I avoid the ffind name collision?

Check ffind help output and invoke the iothackbot binary by its absolute repository path when another ffind is installed.

Can it analyze multiple files?

Yes. The documented command accepts multiple paths and can include all detected types with the -a option.

Developer Details

Author

BrownFineSecurity

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/BrownFineSecurity/iothackbot/tree/master/skills/ffind

Ref

a39a91716eadede5f4cdefd78178fed4e837a128

Maintenance freshness

7/24/2026

Usage

10 downloads · 269 views

File structure

📄 SKILL.md