📦
Audit History
memory-forensics - 5 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v5 Latest | Jul 9, 2026, 07:42 AM | 1 confirmed | 11 | No capability change |
| v4 | Jul 9, 2026, 07:42 AM | 1 confirmed | 11 | No capability change |
| v3 | Jul 7, 2026, 01:56 AM | 1 confirmed | 11 | No capability change |
| v2 | Jun 30, 2026, 05:04 PM | 2 confirmed | 4 | Network access |
| v1 | Feb 25, 2026, 09:36 AM | No confirmed findings | 0 | Baseline |
Audit version 5 Latest
Jul 9, 2026, 07:42 AM
Most code fence, PowerShell, Cobalt Strike, rootkit, and reconnaissance alerts are false positives because the skill is Markdown guidance for offline memory analysis. Confirmed risks remain for privileged live memory acquisition, direct /dev/mem and /proc/kcore access, temporary storage of RAM images, process-memory dumping, and credential extraction guidance.
1
Files scanned
492
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Credential Extraction Guidance
The skill includes a credential extraction section with hashdump, LSA secrets, cached domain credentials, and Mimikatz-style extraction from memory. This can expose reusable secrets if used outside authorized forensic investigations.
The section explicitly covers credential material extraction from memory dumps. The overall forensic context suggests legitimate use, but the data exposure risk is direct.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command loads a kernel memory acquisition module with sudo and writes a full RAM image. This requires elevated privileges and can expose secrets from the live host.
High
sudo privilege escalation
sudo dd if=/dev/mem of=memory.raw bs=1M
The command uses sudo to read /dev/mem into a raw memory image. Direct physical memory access is highly sensitive and can bypass normal data boundaries.
High
sudo privilege escalation
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore with sudo, which can expose kernel and process memory. This is a legitimate forensic action only under strict authorization.
High
sudo privilege escalation
sudo ./osxpmem -o memory.raw
The command runs a macOS memory acquisition tool with sudo. It can capture sensitive system memory and should be limited to authorized evidence collection.
High
Linux /proc filesystem access
# /proc/kcore (ELF format)
The line introduces /proc/kcore as a memory acquisition source, and the following line shows copying it. /proc/kcore can expose live kernel and process memory.
High
Linux /proc filesystem access
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore into an evidence file. That file can contain highly sensitive live memory, including credentials and process data.
High
Non-standard device file access
# /dev/mem (limited, requires permissions)
The line introduces /dev/mem as an acquisition source, and the following line shows direct copying. /dev/mem access can expose raw physical memory.
High
Non-standard device file access
sudo dd if=/dev/mem of=memory.raw bs=1M
The command reads /dev/mem into a raw dump. Direct device memory access is sensitive and can collect secrets outside normal file permissions.
High
Temp directory access
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command writes a full memory image to /tmp. Shared temporary paths can expose highly sensitive RAM captures to other local users or cleanup races.
High
Memory-mapped file access
vol -f memory.raw windows.memmap --pid <PID> --dump
The command dumps a selected process memory map from a forensic image. This is legitimate for incident response but can expose credentials, keys, or executable payloads.
High
Memory-mapped file access
vol -f memory.raw windows.memmap --pid 1234 --dump
The command dumps process memory before string extraction. This can reveal sensitive user data and secrets from the captured process address space.
Risk Factors
⚙️ External commands (50)
SKILL.md:25 SKILL.md:32-44 SKILL.md:44-47 SKILL.md:47-56 SKILL.md:56-59 SKILL.md:59-64 SKILL.md:64-68 SKILL.md:68-80 SKILL.md:80-86 SKILL.md:86-98 SKILL.md:98-103 SKILL.md:103-121 SKILL.md:121-124 SKILL.md:124-130 SKILL.md:130-133 SKILL.md:133-145 SKILL.md:145-148 SKILL.md:148-157 SKILL.md:157-160 SKILL.md:160-169 SKILL.md:169-172 SKILL.md:172-181 SKILL.md:181-185 SKILL.md:185-206 SKILL.md:206-210 SKILL.md:210-222 SKILL.md:222-228 SKILL.md:228-251 SKILL.md:251-255 SKILL.md:255-275 SKILL.md:275-281 SKILL.md:281-307 SKILL.md:307-311 SKILL.md:311-330 SKILL.md:330-336 SKILL.md:336-354 SKILL.md:354-358 SKILL.md:358-373 SKILL.md:373-377 SKILL.md:377-389 SKILL.md:389-395 SKILL.md:395-424 SKILL.md:424-428 SKILL.md:428-437 SKILL.md:437-443 SKILL.md:443-456 SKILL.md:456-460 SKILL.md:460-466 SKILL.md:32 SKILL.md:49
🌐 Network access (1)
📁 Filesystem access (7)
Audited by: codex
Jul 9, 2026, 07:42 AM
Most code fence, PowerShell, Cobalt Strike, rootkit, and reconnaissance alerts are false positives because the skill is Markdown guidance for offline memory analysis. Confirmed risks remain for privileged live memory acquisition, direct /dev/mem and /proc/kcore access, temporary storage of RAM images, process-memory dumping, and credential extraction guidance.
1
Files scanned
492
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Credential Extraction Guidance
The skill includes a credential extraction section with hashdump, LSA secrets, cached domain credentials, and Mimikatz-style extraction from memory. This can expose reusable secrets if used outside authorized forensic investigations.
The section explicitly covers credential material extraction from memory dumps. The overall forensic context suggests legitimate use, but the data exposure risk is direct.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command loads a kernel memory acquisition module with sudo and writes a full RAM image. This requires elevated privileges and can expose secrets from the live host.
High
sudo privilege escalation
sudo dd if=/dev/mem of=memory.raw bs=1M
The command uses sudo to read /dev/mem into a raw memory image. Direct physical memory access is highly sensitive and can bypass normal data boundaries.
High
sudo privilege escalation
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore with sudo, which can expose kernel and process memory. This is a legitimate forensic action only under strict authorization.
High
sudo privilege escalation
sudo ./osxpmem -o memory.raw
The command runs a macOS memory acquisition tool with sudo. It can capture sensitive system memory and should be limited to authorized evidence collection.
High
Linux /proc filesystem access
# /proc/kcore (ELF format)
The line introduces /proc/kcore as a memory acquisition source, and the following line shows copying it. /proc/kcore can expose live kernel and process memory.
High
Linux /proc filesystem access
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore into an evidence file. That file can contain highly sensitive live memory, including credentials and process data.
High
Non-standard device file access
# /dev/mem (limited, requires permissions)
The line introduces /dev/mem as an acquisition source, and the following line shows direct copying. /dev/mem access can expose raw physical memory.
High
Non-standard device file access
sudo dd if=/dev/mem of=memory.raw bs=1M
The command reads /dev/mem into a raw dump. Direct device memory access is sensitive and can collect secrets outside normal file permissions.
High
Temp directory access
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command writes a full memory image to /tmp. Shared temporary paths can expose highly sensitive RAM captures to other local users or cleanup races.
High
Memory-mapped file access
vol -f memory.raw windows.memmap --pid <PID> --dump
The command dumps a selected process memory map from a forensic image. This is legitimate for incident response but can expose credentials, keys, or executable payloads.
High
Memory-mapped file access
vol -f memory.raw windows.memmap --pid 1234 --dump
The command dumps process memory before string extraction. This can reveal sensitive user data and secrets from the captured process address space.
Risk Factors
⚙️ External commands (50)
SKILL.md:25 SKILL.md:32-44 SKILL.md:44-47 SKILL.md:47-56 SKILL.md:56-59 SKILL.md:59-64 SKILL.md:64-68 SKILL.md:68-80 SKILL.md:80-86 SKILL.md:86-98 SKILL.md:98-103 SKILL.md:103-121 SKILL.md:121-124 SKILL.md:124-130 SKILL.md:130-133 SKILL.md:133-145 SKILL.md:145-148 SKILL.md:148-157 SKILL.md:157-160 SKILL.md:160-169 SKILL.md:169-172 SKILL.md:172-181 SKILL.md:181-185 SKILL.md:185-206 SKILL.md:206-210 SKILL.md:210-222 SKILL.md:222-228 SKILL.md:228-251 SKILL.md:251-255 SKILL.md:255-275 SKILL.md:275-281 SKILL.md:281-307 SKILL.md:307-311 SKILL.md:311-330 SKILL.md:330-336 SKILL.md:336-354 SKILL.md:354-358 SKILL.md:358-373 SKILL.md:373-377 SKILL.md:377-389 SKILL.md:389-395 SKILL.md:395-424 SKILL.md:424-428 SKILL.md:428-437 SKILL.md:437-443 SKILL.md:443-456 SKILL.md:456-460 SKILL.md:460-466 SKILL.md:32 SKILL.md:49
🌐 Network access (1)
📁 Filesystem access (7)
Audited by: codex
Jul 7, 2026, 01:56 AM
Most command-related findings are false positives caused by Markdown code fences in a documentation-only forensic guide. Confirmed risks remain for privileged live memory acquisition, raw /dev and /proc memory access, process memory dumping, and credential extraction guidance.
1
Files scanned
492
Lines analyzed
15
Review items
2
False positives ignored
Confirmed security concerns (1)
High
Credential Extraction Guidance
The skill documents hashdump, lsadump, cachedump, and Mimikatz-style credential extraction from memory. This is valid for authorized forensics but can also support credential theft if misused.
The credential extraction section explicitly lists memory plugins for hashes, LSA secrets, cached domain credentials, and Mimikatz-style extraction.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The documented command uses sudo to load a kernel memory acquisition module and write a RAM image. That is privileged live-system access that can expose secrets and affect host stability.
High
sudo privilege escalation
sudo dd if=/dev/mem of=memory.raw bs=1M
The documented command uses sudo to read /dev/mem into a raw memory image. This directly accesses sensitive physical memory and can disclose credentials or private data.
High
sudo privilege escalation
sudo cp /proc/kcore memory.elf
The documented command uses sudo to copy /proc/kcore into an ELF memory image. That provides privileged access to kernel memory and can disclose sensitive host data.
High
sudo privilege escalation
sudo ./osxpmem -o memory.raw
The documented macOS acquisition command runs a memory capture tool with sudo. Live privileged memory capture can expose secrets and should require explicit authorization.
High
Linux /proc filesystem access
# /proc/kcore (ELF format)
The section introduces /proc/kcore as a memory acquisition source. Accessing that interface is privileged kernel memory access with sensitive data exposure risk.
High
Linux /proc filesystem access
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore to a memory image using sudo. This can expose kernel memory and credentials from a live system.
High
Non-standard device file access
# /dev/mem (limited, requires permissions)
The section recommends /dev/mem as a live memory acquisition source. That device exposes raw physical memory and should be treated as high-risk.
High
Non-standard device file access
sudo dd if=/dev/mem of=memory.raw bs=1M
The command reads directly from /dev/mem into a raw image. Direct physical memory access can disclose secrets and may destabilize the host.
High
Memory-mapped file access
vol -f memory.raw windows.memmap --pid <PID> --dump
The command dumps process memory from a RAM image by PID. Process memory can contain credentials, tokens, private data, and malware artifacts.
High
Memory-mapped file access
vol -f memory.raw windows.memmap --pid 1234 --dump
The command dumps process memory for a specific PID from an image. This is legitimate forensic work but can expose sensitive runtime data.
Medium
Temp directory access
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The acquisition example writes a full memory image under /tmp. Temporary directories can have weaker handling controls for highly sensitive RAM captures.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Critical
Cobalt Strike keywords
description = "Detects Cobalt Strike beacon in memory"
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
Malware type keywords
### Rootkit Detection
Force-confirmed blocker/high static finding; AI dismissal overridden.
Risk Factors
⚙️ External commands (53)
SKILL.md:25 SKILL.md:32-44 SKILL.md:44-47 SKILL.md:47-56 SKILL.md:56-59 SKILL.md:59-64 SKILL.md:64-68 SKILL.md:68-80 SKILL.md:80-86 SKILL.md:86-98 SKILL.md:98-103 SKILL.md:103-121 SKILL.md:121-124 SKILL.md:124-130 SKILL.md:130-133 SKILL.md:133-145 SKILL.md:145-148 SKILL.md:148-157 SKILL.md:157-160 SKILL.md:160-169 SKILL.md:169-172 SKILL.md:172-181 SKILL.md:181-185 SKILL.md:185-206 SKILL.md:206-210 SKILL.md:210-222 SKILL.md:222-228 SKILL.md:228-251 SKILL.md:251-255 SKILL.md:255-275 SKILL.md:275-281 SKILL.md:281-307 SKILL.md:307-311 SKILL.md:311-330 SKILL.md:330-336 SKILL.md:336-354 SKILL.md:354-358 SKILL.md:358-373 SKILL.md:373-377 SKILL.md:377-389 SKILL.md:389-395 SKILL.md:395-424 SKILL.md:424-428 SKILL.md:428-437 SKILL.md:437-443 SKILL.md:443-456 SKILL.md:456-460 SKILL.md:460-466 SKILL.md:32 SKILL.md:49 SKILL.md:52 SKILL.md:55 SKILL.md:61
🌐 Network access (1)
📁 Filesystem access (7)
Audited by: codex
Jun 30, 2026, 05:04 PM
The static external-command findings are mostly markdown examples for forensic tools, not hidden code execution. However, the skill gives dual-use guidance for privileged live memory acquisition and credential extraction from memory, so it should not be published without additional review and safeguards.
1
Files scanned
492
Lines analyzed
9
Review items
1
False positives ignored
Confirmed security concerns (2)
High
Credential Extraction From Memory
The skill documents hashdump, lsadump, cachedump, and Mimikatz-style credential extraction from memory. These commands can support incident response, but they can also enable credential theft if used without authorization.
The section is clearly about extracting hashes, LSA secrets, and cached credentials. The document frames this as forensic analysis, but the misuse potential is direct and high.
Medium
Offensive Tooling References Used for Detection
The skill references process injection, rootkit behavior, shellcode patterns, and a Cobalt Strike YARA rule. These references are presented as detection content, so the Cobalt Strike static blocker appears to be contextual rather than malicious.
The static keywords are present, but the surrounding text consistently describes detection and analysis. I did not find evidence of payload generation, deployment, or evasion instructions.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Privileged Live Memory Acquisition Commands
The skill includes examples that load a kernel module, read /dev/mem, copy /proc/kcore, and run osxpmem with sudo. These are legitimate forensic techniques, but they require elevated access and can expose full system memory or affect a live host if misused.
The commands are explicit and require privileged access to live memory sources. The surrounding context is forensic acquisition, so the risk is dual-use rather than confirmed malicious.
Medium
Process Memory and File Dumping Workflows
Several examples dump process memory, suspicious executables, registry hives, and files from captured memory. This is normal memory forensics behavior, but dumped artifacts can contain secrets, private data, or malware samples.
The commands directly dump memory and artifacts. The risk is credible, but the examples are standard defensive forensic procedures.
Medium
Network and System Reconnaissance of Memory Images
The skill includes commands to enumerate processes, network connections, modules, mounts, environment variables, and command lines from memory images. These are expected forensic tasks, but they can reveal sensitive host and user data.
The commands clearly enumerate sensitive state from memory. They operate on memory captures rather than scanning third-party systems, which lowers the severity.
Low
Markdown Code Fences Flagged as Ruby Backticks
Many static external-command findings come from markdown code fences such as powershell, bash, c, python, and yara. These are examples in documentation, not executable Ruby backtick calls in code.
The flagged characters delimit markdown examples. There is no Ruby source file or executable wrapper in the skill.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Hardcoded URL Is Documentation
The hardcoded URL points to the Volatility symbol download location in a comment. It is not used for data exfiltration or automatic network access.
The URL appears only in an installation note. No command sends local data to that URL.
Risk Factors
⚙️ External commands (5)
🌐 Network access (1)
📁 Filesystem access (3)
Detected Patterns
Root Access to Live Memory DevicesCredential Dump Plugin UsageBulk Extraction of Memory Strings and Artifacts
Audited by: codex
Feb 25, 2026, 09:36 AM
This is a legitimate defensive security documentation skill for memory forensics. All 86 static findings are false positives: command examples are documentation for forensic tools (Volatility, WinPmem, LiME), Cobalt Strike references are YARA detection rules for defensive use, and privilege escalation patterns are standard forensic acquisition techniques. Safe for marketplace publication.
1
Files scanned
494
Lines analyzed
2
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (10)
📁 Filesystem access (4)
Detected Patterns
External Commands DocumentationCobalt Strike Detection RulePrivilege Escalation Patterns
Audited by: claude