Versioned security assessment

Report ID: SA-3E4B6C31

7/9/2026, 7:42:37 AM

memory-forensics security assessment v4

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
memory-forensics
Version
v4
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/memory-forensics
Coverage
1 Files scanned · 492 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most code fence, PowerShell, Cobalt Strike, rootkit, and reconnaissance alerts are false positives because the skill is Markdown guidance for offline memory analysis. Confirmed risks remain for privileged live memory acquisition, direct /dev/mem and /proc/kcore access, temporary storage of RAM images, process-memory dumping, and credential extraction guidance.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 492 Lines analyzed

12 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 7 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 53 evidence locations

Capability review items (11)
High
SKILL.md:49
sudo privilege escalation
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command loads a kernel memory acquisition module with sudo and writes a full RAM image. This requires elevated privileges and can expose secrets from the live host.
High
SKILL.md:52
sudo privilege escalation
sudo dd if=/dev/mem of=memory.raw bs=1M
The command uses sudo to read /dev/mem into a raw memory image. Direct physical memory access is highly sensitive and can bypass normal data boundaries.
High
SKILL.md:55
sudo privilege escalation
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore with sudo, which can expose kernel and process memory. This is a legitimate forensic action only under strict authorization.
High
SKILL.md:61
sudo privilege escalation
sudo ./osxpmem -o memory.raw
The command runs a macOS memory acquisition tool with sudo. It can capture sensitive system memory and should be limited to authorized evidence collection.
High
SKILL.md:54
Linux /proc filesystem access
# /proc/kcore (ELF format)
The line introduces /proc/kcore as a memory acquisition source, and the following line shows copying it. /proc/kcore can expose live kernel and process memory.
High
SKILL.md:55
Linux /proc filesystem access
sudo cp /proc/kcore memory.elf
The command copies /proc/kcore into an evidence file. That file can contain highly sensitive live memory, including credentials and process data.
High
SKILL.md:51
Non-standard device file access
# /dev/mem (limited, requires permissions)
The line introduces /dev/mem as an acquisition source, and the following line shows direct copying. /dev/mem access can expose raw physical memory.
High
SKILL.md:52
Non-standard device file access
sudo dd if=/dev/mem of=memory.raw bs=1M
The command reads /dev/mem into a raw dump. Direct device memory access is sensitive and can collect secrets outside normal file permissions.
High
SKILL.md:49
Temp directory access
sudo insmod lime.ko "path=/tmp/memory.lime format=lime"
The command writes a full memory image to /tmp. Shared temporary paths can expose highly sensitive RAM captures to other local users or cleanup races.
High
SKILL.md:114
Memory-mapped file access
vol -f memory.raw windows.memmap --pid <PID> --dump
The command dumps a selected process memory map from a forensic image. This is legitimate for incident response but can expose credentials, keys, or executable payloads.
High
SKILL.md:451
Memory-mapped file access
vol -f memory.raw windows.memmap --pid 1234 --dump
The command dumps process memory before string extraction. This can reveal sensitive user data and secrets from the captured process address space.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 High
SKILL.md:375-388
Credential Extraction Guidance
The skill includes a credential extraction section with hashdump, LSA secrets, cached domain credentials, and Mimikatz-style extraction from memory. This can expose reusable secrets if used outside authorized forensic investigations.
The section explicitly covers credential material extraction from memory dumps. The overall forensic context suggests legitimate use, but the data exposure risk is direct.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Privileged live memory acquisition examples
    Add explicit authorization requirements and replace raw /dev/mem or /proc/kcore examples with safer acquisition tooling guidance.
  2. FIX-002
    High
    Sensitive RAM image storage
    Avoid writing full memory images to shared temporary paths. Recommend encrypted evidence storage with restrictive permissions.
  3. FIX-003
    High
    Credential extraction guidance
    Limit credential recovery steps to approved incident response and require redaction, need-to-know handling, and legal approval.
  4. FIX-004
    Medium
    Dual-use detection examples
    Label Cobalt Strike, rootkit, and YARA material as detection-only and remove any wording that suggests offensive use.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable