Versioned security assessment

Report ID: SA-81E05E63

8/4/2026, 3:46:21 PM

network-101 security assessment v6

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
network-101
Version
v6
Maintainer
zebbern
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/network-101
Coverage
1 Files scanned · 360 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

7 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is an authorized network-lab guide, and many alerts are false positives caused by Markdown fences, documentation labels, and private example addresses. Privileged host changes, service persistence, active network enumeration, and binding to all interfaces are confirmed risks. Weak SNMP, anonymous writable SMB, and credential-form examples require stronger isolation and handling guidance.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 360 Lines analyzed

37 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 17 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 60 evidence locations

Capability review items (30)
High
SKILL.md:62
sudo privilege escalation
sudo apt update && sudo apt install apache2
This command installs or updates system packages with root privileges on line 62. It changes the host and requires explicit operator approval.
High
SKILL.md:65
sudo privilege escalation
sudo systemctl start apache2
This root command changes a system service on line 65, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:66
sudo privilege escalation
sudo systemctl enable apache2
This root command changes a system service on line 66, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:69
sudo privilege escalation
echo "<html><body><h1>Test Page</h1></body></html>" | sudo tee /var/www/html/index.html
This command writes content into a root-owned system or service path on line 69. It makes a privileged host change that requires explicit approval.
High
SKILL.md:79
sudo privilege escalation
sudo ufw allow 80/tcp
This root command changes the host firewall on line 79 and exposes an inbound service. An incorrect target or environment could expand network access.
High
SKILL.md:93
sudo privilege escalation
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
This root command creates a private key and certificate in system directories on line 93. It writes security-sensitive host configuration and needs operator approval.
High
SKILL.md:98
sudo privilege escalation
sudo a2enmod ssl
This command writes content into a root-owned system or service path on line 98. It makes a privileged host change that requires explicit approval.
High
SKILL.md:99
sudo privilege escalation
sudo systemctl restart apache2
This root command changes a system service on line 99, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:106
sudo privilege escalation
sudo nano /etc/apache2/sites-available/default-ssl.conf
This command opens a root-owned service configuration file for modification on line 106. Incorrect edits can weaken or disrupt the host service.
High
SKILL.md:109
sudo privilege escalation
sudo a2ensite default-ssl
This command writes content into a root-owned system or service path on line 109. It makes a privileged host change that requires explicit approval.
High
SKILL.md:110
sudo privilege escalation
sudo systemctl reload apache2
This root command changes a system service on line 110, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:134
sudo privilege escalation
sudo apt install snmpd snmp
This command installs or updates system packages with root privileges on line 134. It changes the host and requires explicit operator approval.
High
SKILL.md:137
sudo privilege escalation
sudo nano /etc/snmp/snmpd.conf
This command opens a root-owned service configuration file for modification on line 137. Incorrect edits can weaken or disrupt the host service.
High
SKILL.md:144
sudo privilege escalation
sudo systemctl restart snmpd
This root command changes a system service on line 144, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:185
sudo privilege escalation
sudo apt install samba
This command installs or updates system packages with root privileges on line 185. It changes the host and requires explicit operator approval.
High
SKILL.md:188
sudo privilege escalation
sudo install -d -m 0770 -o root -g sambashare /srv/samba/share
This root command creates a service directory and assigns permissions on line 188. It changes filesystem ownership and access controls on the host.
High
SKILL.md:191
sudo privilege escalation
sudo nano /etc/samba/smb.conf
This command opens a root-owned service configuration file for modification on line 191. Incorrect edits can weaken or disrupt the host service.
High
SKILL.md:201
sudo privilege escalation
sudo systemctl restart smbd
This root command changes a system service on line 201, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:231
sudo privilege escalation
sudo tail -f /var/log/apache2/access.log
This command reads service logs with root privileges on line 231. Logs can contain sensitive request data and should only be accessed on authorized systems.
High
SKILL.md:234
sudo privilege escalation
sudo tail -f /var/log/apache2/error.log
This command reads service logs with root privileges on line 234. Logs can contain sensitive request data and should only be accessed on authorized systems.
High
SKILL.md:303
sudo privilege escalation
sudo apt install apache2
This command installs or updates system packages with root privileges on line 303. It changes the host and requires explicit operator approval.
High
SKILL.md:304
sudo privilege escalation
sudo systemctl start apache2
This root command changes a system service on line 304, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:307
sudo privilege escalation
cat << 'EOF' | sudo tee /var/www/html/login.html
This command writes content into a root-owned system or service path on line 307. It makes a privileged host change that requires explicit approval.
High
SKILL.md:320
sudo privilege escalation
sudo ufw allow 80/tcp
This root command changes the host firewall on line 320 and exposes an inbound service. An incorrect target or environment could expand network access.
High
SKILL.md:327
sudo privilege escalation
sudo apt install snmpd
This command installs or updates system packages with root privileges on line 327. It changes the host and requires explicit operator approval.
High
SKILL.md:328
sudo privilege escalation
echo "rocommunity public" | sudo tee -a /etc/snmp/snmpd.conf
This command writes content into a root-owned system or service path on line 328. It makes a privileged host change that requires explicit approval.
High
SKILL.md:329
sudo privilege escalation
sudo systemctl restart snmpd
This root command changes a system service on line 329, affecting availability or startup behavior. Running it outside an isolated lab could alter a real host.
High
SKILL.md:339
sudo privilege escalation
sudo apt install samba
This command installs or updates system packages with root privileges on line 339. It changes the host and requires explicit operator approval.
High
SKILL.md:341
sudo privilege escalation
sudo install -d -m 0770 -o root -g sambashare /srv/samba/anonymous
This root command creates a service directory and assigns permissions on line 341. It changes filesystem ownership and access controls on the host.
Medium
SKILL.md:356
Hardcoded IP address
| Cannot connect remotely | Bind service to 0.0.0.0 instead of localhost |
The troubleshooting advice recommends binding a service to 0.0.0.0. This exposes it on every interface and can unintentionally make a weak lab service reachable.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (7)

RISK-001 High
SKILL.md:66
Systemd service enablement
sudo systemctl enable apache2
The command enables Apache to start automatically at boot. This is a persistent system change, even though the stated purpose is legitimate lab setup.
RISK-002 High
SKILL.md:117
Network scanning tools
nmap -p 443 192.168.1.1
This is an executable enumeration or vulnerability-scanning command against a network target. It can probe systems beyond the lab if authorization and scope checks fail.
RISK-003 High
SKILL.md:217
Network scanning tools
enum4linux -a 192.168.1.1
This is an executable enumeration or vulnerability-scanning command against a network target. It can probe systems beyond the lab if authorization and scope checks fail.
RISK-004 High
SKILL.md:220
Network scanning tools
nmap --script smb-vuln* 192.168.1.1
This is an executable enumeration or vulnerability-scanning command against a network target. It can probe systems beyond the lab if authorization and scope checks fail.
RISK-005 High
SKILL.md:139-144SKILL.md:156-168SKILL.md:327-332
Insecure SNMP Lab Configuration
The guide recommends SNMP v1 with public and private community strings, then demonstrates process enumeration and community-string guessing. Exposure outside an isolated lab could disclose system details.
The commands and configuration explicitly use cleartext SNMP v1 and the well-known public community. The skill also acknowledges this protocol limitation.
RISK-006 High
SKILL.md:193-201
Anonymous Writable SMB Configuration
The sample share enables guest access and disables read-only mode. A reachable lab host could accept unauthorized file changes if the filesystem permissions also permit them.
The Samba configuration explicitly sets guest access to yes and read-only to no. Actual write access still depends on the shown directory permissions and Samba identity mapping.
RISK-007 Medium
SKILL.md:307-317
Credential Collection Page Without Handling Guidance
The HTTP example creates a login form that requests a username and password. It omits guidance on test credentials, storage, transport, and cleanup.
The example visibly requests password input and posts it to login.php. No backend or exfiltration is shown, but unsafe lab handling could expose entered credentials.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Commands install packages, alter firewalls, modify service files, and enable startup behavior with root privileges.
    Require confirmation immediately before each privileged block, name the affected host, and provide rollback commands for every persistent change.
  2. FIX-002
    High
    SNMP examples use cleartext v1 communities and predictable public or private values.
    Default to SNMPv3 with unique credentials. Keep legacy examples bound to an isolated interface and state that they must never reach production networks.
  3. FIX-003
    High
    The Samba example permits guest access and marks the share writable.
    Use read-only guest access by default, require named test accounts for writes, and include commands that remove the share after testing.
  4. FIX-004
    High
    Enumeration commands can scan the wrong target or exceed an assessment scope.
    Require an explicit target substitution, approved ports, rate limits, and a final scope confirmation before any scan runs.
  5. FIX-005
    Medium
    The sample login form can collect credentials without defining safe handling.
    Use synthetic credentials only, enable HTTPS, avoid persistence, and document immediate deletion of request logs and submitted values.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
81e05e636292629114b76cbb3922fbe57672fc02
Content hash
64e8a0f23fad3c68c9b5f27115ed725dd61bbbcd281bfd3cdde4b590d853547d
Tree hash
4139395cdade48472604f76a5fdb40ea823296abf449f41c8cbafee62f925012
Skill path
skills/sickn33/network-101
Audit payload hash
4b5ede5919c411d5d8ba7f3aede5bae5

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active