hardware-hardspoof-spoofing-toolkit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The presence of a direct download of a tar.gz from an individual GitHub Pages user (shantanu-u69.github.io) distributing kernel modules/installers — an unvetted, high-privilege executable source — makes this set suspicious even though the other links (ara.so, example.com, browserleaks.com) are ambiguous or benign.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This toolkit contains explicit offensive capabilities — kernel/driver installation, ARP/DNS/SNI spoofing (cache-poisoning), browser fingerprint manipulation, persistence mechanisms and instructions to clean logs — all of which enable man-in-the-middle attacks, hiding tracks, and long-term system compromise, making it high-risk and highly abusable.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's installation instructions use wget to download and extract remote code from https://shantanu-u69.github.io/Spoof-Suite-Security/hardsp00f-latest.tar.gz which is then built/installed (make kernel-module / sudo make install), meaning remote code is fetched and executed during setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing kernel modules/drivers, running commands with sudo/systemctl, modifying /etc configs and NetworkManager, and changing network interfaces (MAC/DNS/ARP), all of which modify the machine state and require elevated privileges.