spoof-suite-hardware-identity

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.85). The set includes a personal GitHub repository and GitHub Pages (shantanu-u69) that host kernel modules, drivers and a Windows ZIP/executables — high-risk artifacts from an untrusted/unknown author that are commonly used to distribute malware, while the other links (example.com, ara.so, browserleaks.com) appear benign.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This is a high-risk dual‑use toolkit that includes explicit offensive capabilities (ARP spoofing, DNS cache poisoning, packet/SNI manipulation), kernel/driver installation with elevated privileges, persistence options, and remote-control interfaces—functions that can enable man‑in‑the‑middle attacks, stealthy system compromise, credential theft, and covert exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The installation steps fetch and then build/execute remote code from the GitHub repository (git clone https://github.com/Shantanu-U69/Spoof-Suite-Security.git) and reference downloading releases from the project's GitHub Pages (https://shantanu-u69.github.io/Spoof-Suite-Security/), which are runtime external dependencies that lead to executing remote code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs installing kernel modules and drivers, running many sudo/administrator commands, modifying root-owned system files (/etc, /var/log), manipulating network interfaces and services — all privileged actions that change the machine state and can compromise security.