spoof-suite-security-hardware

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These are suspicious: the GitHub repo is an unverified personal project that installs kernel-level/root-requiring code (a high-risk vector for malware/backdoors), and ara.so is an unfamiliar single-domain host rather than an established vendor/CDN, so both require strong provenance checks before downloading or running anything.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.95). This README describes a high-risk, dual-use toolkit that intentionally enables network- and kernel-level identity spoofing (ARP/DNS/SNI/packet manipulation), persistence, and privileged operations—features that facilitate man-in-the-middle attacks, credential interception, and system compromise; it also references telemetry/AI integration (use of external API keys) that could exfiltrate profiles or secrets.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's installation instructs cloning and executing code from the external repository https://github.com/Shantanu-U69/Spoof-Suite-Security.git (git clone followed by sudo ./install.sh), which fetches remote code that is executed during setup and is required for runtime, so it directly controls executed code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs installing and loading a kernel module, running many sudo/systemctl/setcap/modprobe commands, modifying system/network services (including disabling SELinux/SIP and stopping NetworkManager), and creating persistent system changes — all actions that require elevated privileges and change the machine state.