analyzing-memory-forensics-with-lime-and-volatility

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly instructs extracting bash command history and socket/process artifacts from memory images (linux.bash, linux.sockstat, etc.), which commonly contain sensitive secrets and would require the agent to output those secrets verbatim if presenting findings.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow runs Volatility 3 plugins (e.g., linux.bash) on a runtime-provided memory image and ingests the resulting recovered bash command text (result.stdout → lines → parsed command fields) into the agent’s in-memory report context, where that text is outsider-authored because it originates from the target system’s user/process activity rather than the operating user.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs loading a kernel module with insmod to acquire memory (insmod lime-$(uname -r).ko ...), which requires root privileges and modifies the system/kernel state.