linux-kernel-exploits

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly requires the agent to include "New credentials or tokens found" in its return summary and to read/leverage existing credentials via get_state_summary(), meaning the LLM would need to handle and output secret values verbatim.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs are high-risk: they include attacker-controlled HTTP endpoints serving shell scripts/binaries (http://ATTACKBOX:8080/...), direct raw GitHub scripts/binaries, and multiple low-reputation GitHub PoC exploit repositories delivering kernel exploits—classic vectors for malware/exploit distribution and unsafe to fetch or execute without full review in a controlled environment.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The document is high-risk: it provides explicit, operational instructions to deploy kernel exploits (DirtyPipe/DirtyCow and others), create persistent root access (overwriting /etc/passwd or SUID binaries), execute remote/local arbitrary code, escape containers/chroots and restricted shells, and steal/exfiltrate credentials (e.g., /etc/shadow), all of which enable deliberate system compromise and data theft.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime workflow instructs downloading outsider-authored free text/code from public web sources (e.g., curl/wget raw GitHub/ExploitDB/other repos for les.sh, les2.pl, and various PoCs), which is then executed/ingested as readable script source in the agent’s context.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote exploit code during runtime (e.g., curl -sL https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh and git clone https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits) which will download and run third‑party code the workflow relies on.

---

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the skill for literal, high-entropy credentials that could be used to gain access.

Flagged:

• The DirtyPipe PoC embeds a full SHA-512-style passwd hash in the data string: root:$6$dirtypipe$JhEN7PSqFf5xHHLRGSCe1cMfCkVSWn4tajGbQn5Is.gx3TkSn1qFzjqOnETwELOjGODB5EhQXhUmL8OGBnMYq/:0:0::/root:/bin/bash This is a high-entropy, literal credential/hash that, in context, is used to overwrite /etc/passwd and enable root login (the doc later states the password is "piped"). Per the secret definition (high-entropy literal that provides access), this qualifies as a secret present in the documentation.

Ignored / not flagged:

• The plaintext passwords mentioned in the examples (e.g., "piped" for DirtyPipe, "password" for DirtyCow) are simple, low-entropy example/setup passwords and are explicitly used as PoC/test credentials — per the rules these are ignored.
• The DirtyCow payload line (firefart:fi3sED95ibqR6:0:0:...) is inconsistent with the comment ("password: password") and is short/non-cryptographic; treated as an example/test credential and ignored.
• No API keys, private PEM blocks, or other high-entropy tokens / secrets were found elsewhere in the document. Most other values are filenames, URLs, command names, or placeholders (ATTACKBOX, etc.), which are not secrets.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly instructs compiling and executing kernel exploits and techniques that overwrite system files (e.g., /etc/passwd), create privileged accounts, modify cgroups and mounts, and perform chroot/container/privilege escapes—actions that directly change and compromise the host system state.