extracting-credentials-from-memory-dump

SUSPICIOUS: the skill’s behavior is coherent with its stated purpose, but that purpose is to give an AI agent credential-extraction and post-compromise analysis capability using dual-use offensive tooling. Install trust is relatively normal and local-only data flow avoids exfiltration, but the skill materially enables recovery of passwords, hashes, Kerberos tickets, and cloud/session tokens, making it high-risk despite limited signs of malware.

The code is a forensic memory-dump credential extraction utility, not an apparent covert malware implant. It has no network exfiltration or persistence behavior, but it intentionally collects extremely sensitive credentials and writes/prints them without encryption or access-control handling. Use only on authorized dumps, protect or securely delete reports, avoid logging stdout, constrain output paths, and use trusted absolute paths for external tools. The principal security risk is credential exposure and possible misuse, with an additional PATH hijacking risk from unqualified subprocess commands.

The supplied material is documentation for a dual-use memory-forensics credential extraction agent, not executable code. It presents significant capability to collect and persist sensitive credentials, so deployment requires strict authorization, access control, encrypted storage, auditing, and secure cleanup. There is no direct evidence of malware or intentional compromise in this fragment, but the operational security risk is substantial if the described agent is misused or implemented insecurely.