kernel-debugging-ftrace-kprobes-kdump

Warn

Audited by Socket on Sep 3, 2026

1 alert found:

Anomaly
AnomalyLOW
examples/bad/kgdb_sysctl.sh

This code fragment performs a privileged, high-impact operation by attempting to set a kernel debugging-related sysctl value (`/proc/sys/kernel/kgdb`) to `1`. While there is no evidence in the fragment of classic malware behaviors (exfiltration, persistence, reverse shells), it is atypical for normal library code and could materially weaken system security if the target knob exists and execution has sufficient privileges. More surrounding context (installation scripts/post-install hooks, calling code, and observed behavior) is needed to confirm malicious intent.

Confidence: 46%Severity: 66%
Audit Metadata
Analyzed At
Sep 3, 2026, 10:07 AM
Package URL
pkg:socket/skills-sh/trothbyte%2Flow-level-skills-trothbyte%2Fkernel-debugging-ftrace-kprobes-kdump%2F@5d439904eb4be53ffc5fba84e147a5e1b2e87ffbd3428276caccc3134a81b371