memory-forensics-evasion
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell commands for memory acquisition (DumpIt, WinPmem, LiME) and extensive analysis via the Volatility3 framework in both
SKILL.mdandreferences/volatility3-cheatsheet.md.- [PRIVILEGE_ESCALATION]: The skill explicitly instructs the agent to executesudo insmodto load the LiME kernel module for memory extraction on Linux, which requires administrative root access.- [EXTERNAL_DOWNLOADS]: Reference material inreferences/anti-memory-forensics.mdincludes links to third-party security research and evasion tools hosted on GitHub by non-trusted individual accounts (e.g., github.com/Cracked5pider/Ekko, github.com/SecIdiot/FOLIAGE).- [CREDENTIALS_UNSAFE]: The documentation describes specific procedures to extract NTLM hashes, LSA secrets, and memory dumps of the LSASS process to facilitate credential harvesting.- [INDIRECT_PROMPT_INJECTION]: The skill creates a potential attack surface by instructing the agent to ingest and analyze untrusted memory dumps which may contain adversarial content. - Ingestion points: External memory dump files (
memory.raw,memory.lime). - Boundary markers: None; there are no instructions to treat memory dump contents as untrusted data or to use delimiters.
- Capability inventory: Access to Volatility3 plugins for scanning memory, extracting files, and harvesting credentials.
- Sanitization: None; the skill does not include steps for sanitizing or validating memory data before processing by the agent.
Audit Metadata