firmware-pentest

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This document contains explicit, actionable instructions for achieving remote code execution (RCE), generating reverse shells, fetching and executing attacker-hosted payloads, and locating/extracting hardcoded keys and credentials—clear patterns enabling backdoors, credential theft, and unauthorized data exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's on-demand bootstrap includes commands that fetch and then execute remote code during runtime (e.g., git clone https://github.com/e-m-b-a/emba.git && cd ~/tools/emba && sudo ./installer.sh -d and git clone --recursive https://github.com/firmadyne/firmadyne.git && cd ~/tools/firmadyne && sudo ./download.sh), which are required installation steps that run external code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill repeatedly instructs using sudo and system-level tools (sudo apt install, sudo emba, sudo fat.py, flashrom/ch341a, installers with sudo), and guides actions that modify the host system or require elevated privileges, so it pushes the agent to change the machine state.