performing-privilege-escalation-on-linux

Fail

Audited by Socket on Mar 15, 2026

3 alerts found:

SecurityObfuscated FileMalware
SecurityMEDIUM
SKILL.md

SUSPICIOUS/HIGH-RISK skill. Its footprint is coherent with its stated purpose, but that purpose is to help an AI agent perform Linux privilege escalation and root compromise on target systems. The main concern is offensive capability enablement, not hidden exfiltration or malware behavior.

Confidence: 91%Severity: 90%
Obfuscated FileHIGH
references/api-reference.md

This code appears to be a dual-use local privilege-escalation enumeration tool: not intrinsically malicious (no clear network exfiltration or obfuscation described) but intentionally prescriptive about exploitable vectors (GTFOBins, dangerous sudo patterns, writable cron scripts). It poses a meaningful security risk if executed by untrusted users or included as a dependency in contexts with elevated privileges because it packages actionable escalation knowledge. Recommended actions: restrict execution to trusted auditors, review full implementation for any automated exploitation or network features, and avoid bundling into production components accessible to untrusted parties.

Confidence: 98%
MalwareHIGH
references/workflows.md

This file is a clear privilege-escalation playbook containing actionable steps to enumerate and escalate privileges on Linux systems, including remote downloads and execution of tools, SUID/sudo abuse, kernel exploit usage, creation of SUID binaries, LD_PRELOAD abuse, cron PATH hijacking, Docker/NFS escapes. It is dual-use but poses a high security risk if used maliciously. Treat as dangerous guidance and do not execute these instructions on systems without explicit authorization.

Confidence: 90%Severity: 85%
Audit Metadata
Analyzed At
Mar 15, 2026, 09:40 PM
Package URL
pkg:socket/skills-sh/mukul975%2FAnthropic-Cybersecurity-Skills%2Fperforming-privilege-escalation-on-linux%2F@ffd9f090d2537c31ef395c3ec01182582eb59add