Linux Privilege Escalation
Audited by Socket on Feb 15, 2026
1 alert found:
Malware[Skill Scanner] Pipe-to-shell or eval pattern detected All findings: [CRITICAL] command_injection: Pipe-to-shell or eval pattern detected (CI013) [AITech 9.1.4] [CRITICAL] command_injection: URL pointing to executable file detected (CI010) [AITech 9.1.4] [CRITICAL] command_injection: URL pointing to executable file detected (CI010) [AITech 9.1.4] This skill is an explicit privilege-escalation offensive playbook. Its capabilities align with its stated purpose (finding and exploiting Linux privesc vectors), but that purpose is inherently malicious unless used under explicit authorization. The skill instructs reading sensitive files, creating backdoors and SUID binaries, compiling and running kernel exploits, and opening reverse shells to attacker-controlled hosts. Data flows route full shell access and sensitive files to remote attacker servers. For an AI-agent skill, this is high-risk and should be classified as malicious/suspicious for use in general environments and blocked or restricted to controlled, authorized red-team contexts. LLM verification: This artifact is a high-risk offensive privilege escalation playbook. It contains explicit, actionable instructions to obtain and persist root access on Linux systems, including unsafe patterns (curl|sh, attacker-hosted binaries), credential theft techniques, and persistence/backdoor creation. For defensive or educational use the content should be reframed: remove or heavily restrict actionable exploit steps, eliminate instructions to host/execute attacker-hosted payloads, add integrity checks f