DB ctf-forensics

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.

Not recommendedlow grade D

ClawHub Agent Skills author: gandli v1.0.0 MIT-0 15 files body ≈ 8 439 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process B 67/100 · Nearly there — weak spots: result and completion, when it triggers, execution cost

Analyzer Docker Infrastructuretype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

59/100

safety, quality, tests

Safety 60%: 48
Quality 40%: 75
Run on models: none yet

Process rating

67/100

Nearly there

Result and completion w 14: 0
When it triggers w 12: 20
Running it twice w 4: 30

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Exfiltration medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

Broad scope medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The skill asks for more than the task needs: broad tool access, credential environment variables, binaries. Every extra permission widens the damage from a mistake or a compromise.

For the author

Narrow allowed-tools and the variable list to the minimum; replace binaries with readable sources or scripts.

How to improve

The SKILL.md body is over 5,000 tokens: move reference detail into references/ and load it when needed.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 28

✓ No critical or high findings

Medium and low: 28

medium Exfiltration intent-browser-credential-store linux-forensics.md:90

Accesses a browser credential / cookie store (documentation of a security skill)
```
**Chrome/Edge Login Data decryption (requires master_key.txt):**
```
security skill
medium Exfiltration intent-browser-credential-store linux-forensics.md:330

Accesses a browser credential / cookie store (documentation of a security skill)
```
# Cookies (encrypted on modern Chrome — need DPAPI/keychain key)
```
security skill
medium Exfiltration intent-browser-credential-store linux-forensics.md:357

Accesses a browser credential / cookie store (documentation of a security skill)
```
# Saved passwords (requires key4.db + logins.json)
```
security skill

medium Exfiltration intent-browser-credential-store linux-forensics.md:372

Accesses a browser credential / cookie store (documentation of a security skill)

**Key insight:** Browser artifacts are SQLite databases with non-standard timestamp formats. Chrome uses WebKit epoch (microseconds since 1601-01-01), Firefox uses Unix epoch in microseconds. Always c

security skill

medium Broad scope meta-broad-allowed-tools SKILL.md:1

Broad tool permissions pre-approved: Bash
```
allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch
```
medium Exfiltration intent-browser-credential-store SKILL.md:266

Accesses a browser credential / cookie store (documentation of a security skill)
```
- **Chrome/Edge:** Decrypt `Login Data` SQLite with AES-GCM using DPAPI master key
```
security skill
low Risky intent intent-offensive-security disk-advanced.md:11

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- [Linux Ransomware Memory-Key Recovery (MetaCTF 2026)](#linu…026)
```
low Risky intent intent-offensive-security disk-advanced.md:152

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
## Linux Ransomware Memory-Key Recovery (MetaCTF 2026)
```

low Risky intent intent-offensive-security disk-advanced.md:154

Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (detector / deny-list definition)

**Pattern:** Linux memory dump + encrypted `.veg` files + `enc_key.bin`; ransomware uses hybrid crypto (AES for files, RSA-wrapped key). Volatility may fail process enumeration due symbol/KASLR (Kerne

detector

low Risky intent intent-offensive-security disk-advanced.md:164

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
2. **Reverse ransomware binary quickly to identify mode/layout.**
```
low Risky intent intent-offensive-security disk-advanced.md:166

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
strings -a ransomware.elf | grep -E "enc_key|EVP_aes|PUBLIC KEY|.veg"
```
low Risky intent intent-offensive-security disk-and-memory.md:10

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
- [PowerShell Ransomware Analysis](#powershell-ransomware-analysis)
```
low Risky intent intent-offensive-security disk-and-memory.md:95

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
**Ransomware key recovery via MFT:**
```
low Risky intent intent-offensive-security disk-and-memory.md:145

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
# Look for: credential access, lateral movement, data staging
```
low Risky intent intent-offensive-security disk-and-memory.md:192

Offensive-security / dual-use content (legitimate for authorised testing; review intended use)
```
## PowerShell Ransomware Analysis
```

low Risky intent intent-offensive-security disk-and-memory.md:387