Linux Incident Remediator

Provides forensically-safe Linux threat detection, network and process analysis, integrity verification, controlled firewall and service remediation preservi...

This skill is coherent for a sysadmin/incident responder, but it performs privileged operations. Before using: (1) only run commands if you understand their impact and have physical/forensic custody policies in place, (2) work on a forensic copy or isolated host when possible to avoid contaminating evidence, (3) inspect and verify any scripts you download (check authorship, hashes, and review code) before making them executable, (4) prefer package-manager installs for trusted tooling when practical, and (5) document and backup current firewall and system state before persisting changes so remediation is reversible. If you lack deep Linux incident-response experience, consult a professional — these commands can disrupt production systems or destroy forensic value if misused.

Type: OpenClaw Skill Name: sys-guard-linux-remediator Version: 1.0.0 The skill is designed for Linux incident response and remediation, requiring high privileges and access to critical system functions. While the `SKILL.md` documentation is extensive and includes robust 'Safety Guardrails' explicitly designed to prevent harmful actions (e.g., `rm -rf /`, `iptables -F` without checks, broad `pkill`), it instructs the agent to download and execute Python forensic tools from an external GitHub repository (`DidierStevens/DidierStevensSuite`) using `sudo wget`. This introduces a significant supply chain vulnerability (Remote Code Execution risk) if the external source were ever compromised, despite the current benign intent and the legitimacy of the tools. There is no evidence of intentional malicious behavior or prompt injection designed to exfiltrate data or establish persistence, but the `wget` command represents a critical vulnerability.