← All skills
lolbin-audit
82 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By ain3sh/.agents (GitHub) · security · 14 stars · scanned at commit 4ddf141
Audit projects, containers, sudoers/IaC, and shell-out call sites for dangerous Living-Off-the-Land binary exposure using GTFOBins data. Use when asked about GTFOBins, LOLBins, post-foothold blast radius, privilege escalation, SUID/capability risks, sudo allowlists, container hardening, or security auto-testing of Unix/Linux projects.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 28 places.
Show 17 more
- skills/lolbin-audit/SKILL.md, line 120
--format text|tsv|jsonl # default: text - skills/lolbin-audit/SKILL.md, line 132
set -euo pipefail - skills/lolbin-audit/SKILL.md, line 183
"$SKILL_DIR/scripts/project-audit.sh" /path/to/repo --format jsonl - skills/lolbin-audit/SKILL.md, line 190
{"surface":"iac","source":"Dockerfile","line":4,"binary":"/usr/bin/python3","gtfo_binary":"python","technique":"capabilities","severity":"high","reason":"provis - skills/lolbin-audit/SKILL.md, line 191
{"surface":"shellout","source":"app.py","line":12,"binary":"tar","gtfo_binary":"tar","technique":"shell","severity":"medium","reason":"source code shells out to - skills/lolbin-audit/SKILL.md, line 206
"$SKILL_DIR/scripts/image-audit.sh" my-image:latest --format jsonl - skills/lolbin-audit/SKILL.md, line 221
"$SKILL_DIR/scripts/sudoers-audit.sh" ./infra --format jsonl - skills/lolbin-audit/SKILL.md, line 229
"$SKILL_DIR/scripts/iac-suid-audit.sh" . --format text - skills/lolbin-audit/SKILL.md, line 237
"$SKILL_DIR/scripts/shellout-grep.sh" . --format jsonl - skills/lolbin-audit/SKILL.md, line 242
1. Does user/external input reach the argv? (look for `f"..."`, `% ...`, `${...}`, `+ var`, `shell=True`) - skills/lolbin-audit/SKILL.md, line 276
SKILL_DIR="$HOME/.agents/skills/lolbin-audit" - skills/lolbin-audit/SKILL.md, line 291
tmp=$(mktemp -d) - skills/lolbin-audit/references/categories.md, line 20
| `shell` | sudoers allows it, or a shell-out reaches it with attacker-controlled argv | sudoers rule + this category; or `shell=True` / f-string / `${var}` int - skills/lolbin-audit/references/categories.md, line 73
| `subprocess.run(["python", "-c", literal_string])` | argv is fully literal; no input control | - skills/lolbin-audit/references/findings-template.md, line 135
| `FP` | shellout | `app/cli.py:42` | `subprocess.run(["python", "-c", LITERAL])` | argv fully literal, no input reaches it | — | - skills/lolbin-audit/references/findings-template.md, line 136
| `pending` | shellout | `worker/jobs.py:88` | `os.system(f"tar xf {path}")` | `path` traced to validated allowlist; revisit if validator weakens | — | - skills/lolbin-audit/references/findings-template.md, line 137
| `TP` | shellout | `api/users.py:201` | `os.system(f"vim {fname}")` | `fname` reaches from a request param; runs as web user but image has `setuid` `vim` | F-0
and 8 more places
Downloads and installs other software
The author does not mention this.
Found in 1 place.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'lolbin-audit' ] || [ -L ~/.agents/skills/'lolbin-audit' ]; then echo 'A skill folder named lolbin-audit already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ain3sh/.agents' "$d" && git -C "$d" checkout --quiet '4ddf141db8b6d6a225ad100c3d9589932b7163fd' -- 'skills/lolbin-audit' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/lolbin-audit' ~/.agents/skills/'lolbin-audit' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'lolbin-audit' ~/.claude/skills/'lolbin-audit' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for ain3sh/.agents shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/ain3sh/.agents/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | 4ddf141 | 82 |