Hostile 100% python Download

skcapstone 0.15.168

curl-pipe-sh, credential theft, persistence

“Sovereign Agent Framework — conscious AI through identity, trust, memory, and security”

Systemd autostarts hidden interpreter payloadSkill launches Codex without approvals

Evidence

Systemd ExecStart hidden dotfile argument skfleet-live-publisher.service · lines 7–17
7:6onment=SKFLEET_TMUX_SOCKET=%t/skfleet/tmux.sock
8RuntimeDirectory=skfleet
9RuntimeDirectoryMode=0755
10RuntimeDirectoryPreserve=yes
11ExecStart=%h/.skenv/bin/python3 -m skcapstone.fleet_live_publisher --home %h/.skcapstone
12TimeoutStartSec=30
13NoNewPrivileges=yes
14PrivateTmp=yes
15
16[Install]
17WantedBy=default.target
Systemd ExecStart hidden dotfile argument skfleet-mero.service · lines 2–19
6 lines
8Environment=SKCAPSTONE_AGENT=mero
9Environment=PATH=%h/.skenv/bin:%h/.local/bin:/usr/local/bin:/usr/bin:/bin
10ExecStart=%h/.skenv/bin/python3 -m skcapstone.seat_cycle_entrypoint --seat mero --home %h/.skcapstone --control-plane %h/.skcapstone/coordination/seat-control-plane.json
11TimeoutStartSec=180
12NoNewPrivileges=yes
4 lines
17
18[Install]
19WantedBy=default.target
WantedBy=default.target directive skfleet-atlas.service · lines 19–23
19:36ination/seat-cycles %h/.skcapstone/coordination/skmail.d
20ReadWritePaths=%h/.skcapstone/evidence %h/.skcapstone/fleet
21
22[Install]
23WantedBy=default.target

Showing the top 5 files — 7 more files (128 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.