Does it change sudoers?

No. It only reads copies you provide and writes a report.

Why is root ALL only INFO?

It's the normal Debian/Ubuntu default. NOPASSWD ALL for other users is CRITICAL.

A community catalog of Unix binaries that can be abused to escape restricted shells or elevate privileges. We ship the sudo-context list.

Can I pass a whole /etc dump folder?

Yes — pass the directory; sudoers, sudoers.d/*, passwd and group are picked up.

Is negation with ! safe?

No. sudoers(5) says subtracting commands from ALL with `!` is generally not effective.

sudoers and privilege auditor

Example session with this skill installed

I dumped sudoers, passwd and group from a bakery VPS. Is anyone getting passwordless root? Any shell escapes?

Read your context and instructions
Compiled the sudoers and privilege

Answer: yes — 3 CRITICAL, 9 HIGH, 3 MEDIUM on the sample host.

CRITICAL: dev ALL=(ALL) NOPASSWD: ALL — passwordless full root
CRITICAL: second UID 0 account backupsvc alongside root in passwd
CRITICAL: account guest has an empty password field

HIGH: deploy has SETENV: NOPASSWD on /usr/bin/systemctl restart * (wildcard matches spaces/args per sudoers(5); systemctl is on the GTFOBins sudo list)

HIGH: oncall may run /usr/bin/vim /var/log/nginx/* — classic shell escape

HIGH: backup ALL=(ALL) ALL, !/usr/bin/passwd, !/usr/bin/su — negation is advisory only; the user can rename the binary

MEDIUM: Defaults !use_pty; sudoedit rule on nginx sites-enabled
INFO: expected root ALL / %sudo ALL; %sudo members are deploy, dev

Deliverables: terminal summary plus optional audit.md, findings CSV and JSON. GTFOBins sudo list loaded:

455 binaries (API snapshot cited in references/).

Next steps: remove NOPASSWD ALL; delete or lock the extra UID 0 and empty-password accounts; replace shell-escape grants with least-privilege command lists; re-run after visudo -c on the host.

(Real run on the bundled examples/sample/ sudoers + passwd + group.)

Connects securely to your tools. The creator never sees your data.

About this skill

Find the sudo rule that is actually a root shell.

Point this at copies of /etc/sudoers, sudoers.d/, /etc/passwd and /etc/group. It flags NOPASSWD, command wildcards, SETENV, ineffective ALL, !/usr/bin/passwd negation, GTFOBins sudo escapes (vim, less, find, …), dangerous Defaults, multiple UID 0 accounts and empty password fields. Expected root ALL / %sudo ALL rules are INFO, not noise.

What's included

SKILL.md, scripts/sudoers_audit.py, bundled GTFOBins sudo list (455 binaries, API snapshot 2026-10-12), references, sample host files.

Going further: paid skills from the same creator

server log threat hunter: hunt auth.log for the break-in that abused these rules.
linux cis style config auditor: broader host hardening score.
small business security audit: whole-business checkup.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Free forever

No account required to browse

sudoers and privilege auditor