Skills pentest-metasploit
📦

pentest-metasploit

v0.1.0 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Audit Metasploit Workflows Safely

Security teams need structured review of authorized exploit validation, but these workflows carry high misuse risk. This skill documents Metasploit assessment steps with scope checks, logging, and cleanup guidance.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "pentest-metasploit" from https://skillstore.io/skills/agentsecops-pentest-metasploit.md and its manifest at https://skillstore.io/api/skills/agentsecops-pentest-metasploit/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-pentest-metasploit.md Signed manifest GET /api/skills/agentsecops-pentest-metasploit/manifest Signed lockfile GET /api/skills/agentsecops-pentest-metasploit/lockfile

Test it

Using "pentest-metasploit". Plan validation for an authorized SMB finding.

Expected outcome:

A scoped checklist covering authorization, test window, target list, safety checks, expected evidence, cleanup, and escalation contacts.

Using "pentest-metasploit". Summarize post-exploitation evidence for a report.

Expected outcome:

  • A concise impact statement tied to the approved test objective.
  • A timeline of observed access and actions.
  • Cleanup and remediation notes for the asset owner.

Using "pentest-metasploit". Create a defensive detection plan from a payload scenario.

Expected outcome:

A detection plan with expected logs, network signals, endpoint alerts, validation steps, and analyst response guidance.

Security Audit

Critical
v10 • 7/9/2026 Open versioned report

The skill is not a passive reference; SKILL.md provides operational Metasploit workflows for exploit execution, Meterpreter sessions, credential collection, persistence, lateral movement, phishing payload delivery, evasion, and privilege escalation. Most rule-template and reference-example detections are documentation false positives, but the core skill content and CI pipe-to-shell template are confirmed high-risk or critical. No prompt-injection attempt was found in the reviewed files.

6
Files scanned
1,985
Lines analyzed
50
Review items
0
False positives ignored

Confirmed security concerns (63)

Critical
assets/ci-config-template.yml:240
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads an install script from GitHub and pipes it directly to bash. This is a supply-chain execution path in CI.
Critical
SKILL.md:2
Metasploit framework
name: pentest-metasploit
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:5
Metasploit framework
security assessments using Metasploit Framework. Use when: (1) Validating vulnerabilities in
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:13
Metasploit framework
tags: [pentest, metasploit, exploitation, post-exploitation, vulnerability-validation, red-team]
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:16
Metasploit framework
packages: [metasploit-framework]
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:19
Metasploit framework
- https://docs.metasploit.com/
The line is a Metasploit reference link, but it is part of a skill centered on Metasploit Framework workflows. The same file contains exploit and payload execution steps.
Critical
SKILL.md:20
Metasploit framework
- https://www.offsec.com/metasploit-unleashed/
The line is a Metasploit reference link, but it is part of a skill centered on Metasploit Framework workflows. The same file contains exploit and payload execution steps.
Critical
SKILL.md:24
Metasploit framework
# Metasploit Framework Penetration Testing
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Show all 63 confirmed findings
Critical
SKILL.md:28
Metasploit framework
Metasploit Framework is the industry-standard platform for penetration testing, vulnerability valida
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:34
Metasploit framework
Initialize Metasploit console and verify database connectivity:
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:40
Metasploit framework
# Initialize Metasploit database
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:43
Metasploit framework
# Launch Metasploit console
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:120
Metasploit framework
msf6 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_https
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:162
Metasploit framework
meterpreter > sysinfo
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:163
Metasploit framework
meterpreter > getuid
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:164
Metasploit framework
meterpreter > getprivs
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:167
Metasploit framework
meterpreter > ipconfig
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:168
Metasploit framework
meterpreter > route
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:171
Metasploit framework
meterpreter > ps
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:174
Metasploit framework
meterpreter > run post/windows/gather/enum_av_excluded
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:175
Metasploit framework
meterpreter > run post/windows/gather/enum_logged_on_users
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:190
Metasploit framework
meterpreter > run post/multi/recon/local_exploit_suggester
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:193
Metasploit framework
meterpreter > ps
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:194
Metasploit framework
meterpreter > migrate <stable-process-pid>
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:197
Metasploit framework
meterpreter > getsystem
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:198
Metasploit framework
meterpreter > getuid
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:213
Metasploit framework
meterpreter > run post/windows/gather/arp_scanner RHOSTS=<internal-subnet>
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:214
Metasploit framework
meterpreter > run auxiliary/scanner/smb/smb_version
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:217
Metasploit framework
meterpreter > run autoroute -s <internal-subnet>/24
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:280
Metasploit framework
msf6 exploit(...) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:301
Metasploit framework
msf6 exploit(office_word_macro) > set PAYLOAD windows/meterpreter/reverse_https
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:307
Metasploit framework
msf6 exploit(multi/handler) > set PAYLOAD windows/meterpreter/reverse_https
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:331
Metasploit framework
# Headless Metasploit resource script
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:336
Metasploit framework
set PAYLOAD windows/x64/meterpreter/reverse_tcp
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:356
Metasploit framework
Map Metasploit activities to ATT&CK framework:
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:380
Metasploit framework
msf6 evasion(...) > set PAYLOAD windows/meterpreter/reverse_https
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:384
Metasploit framework
set PAYLOAD windows/meterpreter/reverse_https # staged
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:386
Metasploit framework
set PAYLOAD windows/meterpreter_reverse_https # stageless
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:389
Metasploit framework
meterpreter > run post/windows/manage/migrate
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:418
Metasploit framework
meterpreter > run post/multi/recon/local_exploit_suggester
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:421
Metasploit framework
meterpreter > getsystem -t 1 # Named Pipe Impersonation
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:422
Metasploit framework
meterpreter > getsystem -t 2 # Named Pipe Impersonation (Admin Drop)
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:423
Metasploit framework
meterpreter > getsystem -t 3 # Token Duplication
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:426
Metasploit framework
meterpreter > background
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:434
Metasploit framework
Organizations can detect Metasploit activity by:
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:436
Metasploit framework
- **Network IDS**: Signature-based detection of default Metasploit payloads
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:437
Metasploit framework
- **Endpoint Detection**: Behavioral analysis of meterpreter process injection
The skill explicitly teaches Metasploit Framework exploitation and Meterpreter workflows. This is dual-use offensive tooling with direct misuse potential.
Critical
SKILL.md:451
Metasploit framework
- [Metasploit Documentation](https://docs.metasploit.com/)
The line is a Metasploit reference link, but it is part of a skill centered on Metasploit Framework workflows. The same file contains exploit and payload execution steps.
Critical
SKILL.md:452
Metasploit framework
- [Metasploit Unleashed](https://www.offsec.com/metasploit-unleashed/)
The line is a Metasploit reference link, but it is part of a skill centered on Metasploit Framework workflows. The same file contains exploit and payload execution steps.
Critical
SKILL.md:349
Cobalt Strike keywords
- **Cobalt Strike**: Export sessions to Cobalt Strike beacons
The line describes exporting sessions to Cobalt Strike beacons. That is C2 and post-exploitation tradecraft integration guidance.
Critical
multiple:1
[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
This combination is common in credential stealers and RATs
The heuristic combination is present in the core skill: command execution, network pivoting, payload handling, and credential access are all documented. It is not a classic stealer, but the dangerous combination is real.
Critical
SKILL.md:113-182SKILL.md:188-205
Operational Exploitation and Post-Exploitation Workflow
SKILL.md guides exploit configuration, reverse Meterpreter payload use, exploit execution, session interaction, credential collection, persistence, and privilege escalation. This goes beyond defensive explanation and can directly enable unauthorized compromise if misused.
The cited sections include concrete exploit, payload, Meterpreter, credential, persistence, and privilege escalation workflow text. The surrounding skill description confirms these are intended assessment procedures, not incidental references.
Critical
SKILL.md:295-311
Phishing Payload Delivery Workflow
SKILL.md includes a pattern for generating a malicious Office macro document and setting up a handler for a reverse Meterpreter payload. This is social engineering payload delivery guidance, which static pattern matching only partially captured.
The section title and steps explicitly describe malicious document generation and listener setup. There is little ambiguity about the offensive delivery intent.
Critical
SKILL.md:245-251SKILL.md:346-350SKILL.md:377-429
Evasion, C2 Handoff, and Covert Operations Guidance
SKILL.md discusses attribution prevention, encrypted callbacks, Cobalt Strike and PowerShell Empire handoff, evasion payload generation, and UAC bypass troubleshooting. These instructions can help avoid detection and extend compromise.
The cited text combines operational security, C2 framework integration, evasion, and privilege escalation instructions. These are high-confidence offensive tradecraft indicators in context.
High
SKILL.md:365
C2 keywords
- **Exfiltration**: T1041 (Exfiltration Over C2 Channel)
The C2 exfiltration mapping appears in a section that maps Metasploit activities to ATT&CK techniques. In context it supports offensive post-exploitation understanding.
High
SKILL.md:163-164
System reconnaissance
meterpreter > getuid
The Meterpreter getuid command gathers identity context from a compromised host. This is operational post-exploitation reconnaissance.
High
SKILL.md:198-199
System reconnaissance
meterpreter > getuid
The Meterpreter getuid command gathers identity context from a compromised host. This is operational post-exploitation reconnaissance.
High
SKILL.md:248
System reconnaissance
- **Attribution Prevention**: Avoid personal infrastructure or identifiable indicators
The line gives operational security guidance about attribution or detection avoidance in an offensive workflow. The exact pattern is broad, but the context is risky.
High
SKILL.md:251
System reconnaissance
- **Session Management**: Close sessions cleanly to avoid detection alerts
The line gives operational security guidance about attribution or detection avoidance in an offensive workflow. The exact pattern is broad, but the context is risky.
High
SKILL.md:17
Network scanning tools
tools: [postgresql, nmap]
The skill depends on or invokes Nmap-style scanning as part of Metasploit target reconnaissance and pivoting. This is operational network scanning guidance.
High
SKILL.md:88
Network scanning tools
msf6 > db_import /path/to/nmap-scan.xml
The skill depends on or invokes Nmap-style scanning as part of Metasploit target reconnaissance and pivoting. This is operational network scanning guidance.
High
SKILL.md:232
Network scanning tools
proxychains nmap -sT -Pn <internal-target>
The skill depends on or invokes Nmap-style scanning as part of Metasploit target reconnaissance and pivoting. This is operational network scanning guidance.
High
SKILL.md:348
Network scanning tools
- **Nmap Integration**: Import reconnaissance data with `db_import`
The skill depends on or invokes Nmap-style scanning as part of Metasploit target reconnaissance and pivoting. This is operational network scanning guidance.
Capability review items (50)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical
SKILL.md:113-127
Ruby/shell backtick execution
```bash
The surrounding block configures an EternalBlue module, reverse Meterpreter payload, listener values, and exploit execution. These commands can directly enable target compromise.
Critical
SKILL.md:127-133
Ruby/shell backtick execution
```
The surrounding block configures an EternalBlue module, reverse Meterpreter payload, listener values, and exploit execution. These commands can directly enable target compromise.
Critical
SKILL.md:133-142
Ruby/shell backtick execution
```bash
The surrounding block configures an EternalBlue module, reverse Meterpreter payload, listener values, and exploit execution. These commands can directly enable target compromise.
Critical
SKILL.md:142-154
Ruby/shell backtick execution
```
The surrounding block configures an EternalBlue module, reverse Meterpreter payload, listener values, and exploit execution. These commands can directly enable target compromise.
Critical
SKILL.md:154-176
Ruby/shell backtick execution
```bash
The surrounding post-exploitation section covers Meterpreter sessions, host enumeration, credential collection, and persistence modules. This is operational post-compromise guidance.
Critical
SKILL.md:176-179
Ruby/shell backtick execution
```
The surrounding post-exploitation section covers Meterpreter sessions, host enumeration, credential collection, and persistence modules. This is operational post-compromise guidance.
Critical
SKILL.md:179-180
Ruby/shell backtick execution
- `post/windows/gather/hashdump` - Extract password hashes (requires SYSTEM privileges)
The surrounding post-exploitation section covers Meterpreter sessions, host enumeration, credential collection, and persistence modules. This is operational post-compromise guidance.
Critical
SKILL.md:180-181
Ruby/shell backtick execution
- `post/multi/recon/local_exploit_suggester` - Identify privilege escalation opportunities
The surrounding post-exploitation section covers Meterpreter sessions, host enumeration, credential collection, and persistence modules. This is operational post-compromise guidance.
Critical
SKILL.md:181-182
Ruby/shell backtick execution
- `post/windows/gather/credentials/credential_collector` - Gather stored credentials
The surrounding post-exploitation section covers Meterpreter sessions, host enumeration, credential collection, and persistence modules. This is operational post-compromise guidance.
Critical
SKILL.md:182-188
Ruby/shell backtick execution
- `post/windows/manage/persistence_exe` - Establish persistence (if explicitly authorized)
The surrounding post-exploitation section covers Meterpreter sessions, host enumeration, credential collection, and persistence modules. This is operational post-compromise guidance.
Critical
SKILL.md:188-199
Ruby/shell backtick execution
```bash
The surrounding section gives privilege escalation workflow commands including getsystem and local exploit module setup. This is post-compromise escalation guidance.
Critical
SKILL.md:199-202
Ruby/shell backtick execution
```
The surrounding section gives privilege escalation workflow commands including getsystem and local exploit module setup. This is post-compromise escalation guidance.
Critical
SKILL.md:202-203
Ruby/shell backtick execution
1. Background current session: `background`
The surrounding section gives privilege escalation workflow commands including getsystem and local exploit module setup. This is post-compromise escalation guidance.
Critical
SKILL.md:203-204
Ruby/shell backtick execution
2. Select escalation module: `use exploit/windows/local/<escalation-module>`
The surrounding section gives privilege escalation workflow commands including getsystem and local exploit module setup. This is post-compromise escalation guidance.
Critical
SKILL.md:204-205
Ruby/shell backtick execution
3. Set session: `set SESSION <session-id>`
The surrounding section gives privilege escalation workflow commands including getsystem and local exploit module setup. This is post-compromise escalation guidance.
Critical
SKILL.md:205-211
Ruby/shell backtick execution
4. Run exploit: `exploit`
The surrounding section gives privilege escalation workflow commands including getsystem and local exploit module setup. This is post-compromise escalation guidance.
Critical
SKILL.md:211-223
Ruby/shell backtick execution
```bash
The surrounding section covers internal network enumeration, autoroute pivoting, SOCKS proxy setup, and scanning through a compromised host. This supports lateral movement.
Critical
SKILL.md:223-227
Ruby/shell backtick execution
```
The surrounding section covers internal network enumeration, autoroute pivoting, SOCKS proxy setup, and scanning through a compromised host. This supports lateral movement.
Critical
SKILL.md:227-233
Ruby/shell backtick execution
```bash
The surrounding section covers internal network enumeration, autoroute pivoting, SOCKS proxy setup, and scanning through a compromised host. This supports lateral movement.
Critical
SKILL.md:233-276
Ruby/shell backtick execution
```
The surrounding section covers internal network enumeration, autoroute pivoting, SOCKS proxy setup, and scanning through a compromised host. This supports lateral movement.
Critical
SKILL.md:276-282
Ruby/shell backtick execution
```bash
The surrounding examples execute web and database server exploit modules with Meterpreter payloads. These are concrete exploitation workflows.
Critical
SKILL.md:282-286
Ruby/shell backtick execution
```
The surrounding examples execute web and database server exploit modules with Meterpreter payloads. These are concrete exploitation workflows.
Critical
SKILL.md:286-293
Ruby/shell backtick execution
```bash
The surrounding examples execute web and database server exploit modules with Meterpreter payloads. These are concrete exploitation workflows.
Critical
SKILL.md:293-297
Ruby/shell backtick execution
```
The surrounding examples execute web and database server exploit modules with Meterpreter payloads. These are concrete exploitation workflows.
Critical
SKILL.md:297-311
Ruby/shell backtick execution
```bash
The surrounding examples include malicious document payload delivery, handler setup, and credential spraying. These are high-risk offensive workflows.
Critical
SKILL.md:311-315
Ruby/shell backtick execution
```
The surrounding examples include malicious document payload delivery, handler setup, and credential spraying. These are high-risk offensive workflows.
Critical
SKILL.md:315-322
Ruby/shell backtick execution
```bash
The surrounding examples include malicious document payload delivery, handler setup, and credential spraying. These are high-risk offensive workflows.
Critical
SKILL.md:322-330
Ruby/shell backtick execution
```
The surrounding examples include malicious document payload delivery, handler setup, and credential spraying. These are high-risk offensive workflows.
Critical
SKILL.md:330-344
Ruby/shell backtick execution
```bash
The surrounding CI example creates a Metasploit resource script and runs headless exploit validation. It enables automated exploitation from a pipeline.
Critical
SKILL.md:344-348
Ruby/shell backtick execution
```
The surrounding CI example creates a Metasploit resource script and runs headless exploit validation. It enables automated exploitation from a pipeline.
Critical
SKILL.md:377-390
Ruby/shell backtick execution
```bash
The surrounding troubleshooting guidance recommends evasion payload generation and session migration. This can help bypass defenses after exploitation.
Critical
SKILL.md:390-400
Ruby/shell backtick execution
```
The surrounding troubleshooting guidance recommends evasion payload generation and session migration. This can help bypass defenses after exploitation.
Critical
SKILL.md:416-430
Ruby/shell backtick execution
```bash
The surrounding section provides privilege escalation and UAC bypass workflow steps. This is high-risk post-compromise guidance.
High
assets/ci-config-template.yml:164
Git platform tokens
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The CI template passes GITHUB_TOKEN to a third-party action. If the action or tag is compromised, the workflow token could be abused.
High
SKILL.md:79-83
Ruby/shell backtick execution
```bash
The surrounding block provides Metasploit workspace, Nmap import, and module search commands against targets. This is operational reconnaissance and exploit-selection guidance.
High
SKILL.md:83-87
Ruby/shell backtick execution
```
The surrounding block provides Metasploit workspace, Nmap import, and module search commands against targets. This is operational reconnaissance and exploit-selection guidance.
High
SKILL.md:87-91
Ruby/shell backtick execution
```bash
The surrounding block provides Metasploit workspace, Nmap import, and module search commands against targets. This is operational reconnaissance and exploit-selection guidance.
High
SKILL.md:91-97
Ruby/shell backtick execution
```
The surrounding block provides Metasploit workspace, Nmap import, and module search commands against targets. This is operational reconnaissance and exploit-selection guidance.
High
SKILL.md:97-101
Ruby/shell backtick execution
```bash
The surrounding block provides Metasploit workspace, Nmap import, and module search commands against targets. This is operational reconnaissance and exploit-selection guidance.
High
SKILL.md:101-113
Ruby/shell backtick execution
```
The surrounding block provides Metasploit workspace, Nmap import, and module search commands against targets. This is operational reconnaissance and exploit-selection guidance.
High
SKILL.md:348-377
Ruby/shell backtick execution
- **Nmap Integration**: Import reconnaissance data with `db_import`
The line advertises Nmap integration with Metasploit data import. In context it supports target reconnaissance for exploitation.
High
SKILL.md:400-411
Ruby/shell backtick execution
```bash
The surrounding troubleshooting guidance changes targets and payloads after failed exploitation. This is operational exploit iteration guidance.
High
SKILL.md:411-416
Ruby/shell backtick execution
```
The surrounding troubleshooting guidance changes targets and payloads after failed exploitation. This is operational exploit iteration guidance.
High
SKILL.md:350
PowerShell invocation
- **Empire**: Handoff sessions to PowerShell Empire framework
The line recommends handoff to PowerShell Empire, a post-exploitation framework. That is operational offensive integration guidance.
High
SKILL.md:38
sudo privilege escalation
sudo systemctl start postgresql
The skill instructs using sudo to start PostgreSQL as part of Metasploit setup. It is local privileged command execution, even if operationally plausible.
High
SKILL.md:229
SOCKS proxy
socks4 127.0.0.1 1080
The SOCKS proxy configuration is part of a pivoting workflow through a compromised host. It enables lateral movement and proxying tools into internal networks.
Medium
SKILL.md:36-48
Ruby/shell backtick execution
```bash
Although the detector matched Markdown backticks, the fenced block contains shell commands for service startup, database initialization, and launching Metasploit. This is external command guidance in the skill.
Medium
SKILL.md:48-79
Ruby/shell backtick execution
```
Although the detector matched Markdown backticks, the fenced block contains shell commands for service startup, database initialization, and launching Metasploit. This is external command guidance in the skill.
Medium
SKILL.md:229
Hardcoded IP address
socks4 127.0.0.1 1080
The hardcoded localhost address configures a SOCKS proxy for pivoting through a compromised host. In this context it supports lateral movement workflow.
Low
assets/ci-config-template.yml:240
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The URL is a remote installer used in a CI command that pipes directly to bash. A changed or compromised remote script would execute in CI.

Risk Factors

⚙️ External commands (50)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 SKILL.md:36-48 SKILL.md:48-79 SKILL.md:79-83 SKILL.md:83-87 SKILL.md:87-91 SKILL.md:91-97 SKILL.md:97-101 SKILL.md:101-113 SKILL.md:113-127 SKILL.md:127-133 SKILL.md:133-142 SKILL.md:142-154 SKILL.md:154-176 SKILL.md:176-179 SKILL.md:179-180 SKILL.md:180-181 SKILL.md:181-182 SKILL.md:182-188 SKILL.md:188-199 SKILL.md:199-202 SKILL.md:202-203 SKILL.md:203-204 SKILL.md:204-205 SKILL.md:205-211 SKILL.md:211-223 SKILL.md:223-227 SKILL.md:227-233 SKILL.md:233-276 SKILL.md:276-282 SKILL.md:282-286 SKILL.md:286-293 SKILL.md:293-297 SKILL.md:297-311 SKILL.md:311-315 SKILL.md:315-322 SKILL.md:322-330 SKILL.md:330-344 SKILL.md:344-348 SKILL.md:348-377 SKILL.md:377-390 SKILL.md:390-400 SKILL.md:400-411
🌐 Network access (25)
assets/ci-config-template.yml:240 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:451 SKILL.md:452 SKILL.md:453 SKILL.md:454 SKILL.md:455 SKILL.md:229 SKILL.md:229
📁 Filesystem access (2)
assets/ci-config-template.yml:323 assets/ci-config-template.yml:323
🔑 Env variables (23)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell patternMetasploit framework×48Cobalt Strike keywordsC2 keywordsSystem reconnaissance×4Network scanning tools×4[HEURISTIC] DANGEROUS COMBINATION: Code execution + Network + Credential access
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/agentsecops-pentest-metasploit/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-pentest-metasploit/security.svg)](https://skillstore.io/skills/agentsecops-pentest-metasploit?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-pentest-metasploit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-pentest-metasploit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-pentest-metasploit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). pentest-metasploit security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-pentest-metasploit/audits/10

BibTeX citation

@techreport{agentsecops-agentsecops-pentest-metasploit-2026, author = {AgentSecOps}, title = {pentest-metasploit security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/agentsecops-pentest-metasploit/audits/10}, note = {Author version 0.1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "pentest-metasploit security audit report (audit version 10)" version: "0.1.0" type: report authors: - name: "AgentSecOps" date-released: "2026-07-09" url: "https://skillstore.io/skills/agentsecops-pentest-metasploit/audits/10" identifiers: - type: other value: "skillstore:agentsecops-pentest-metasploit:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
100
Maintainability
87
Content
73
Community
100
Spec Compliance

What You Can Build

Plan Authorized Validation

Prepare a scoped vulnerability validation plan with safety checks, evidence goals, and cleanup tasks.

Build Detection Exercises

Translate documented Metasploit behaviors into lab-only detection and response scenarios.

Review Offensive Procedures

Assess whether proposed exploit workflows match engagement rules and internal risk limits.

Try These Prompts

Confirm Authorization 
Review this engagement scope and identify in-scope assets, test windows, safety limits, and escalation contacts before any validation work.
Plan Safe Validation 
Create a controlled validation plan for this approved finding. Include prerequisites, stop conditions, expected evidence, cleanup, and reporting notes.
Prepare Finding Report 
Turn these authorized test observations into a finding narrative with business impact, evidence summary, affected assets, remediation, and residual risk.
Design Defensive Exercise 
Convert this Metasploit-style workflow into a lab-only detection exercise with telemetry goals, control mapping, response actions, and success criteria.

Best Practices

  • Confirm written authorization, scope, and emergency contacts before using any workflow.
  • Use isolated lab or engagement workspaces with logging and cleanup requirements.
  • Record actions, evidence, and stop conditions for every validation step.

Avoid

  • Running exploit steps on assets outside the approved scope.
  • Generating phishing payloads, persistence, or credential collection for live users.
  • Using remote installer scripts or broad CI tokens without pinning and review.

Frequently Asked Questions

Is this safe for automatic installation?
No. The skill contains operational offensive security workflows and needs human security review before use.
Does this skill require Metasploit?
Yes. The documented workflows assume Metasploit Framework and related tooling in a controlled environment.
Can the skill verify authorization?
No. Users must provide written authorization, scope, and testing windows from the asset owner.
Can defenders use this skill?
Yes, defenders can adapt it for lab-only detection planning, control validation, and response exercises.
Does the skill execute commands by itself?
The skill provides command-oriented workflows. Execution depends on the agent, user approval, and environment controls.
What should be removed before publication?
Remove payload delivery, credential collection, persistence, C2 handoff, evasion, and live exploitation steps.

Developer Details

License

MIT

Author version

v0.1.0

Skillstore revision

r1

Repository

https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/pentest-metasploit

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

8 downloads · 375 views

File structure

📁 assets/

📄 .gitkeep

📄 ci-config-template.yml

📄 rule-template.yaml

📁 references/

📄 EXAMPLE.md

📄 WORKFLOW_CHECKLIST.md

📄 SKILL.md

More from AgentSecOps

View all

Related Skills

View all