# Validate Vulnerabilities with Metasploit

Security teams need repeatable workflows for authorized vulnerability validation without losing scope discipline. This skill guides Metasploit planning, execution notes, and defensive reporting for controlled assessments.

## Install

```bash
npx skillstore add agentsecops/pentest-metasploit
```

## Metadata

- - Slug: agentsecops-pentest-metasploit
- - Version: 0.1.0
- - Author: AgentSecOps
- - GitHub username: AgentSecOps
- - License: MIT
- - Repository: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/offsec/pentest-metasploit
- - Ref: main
- - Supported tools: Claude, Codex, Claude Code
- - Risk level: high
- - Risk factors: external\_commands, network, filesystem, env\_access, scripts
- - Quality score: 38
- - Quality tier: warning
- - Public page: https://skillstore.pages.dev/skills/agentsecops-pentest-metasploit
- - Manifest: https://skillstore.pages.dev/api/skills/agentsecops-pentest-metasploit/manifest

## Capabilities

- Guides Metasploit workspace setup and database-backed target tracking.
- Explains exploit selection, option review, payload configuration, and result logging.
- Provides post-exploitation checklists for authorized session handling and evidence capture.
- Maps Metasploit activity to MITRE ATT&CK, OWASP, PTES, PCI-DSS, and SOC 2 context.
- Includes CI and rule templates for security validation workflows.

## Use Cases

- Validate Exposure in an Internal Assessment: Plan a scoped Metasploit workflow, document exploit checks, and record evidence for an authorized internal network test.
- Test Detection and Response Coverage: Use controlled activity descriptions to align EDR, IDS, logging, and incident response checks with expected Metasploit behaviors.
- Prepare a Vulnerability Validation Report: Convert validated findings into impact statements, affected assets, remediation notes, and framework mappings for stakeholders.

## Prompt Templates

### Confirm Assessment Scope

```
Help me create an authorization and scope checklist for a Metasploit assessment. Include target ranges, testing windows, contacts, exclusions, and evidence handling.
```

### Plan Vulnerability Validation

```
Given these authorized findings and target details, outline a safe Metasploit validation plan with pre-checks, logging needs, rollback steps, and reporting fields.
```

### Map Activity to Controls

```
Map this authorized Metasploit test plan to MITRE ATT&CK techniques and suggest detections, logs, and alerts defenders should verify.
```

### Review a Red Team Workflow

```
Review this authorized Metasploit workflow for scope risk, unsafe steps, evidence gaps, cleanup requirements, and defensive coordination points.
```

## Limitations

- Requires written authorization and a clearly defined testing scope.
- Does not verify that targets are legally authorized for testing.
- Can produce harmful outcomes if used on unauthorized systems.
- Requires installed Metasploit, PostgreSQL, and supporting security tools.

## Best Practices

- Use the skill only with written authorization and a documented scope.
- Run tests in controlled windows with logging, monitoring, and emergency contacts active.
- Record evidence, cleanup actions, and remediation guidance for every validated finding.

## Anti Patterns

- Do not use the workflows against systems without explicit permission.
- Do not copy exploit, persistence, or evasion steps into production without legal and operational approval.
- Do not treat successful exploitation as complete without cleanup, reporting, and defensive follow-up.

## Security Audit

- - Safe to publish: false
- - Audited at: 2026-06-28T05:47:59.177\+00:00
- - Summary: Static findings are mostly true positives for a high-risk dual-use Metasploit skill: it contains operational exploit, payload, post-exploitation, credential access, pivoting, and evasion guidance. Several template and reference detections are false positives because they are security-rule examples or CI documentation, and no prompt-injection evidence was found. The skill is not blocked as confirmed malicious because it repeatedly requires authorization, but it is not safe for general publication.

## Stats

- - Views: 375
- - Downloads: 7
- - Favorites: 0
- - Popularity score: 0