Pentest C2 Operator
v0.1.0Set up authorized C2 simulation workflows and measure defensive detection outcomes.
⭐ 0· 513·3 current·3 all-time
byMuhammad Mazhar Saeed@0x-professor
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description claim C2 simulation orchestration and detection measurement; the included script enforces scope and authorization, builds a canonical finding, and generates report artifacts. The listed external C2 tools are references only; the skill does not embed or require those tools to run.
Instruction Scope
SKILL.md limits execution to authorized targets, requires --i-have-authorization for live runs, and documents outputs. The runtime script respects scope and dry-run. Note: the script imports helper functions from an external shared module (autonomous-pentester/shared/pentest_common) which is not included here — you should inspect that shared code before running to confirm it does not perform unexpected I/O or network activity.
Install Mechanism
No install spec and no external downloads; the skill is instruction-plus-script only, so it does not write or execute fetched code during install.
Credentials
The skill requires no environment variables, credentials, or config paths. All required inputs (scope, target, input/output paths) are command-line parameters, which is proportional for this purpose.
Persistence & Privilege
always is false and the skill does not request elevated or persistent platform privileges. It writes artifact files to the specified output directory only when run (and only if authorization is confirmed or dry-run is false).
Assessment
This skill appears to do what it says: it validates scope/authorization, and generates local report artifacts. Before installing or running it: (1) review the autonomous-pentester/shared/pentest_common module the script imports (that code will determine what I/O or network actions actually occur); (2) make sure you have written authorization for any live tests and prefer --dry-run until you've audited dependencies; (3) confirm the tool will not invoke external C2 frameworks or download payloads in your environment unless you explicitly enable that behavior; and (4) run in an isolated/test environment first if you're unsure.Like a lobster shell, security has layers — review code before you run it.
latestvk973d93ckr2ettn1s08pvk4ahs820rqb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.