Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
S³ Pentest Commands
v1.0.0This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "s...
⭐ 0· 207·0 current·0 all-time
bySolomon Neas@solomonneas
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name and description match the SKILL.md: it's a command reference for penetration testing tools (nmap, metasploit, nikto, sqlmap, etc.). No unrelated binaries, env vars, or installs are requested, so required/declared resources are proportionate to a documentation/reference skill.
Instruction Scope
The instructions include explicit, ready-to-run commands for scanning, exploitation, payload generation, brute forcing, and privilege escalation (e.g., msfconsole exploit sequences, msfvenom payloads, brute-force examples). While these are consistent with the stated purpose, they are highly actionable and dangerous if run against unauthorized targets. The SKILL.md does not instruct the agent to read unrelated files or env vars, but it does assume use of local wordlists and network access.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. Nothing is downloaded or written to disk by the skill itself.
Credentials
The skill requests no environment variables, credentials, or config paths. That is proportionate for a reference document; it does reference expected prerequisites (Kali, wordlists, network access), which are reasonable for pentesting guidance.
Persistence & Privilege
always:false (normal) and model invocation is enabled (default). Because the skill contains explicit exploit commands, autonomous invocation combined with an agent that has network access and pentesting tools installed increases risk—this is not a flaw in the skill itself but an operational risk to consider.
What to consider before installing
This skill is a coherent and complete command reference for penetration testing tools, but it contains ready-to-run exploit and password-cracking commands. Only install or use it if you: (1) have explicit authorization to test the target systems, (2) understand legal/ethical implications, and (3) run the agent in an isolated/test environment. Consider disabling autonomous invocation or requiring explicit user confirmation before running any commands, and ensure audit/logging and network isolation are in place so the agent cannot accidentally execute these commands against production or unauthorized targets.Like a lobster shell, security has layers — review code before you run it.
hydravk97fzq403m3tkv2g5gnaw1nq158376bglatestvk97fzq403m3tkv2g5gnaw1nq158376bgmetasploitvk97fzq403m3tkv2g5gnaw1nq158376bgniktovk97fzq403m3tkv2g5gnaw1nq158376bgnmapvk97fzq403m3tkv2g5gnaw1nq158376bgpenetration-testingvk97fzq403m3tkv2g5gnaw1nq158376bg
License
MIT-0
Free to use, modify, and redistribute. No attribution required.