Skillv1.0.0

ClawScan security

metasploit · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousMar 11, 2026, 10:03 AM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's content matches a legitimate Metasploit workflow, but the registry metadata omits required runtime binaries (e.g., msfconsole/python3) and there are small coherence gaps you should verify before use.
Guidance: This skill implements a legitimate, cautious Metasploit workflow and includes a small helper script to generate .rc files, but the package metadata does not declare that msfconsole and python3 are required. Before installing or running: (1) Verify you have explicit, written authorization for any targets you test; (2) confirm msfconsole and python3 are present and allowed in your environment; (3) inspect scripts/build_rc.py (it's short and readable) and any output paths the skill will write to (spool, .rc files); (4) run in an isolated/test environment first to avoid accidental impact; and (5) prefer source or homepage provenance — this package has no homepage listed, so if provenance matters to you, request the publisher to provide it. The omission of required binaries in metadata may be an oversight, but treat it as a risk until clarified.

Review Dimensions

Purpose & Capability: concernThe skill name, description, SKILL.md, references, and the included scripts clearly target Metasploit workflows (module selection, .rc generation, msfconsole execution). However the declared metadata lists no required binaries or primary credential even though the runtime instructions call for msfconsole and python3. That omission is inconsistent with the stated purpose and should be corrected or explained.
Instruction Scope: okSKILL.md is narrowly focused on planning and executing authorized Metasploit assessments, includes an explicit authorization check, stepwise workflow, and conservative guidance (use check first, review .rc before running). The instructions do direct the agent to write .rc files, run msfconsole, and capture logs/sessions — all expected for this purpose and explicitly scoped to authorized testing.
Install Mechanism: noteThere is no install spec (instruction-only plus a small included script), which is lowest risk for supply-chain code changes. The included scripts/build_rc.py is simple and safe. The skill relies on external tools (msfconsole, Python) but does not install them; the metadata should list those runtime dependencies.
Credentials: noteNo environment variables, credentials, or config paths are requested — appropriate for this skill. Still, the skill will operate on network targets and may need filesystem access for .rc and spool logs; ensure those are acceptable for your environment. The lack of declared required binaries (msfconsole/python3) is the main proportionality inconsistency.
Persistence & Privilege: okSkill does not request always:true or other elevated persistence. It is user-invocable and allows autonomous invocation by default (platform standard). It does not modify other skills or claim system-wide configuration changes.