metasploit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:21 PM UTC
• Version: 1.0.0

Overview

This skill is openly for authorized Metasploit testing, but its resource-script generator lacks input validation in ways that could turn crafted arguments into extra Metasploit commands when the generated script is run.

Install only if you are comfortable reviewing every generated .rc file before running it and using the skill strictly on authorized targets. Treat module, payload, host, path, and option values as untrusted unless you typed and validated them yourself; the generator should be fixed to reject newlines/control characters and validate module paths before routine use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/build_rc.py:55
• Finding: Metasploit Resource Script Command Injection via Unvalidated Module and Payload Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/build_rc.py`, lines 55–62 **Vulnerability Type**: Metasploit resource-script command injection **Risk Level**: High ### Vulnerable Code ```python lines.append(f"use {args.module}") if args.rhosts: lines.append(f"set RHOSTS {quote_value(args.rhosts)}") if args.rport is not None: lines.append(f"set RPORT {args.rport}") if args.payload: lines.append(f"set PAYLOAD {args.payload}") ``` ### Technical Analysis The values supplied through `--module` and `--payload` are interpolated directly into Metasploit resource-script commands. Neither value is validated against the expected Metasploit module-path syntax, escaped, nor passed through `quote_value()`. An attacker who can influence the script arguments can include newline characters in either value. The newline terminates the intended `use` or `set PAYLOAD` command and introduces one or more additional commands into the generated `.rc` file. Metasploit resource scripts are subsequently intended to be executed using the documented command: ```bash msfconsole -q -r run.rc ``` Because `msfconsole` supports commands capable of invoking local operating-system commands, injected resource-script content can lead to arbitrary command execution under the identity of the operator running Metasploit. This is a generation-time injection vulnerability: creating the file does not itself execute the payload, but execution occurs when an operator follows the documented workflow and loads the generated resource script. ### Attack Path 1. An attacker gains control over, or convinces an operator to use, a crafted `--module` or `--payload` argument. 2. The malicious argument contains a valid-looking value followed by a newline and an additional Metasploit console command, such as a command that invokes a local shell. 3. `build_rc.py` writes the attacker-controlled text directly into the resource script. 4. The operator review ...[truncated 1481 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Strictly validate module and payload paths** Apply an allowlist that accepts only the syntax required for Metasploit identifiers. For example: ```python MODULE_RE = re.compile(r"^[A-Za-z0-9_./-]+$") ``` Reject values that do not match the allowlist before generating any output. If stricter syntax is practical, require known prefixes such as `exploit/`, `auxiliary/`, or recognized payload families. 2. **Reject command delimiters and control characters globally** Reject carriage returns, line feeds, NUL bytes, and other ASCII control characters in every user-controlled value written to the resource script. This protection should apply to `--module`, `--payload`, `--rhosts`, `--lhost`, `--targeturi`, `--workspace`, `--spool`, `--set`, and `--setg` values. ```python def reject_control_characters(value: str, field: str) -> None: if any(ord(ch) < 32 or ord(ch) == 127 for ch in value): raise ValueError(f"{field} contains prohibited control characters") ``` 3. **Use field-specific validation** Do not rely solely on generic quoting. Validate each argument according to its semantics: - Module and payload: constrained resource paths. - Ports: enforce the range `1–65535`. - Hosts: validate expected hostname, IP address, or CIDR syntax. - Option keys: retain the existing strict key allowlist. - File paths: reject line breaks and apply an explicit path policy where appropriate. 4. **Fail safely before writing output** Validate all arguments before creating parent directories or writing the resource file. On validation failure, return a nonzero status and avoid leaving a partial script. 5. **Add regression tests** Include tests proving rejection of: - `\n` and `\r\n` injection in module and payload arguments. - Control characters in all other string arguments. - Embedded resource-script commands. - Invalid module-path characters. - Out-of-ran ...[truncated 246 chars]

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match

Content

---
name: openclaw-metasploit
description: Plan and execute authorized Metasploit assessments for OpenClaw tasks with repeatable workflows, including target triage, exploit module selection, option tuning, .rc generation, controlled execution, and evidence-focused reporting. Use when requests involve msfconsole operations, module/payload matching, exploit/check automation, session verification, or pentest result writeups.
---

# OpenClaw Metasploit

## Overview

Use this skill to run deterministic and auditable Metasploit workflows for authorized security testing.
Prefer a check-first workflow and generate repeatable `.rc` scripts via `scripts/build_rc.py` instea

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match

Content

interface:
  display_name: "OpenClaw Metasploit"
  short_description: "Metasploit exploitation workflow for OpenClaw operations"
  default_prompt: "Use this skill to plan and execute Metasploit workflows for authorized security testing with clear verification and reporting steps."

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match

Content

ayloads that match objective and minimize operational impact.
4. Avoid noisy options unless explicitly approved in scope.
5. Record why one module was chosen over alternatives.

## Common Service-to-Module Discovery Patterns

### HTTP/Web
- Search: `search type:exploit service:http <product|cve>`
- Verify options: `TARGETURI`, `SSL`, `VHOST`, auth fields
- Typical payload families:
  - `linux/x64/meterpreter/reverse_tcp`
  - `cmd/unix/reverse_bash`
  - `php/meterpreter/reverse_tcp`

### SMB/Windows
- Search: `search type:exploit service:smb <product|cve>`
- Verify options: `RHOSTS`, `RPORT`, `SMBUser`, `SMBPass`, domain options
- Typical payload families:
  - `windows/x64/meterpreter/reverse_tcp`
  - `windows/shell/reverse_tcp`

### SSH
- Search: `search type:exploit service:ssh <product|cve>`
- Verify options: credentials, key paths, brute-force limits
- Typical payload families:
  - command or session payloads aligned with module support

### Database Services
- Search: `search type:

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match

Content

command += " -j"
    if args.background:
        command += " -z"
    lines.append(command)

    if args.list_sessions:
        lines.append("sessions -l")

    if args.auto_exit:
        if args.spool:
            lines.append("spool off")
        lines.append("exit -y")

    return lines


def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(
        description="Build a Metasploit .rc script for repeatable exploit execution."
    )
    parser.add_argument("--module", required=True, help="Metasploit module path")
    parser.add_argument("--rhosts", help="RHOSTS value")
    parser.add_argument("--rport", type=int, help="RPORT value")
    parser.add_argument("--payload", help="Payload module path")
    parser.add_argument("--lhost", help="LHOST value")
    parser.add_argument("--lport", type=int, help="LPORT value")
    parser.add_argument("--targeturi", help="TARGETURI value")
    parser.add_argument("--ssl", action="store_true", help="Set SSL true")
    parser

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is described as performing end-to-end authorized Metasploit assessments, including triage, module selection, controlled execution, session verification, and reporting, but the described implementation appears much narrower and centers on `.rc` script generation and procedural guidance. This mismatch can mislead operators or downstream agents into overtrusting the skill's safeguards and capabilities, causing unsafe assumptions about authorization checks, execution controls, and evidence handling.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill provides actionable instructions to generate Metasploit resource scripts and explicitly references writing `.rc` files via `scripts/build_rc.py`, but it does not declare any tool scope or permission boundaries. In an agent environment, missing `permissions` or `allowed-tools` increases the chance that file-writing or adjacent execution capabilities are used without explicit policy constraints, which is risky for a security-sensitive skill.

Static analysis

No suspicious patterns detected.