metasploit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:21 PM UTC
• Version: 1.0.0

Overview

This skill is openly for authorized Metasploit testing, but its resource-script generator lacks input validation in ways that could turn crafted arguments into extra Metasploit commands when the generated script is run.

Install only if you are comfortable reviewing every generated .rc file before running it and using the skill strictly on authorized targets. Treat module, payload, host, path, and option values as untrusted unless you typed and validated them yourself; the generator should be fixed to reject newlines/control characters and validate module paths before routine use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/build_rc.py:55

Finding

Metasploit Resource Script Command Injection via Unvalidated Module and Payload Arguments

Content

View full analysis

Remediation

View remediation

None: if any(ord(ch) < 32 or ord(ch) == 127 for ch in value): raise ValueError(f"{field} contains prohibited control characters") ``` 3. **Use field-specific validation** Do not rely solely on generic quoting. Validate each argument according to its semantics: - Module and payload: constrained resource paths. - Ports: enforce the range `1–65535`. - Hosts: validate expected hostname, IP address, or CIDR syntax. - Option keys: retain the existing strict key allowlist. - File paths: reject line breaks and apply an explicit path policy where appropriate. 4. **Fail safely before writing output** Validate all arguments before creating parent directories or writing the resource file. On validation failure, return a nonzero status and avoid leaving a partial script. 5. **Add regression tests** Include tests proving rejection of: - `\n` and `\r\n` injection in module and payload arguments. - Control characters in all other string arguments. - Embedded resource-script commands. - Invalid module-path characters. - Out-of-ran ...[truncated 246 chars]

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: openclaw-metasploit
description: Plan and execute authorized Metasploit assessments for OpenClaw tasks with repeatable workflows, including target triage, exploit module selection, option tuning, .rc generation, controlled execution, and evidence-focused reporting. Use when requests involve msfconsole operations, module/payload matching, exploit/check automation, session verification, or pentest result writeups.
---

# OpenClaw Metasploit

## Overview

Use this skill to run deterministic and auditable Metasploit workflows for authorized security testing.
Prefer a check-first workflow and generate repeatable `.rc` scripts via `scripts/build_rc.py` instea

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · agents/openai.yaml (reported line 3)May include surrounding context.

yaml

interface:
  display_name: "OpenClaw Metasploit"
  short_description: "Metasploit exploitation workflow for OpenClaw operations"
  default_prompt: "Use this skill to plan and execute Metasploit workflows for authorized security testing with clear verification and reporting steps."

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/module-selection.md (reported line 25)May include surrounding context.

md

ayloads that match objective and minimize operational impact.
4. Avoid noisy options unless explicitly approved in scope.
5. Record why one module was chosen over alternatives.

## Common Service-to-Module Discovery Patterns

### HTTP/Web
- Search: `search type:exploit service:http <product|cve>`
- Verify options: `TARGETURI`, `SSL`, `VHOST`, auth fields
- Typical payload families:
  - `linux/x64/meterpreter/reverse_tcp`
  - `cmd/unix/reverse_bash`
  - `php/meterpreter/reverse_tcp`

### SMB/Windows
- Search: `search type:exploit service:smb <product|cve>`
- Verify options: `RHOSTS`, `RPORT`, `SMBUser`, `SMBPass`, domain options
- Typical payload families:
  - `windows/x64/meterpreter/reverse_tcp`
  - `windows/shell/reverse_tcp`

### SSH
- Search: `search type:exploit service:ssh <product|cve>`
- Verify options: credentials, key paths, brute-force limits
- Typical payload families:
  - command or session payloads aligned with module support

### Database Services
- Search: `search type:

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/build_rc.py (reported line 99)May include surrounding context.

python

command += " -j"
    if args.background:
        command += " -z"
    lines.append(command)

    if args.list_sessions:
        lines.append("sessions -l")

    if args.auto_exit:
        if args.spool:
            lines.append("spool off")
        lines.append("exit -y")

    return lines


def parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(
        description="Build a Metasploit .rc script for repeatable exploit execution."
    )
    parser.add_argument("--module", required=True, help="Metasploit module path")
    parser.add_argument("--rhosts", help="RHOSTS value")
    parser.add_argument("--rport", type=int, help="RPORT value")
    parser.add_argument("--payload", help="Payload module path")
    parser.add_argument("--lhost", help="LHOST value")
    parser.add_argument("--lport", type=int, help="LPORT value")
    parser.add_argument("--targeturi", help="TARGETURI value")
    parser.add_argument("--ssl", action="store_true", help="Set SSL true")
    parser

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is described as performing end-to-end authorized Metasploit assessments, including triage, module selection, controlled execution, session verification, and reporting, but the described implementation appears much narrower and centers on .rc script generation and procedural guidance. This mismatch can mislead operators or downstream agents into overtrusting the skill's safeguards and capabilities, causing unsafe assumptions about authorization checks, execution controls, and evidence handling.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill provides actionable instructions to generate Metasploit resource scripts and explicitly references writing .rc files via scripts/build_rc.py, but it does not declare any tool scope or permission boundaries. In an agent environment, missing permissions or allowed-tools increases the chance that file-writing or adjacent execution capabilities are used without explicit policy constraints, which is risky for a security-sensitive skill.

Content

No source excerpt is available for this finding.