metasploit-framework

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High-risk: the content provides explicit, step-by-step instructions to achieve remote code execution, create and deploy reverse shells, harvest credentials (hashdump, credential_collector), perform keylogging/screenshots, establish persistence and pivoting, and obfuscate payloads for AV evasion—all patterns that enable backdoors, unauthorized access, and data exfiltration.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's prerequisites instruct a runtime curl that downloads and then executes a remote installer script from https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb, which fetches and runs remote code as a required setup step.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running sudo commands (e.g., sudo systemctl start postgresql, sudo msfdb init) and includes post-exploitation/persistence and privilege-escalation guidance, which directs the agent to obtain elevated privileges and modify the host system state.