Metasploit Framework
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches an installation wrapper from the official Rapid7 GitHub repository (
raw.githubusercontent.com/rapid7/metasploit-omnibus/...) to set up the Metasploit Framework environment.- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for software installation, database initialization (msfdb init), and operating the Metasploit console and payload generator.- [PROMPT_INJECTION]: The skill provides an interface for interacting with Metasploit, which includes a surface for indirect prompt injection by interpolating user-provided inputs into framework commands. - Ingestion points: User-supplied values for module options, target addresses (
RHOSTS), and payload parameters (LHOST,LPORT). - Boundary markers: No delimiters or warnings regarding embedded instructions in user data are present in the provided instructions.
- Capability inventory: Full access to Metasploit's suite of exploitation, auxiliary, and post-exploitation modules, along with shell execution capabilities via Meterpreter sessions.
- Sanitization: No input validation, escaping, or sanitization of user-provided parameters is described in the core workflow.
Audit Metadata