cobalt-strike

Pass

Audited by Gen Agent Trust Hub on May 9, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a technical reference for Cobalt Strike (CS). It describes standard red teaming procedures such as credential harvesting, lateral movement, and C2 (Command and Control) management within an instructional framework.
  • [SAFE]: No commands or instructions were detected that attempt to bypass agent safety filters, access the user's local sensitive files (like SSH keys or environment variables), or execute malicious code on the host environment.
  • [SAFE]: The Aggressor Scripting guide in references/aggressor-scripting.md contains code snippets that demonstrate how to automate CS tasks. For example, it shows how to use Java classes within the Sleep scripting engine to send notifications to a webhook when a new session is established. These examples are documented for use within the CS framework and do not target the AI agent's environment.
  • [SAFE]: The methodologies described for privilege escalation and persistence are targeted at remote 'victim' systems during authorized security assessments, and the skill does not attempt to apply these techniques to the agent's execution context.
  • [SAFE]: All external references and command examples (e.g., teamserver, beacon commands, mimikatz) are consistent with the stated purpose of providing a Cobalt Strike operational manual.
Audit Metadata
Risk Level
SAFE
Analyzed
May 9, 2026, 08:28 AM