metasploit-framework

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with comprehensive executable commands and a clear ten-phase sequence, but it is overlong and monolithic. The Quick Reference duplicates earlier phases, and destructive exploitation steps lack integrated validation checkpoints, capping workflow clarity.

Suggestions

Tighten conciseness by removing the Quick Reference tables that duplicate the phase content and consolidating the repetitive msfvenom examples into one parameterized pattern plus a format list.

Add explicit validation feedback loops into the exploitation workflow (e.g. 'run check; only exploit if vulnerable', 'verify session opened with sessions -l; if no session, consult troubleshooting') instead of relegating recovery to a detached table.

Apply progressive disclosure by moving the full module catalogs and msfvenom payload reference into separate reference files (e.g. references/modules.md, references/msfvenom.md) and keeping SKILL.md as a concise overview with one-level-deep links.

Dimension	Reasoning	Score
Conciseness	The body is a ~470-line command dump that is largely free of explanatory prose fluff, but the Quick Reference tables duplicate the phase content and many msfvenom/payload examples are redundant; much of this command syntax Claude already knows. Not score 3 because it could be tightened considerably; not score 1 because it is lean command blocks rather than tutorial-style concept explanation.	2 / 3
Actionability	Provides fully executable, copy-paste-ready msfconsole and msfvenom commands with concrete options (e.g. 'msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=... -f exe -o shell.exe'). Not below 3 because guidance is specific and complete rather than pseudocode or abstract.	3 / 3
Workflow Clarity	Ten numbered phases give a clear sequence, but exploitation is destructive and the workflow lacks integrated validation feedback loops — the only recovery guidance is a detached Troubleshooting table, and the 'check' step is mentioned but not enforced as a checkpoint. Per the destructive-operations guideline this caps at 2; not score 1 because the sequence is explicitly laid out.	2 / 3
Progressive Disclosure	No bundle files exist; all content lives in a single monolithic SKILL.md. Internal section organization is good (Purpose, Prerequisites, phases, Quick Reference, Constraints, Troubleshooting), but reference material such as full module lists and msfvenom examples that should be split into separate files is inline. Not score 1 because organization is clear, not poor; not score 3 because there is no one-level-deep reference split.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong: it names concrete capabilities, provides natural trigger phrases users would say, includes an explicit use-when clause, and is highly distinct to the Metasploit domain. The only minor weakness is the slightly fluffy 'comprehensive guidance' phrasing in the what-summary, but the action list compensates.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions such as 'exploit vulnerabilities with msfconsole', 'create payloads with msfvenom', and 'perform post-exploitation', matching the multiple-specific-actions anchor. Voice is third person ('This skill should be used...'), so no first/second-person penalty applies; not score 2 because the actions are concrete and comprehensive rather than partial.	3 / 3
Completeness	Explicitly answers 'when' via 'This skill should be used when the user asks to...' and answers 'what' via the action list plus 'provides comprehensive guidance for leveraging the Metasploit Framework in security assessments'. The explicit trigger clause means it is not capped at 2; not below 3 because both what and when are present with explicit triggers.	3 / 3
Trigger Term Quality	Natural user phrases are quoted directly ('use Metasploit for penetration testing', 'create payloads with msfvenom', 'use auxiliary modules for scanning'), giving good coverage of terms a user would actually say. Not score 2 because it covers multiple common variations rather than a single keyword.	3 / 3
Distinctiveness Conflict Risk	Highly distinctive terms (Metasploit, msfconsole, msfvenom, post-exploitation) define a clear niche unlikely to conflict with other skills. Not score 2 because the triggers are tool-specific rather than generic.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/metasploit-framework/SKILL.md
Commit: af7d491

Reviewed: about 8 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.