Metasploit Framework

Reviewed 2026-10-21securityPrompt / Rule# security # metasploit # pentest # authorized-testing # red-team

Community skill that gives an agent a command reference for the Metasploit penetration-testing framework. It is an offensive-security skill: the upstream file is marked risk: offensive and meant for authorised assessments and lab use only.

Security Reviewed

Markdown command reference for an offensive-security tool; no code of its own, but it directs an agent to run exploitation commands. Authorised use and a lab only.

Install Metasploit Framework in Google Antigravity

Antigravity loads skills from .agents/skills/ in your project or ~/.gemini/config/skills/ for all projects (official docs). Full guide

EasiestOption 1: paste this to your Antigravity agent

Install the "Metasploit Framework" skill for Google Antigravity.
Follow the steps at https://www.antigravityskills.org/install/metasploit-framework.md (source: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/metasploit-framework).
Before running anything, show me what you will download and whether it includes scripts, and wait for my OK.
Install it into this project (.agents/skills/) unless I say global. When done, check that Antigravity lists it as an installed skill.

The agent reads the install file, shows you what it will download and waits for your OK.

Option 2: install it yourself

1. Download the repository
```
git clone --depth 1 https://github.com/sickn33/antigravity-awesome-skills.git /tmp/ag-skills && git -C /tmp/ag-skills log -1 --format=%h
```
We reviewed commit 32b8ad9. If the second command prints a different hash, the skill may have changed since our review. Only continue if you have authorisation to test the systems you will point it at.
2. Copy the skill into this project (workspace skill)
```
mkdir -p .agents/skills && cp -r /tmp/ag-skills/skills/metasploit-framework .agents/skills/
```
Run from your project root. Antigravity reads workspace skills from .agents/skills/<folder>/; this folder holds one file, SKILL.md. Prefer a workspace skill for a security skill so it is not active in every project.
3. Or install it for all projects (global skill)
```
mkdir -p ~/.gemini/config/skills && cp -r /tmp/ag-skills/skills/metasploit-framework ~/.gemini/config/skills/
```
Use this instead of the previous step. We do not recommend a global install for an offensive-security skill.
4. Check that Antigravity sees it
Antigravity app: start a new conversation and ask "What skills do you have?"; metasploit-framework should be listed. Antigravity CLI: run /skills (/skills reload in a session that was already open). The skill does not install Metasploit; that is a separate step from Rapid7's own documentation.

The skill is a text file, but it steers an agent toward running penetration-testing commands. Keep the confirmation gate in the file intact and use it only in a lab or an authorised engagement.

Using Claude Code, Cursor or Codex? See other assistants below.

What is Metasploit Framework?

metasploit-framework is a community skill in sickn33's antigravity-awesome-skills collection (frontmatter author: zebbern, added 2026-02-27, risk: offensive). It is a single Markdown file that teaches an agent the vocabulary and command flow of the Metasploit Framework, the open-source penetration-testing tool maintained by Rapid7. The skill does not contain Metasploit itself: you need your own installation, and Metasploit is only meant to be pointed at systems you own or have written permission to test. This page is written for the people who meet the skill from the other side: security teams who want to know what such a tool does, which of their own controls it exercises, and what a safe, authorised use looks like. We do not reproduce the skill's exploitation walkthrough here.

How to use Metasploit Framework?

Use it only inside an authorised engagement or a disposable lab. The skill's own header requires the agent to ask for the exact target, confirmation of written authorisation and scope, and to show each command and wait for an explicit yes before doing anything that probes or changes a system; without that it should stay read-only and give defensive guidance. For a defender the practical uses are: check which of your systems an authorised tester would be able to reach, and use the module's own vulnerability check against patched and unpatched lab machines to confirm that a fix works.

Key features of Metasploit Framework

✓We counted at 32b8ad9: the skill is one file, SKILL.md (496 lines, 14,529 bytes). No scripts, no checklists, no bundled binaries
✓We counted: it is organised into 10 numbered phases (console basics, module types, searching, configuring, payload types, Meterpreter, auxiliary, post-exploitation, payload generation, handlers) plus a quick-reference and a short troubleshooting table
✓Its header says AUTHORIZED USE ONLY and adds a mandatory confirmation gate: the agent must ask for the exact target, confirm written authorisation and scope, show the command and wait for an explicit yes. Without that it is told to stay read-only and give defensive guidance
✓The skill's own limitations section says modern AV/EDR may detect Metasploit payloads and that firewall rules may block reverse connections: both are controls a defender can check
✓For scale, we counted modules in rapid7/metasploit-framework at 401e4e45 (2026-10-20): 2,717 exploit, 1,348 auxiliary, 436 post, 545 payload, 57 encoder, 14 nop and 13 evasion files. The skill covers the workflow, not these modules, and lists only a handful of example module paths
✓Metasploit Framework itself is open source under a BSD-style licence (its README); the skill file is covered by the collection's MIT licence

When to use Metasploit Framework

1Understanding, as a defender, what an authorised penetration test will try so you can check logging, alerting and patch levels before it starts
2Rehearsing detection in an isolated lab: running a module against a patched and an unpatched test machine and confirming your EDR and network monitoring react
3Giving an agent a command reference while you carry out a scoped, written-permission assessment with the confirmation gate switched on

Source and files

Repository: sickn33/antigravity-awesome-skills (MIT)
Upstream risk label: offensive
Added upstream: 2026-02-27
SKILL.md size: 14.2 KB
Files in the skill folder: SKILL.md
Listing synced: 2026-10-05 from commit bdacd76

Installation & Setup Guide

Agent Rules / Prompt Setup

Follow these steps (taken from the project's own docs) to configure Metasploit Framework in your development environment.

Step 1: Claude Code (manual copy)claude

mkdir -p .claude/skills && cp -r /tmp/ag-skills/skills/metasploit-framework .claude/skills/

Not documented per skill by the repository; this uses Claude Code's standard .claude/skills/ folder after the clone above.

Step 2: Cursor: not documented by the projectcursor

The README lists installer targets for several hosts, but gives no per-skill Cursor path, so we do not list one.

Usage Example & Verification

Prompt / Request Example

1) Our example (defensive): "Read the metasploit-framework skill and list, in plain language, which kinds of activity it describes, and which logs and alerts in a typical Windows and Linux environment would show that activity. Do not run anything."
-> The agent summarises the file and maps it to detection points. No commands are run.

2) Our example (planning): "We have written permission to test the lab network 10.99.0.0/24 only. Draft a rules-of-engagement checklist and the evidence we need to keep."
-> The agent produces a scope and reporting checklist; it should still ask you to confirm the target before any command.

3) We do not publish exploit or payload commands on this page. They are in the upstream SKILL.md for people who are authorised to use them.

Security Review

Static review

Reviewed Date

2026-10-21

Audited Ref / Commit

32b8ad9

Reviewer

antigravityskills.org (static review)

Markdown command reference for an offensive-security tool; no code of its own, but it directs an agent to run exploitation commands. Authorised use and a lab only.

Full review: scope, findings, risks

Audit Scope:skills/metasploit-framework/SKILL.md read in full (496 lines) at commit 32b8ad9 (2026-10-20); repository README disclaimer and LICENSE; module counts taken from a shallow clone of rapid7/metasploit-framework at 401e4e45 (2026-10-20). Static review only; we did not install Metasploit or run the skill.

Key Findings:One Markdown file, no scripts. It contains command examples for scanning, exploitation, post-exploitation and payload generation with msfvenom, a mandatory confirmation gate at the top, a legal-requirements section and a troubleshooting table. It makes no network calls itself and needs no API keys. One troubleshooting row mentions sudo msfdb init for the Metasploit database; the prerequisites say the skill itself needs no sudo.

Identified Operational Risks & Permissions:High (dual use). The commands it describes can compromise systems if pointed at targets you are not authorised to test. Upstream frontmatter: risk: offensive. Use in a disposable lab or under written authorisation only.

The folder holds one file, SKILL.md. We found no scripts, no URLs the agent is told to download from, no credentials and no instructions to disable safeguards. The file starts with an AUTHORIZED USE ONLY notice and a confirmation gate (ask for the exact target, confirm written authorisation and scope, show commands, wait for explicit confirmation; otherwise stay read-only). The body lists Metasploit console commands, module categories, payload types, Meterpreter and post-exploitation commands, msfvenom payload generation and a handler setup, plus three short constraint lists (legal, technical, operational). The operational list and one troubleshooting row cover avoiding detection; we deliberately do not reproduce them. Because it steers an agent toward commands that change remote systems, we rate the dual-use risk high even though the file contains no code. We did not run Metasploit or test the skill in Antigravity.

Operational Notes & Known Limitations

Known Limitations

•Offensive-security tooling: using it against systems you do not own or have written permission to test is illegal in most countries
•The skill is only a reference file: it needs a separate Metasploit installation, and we did not install or run Metasploit for this review
•Frontmatter marks it risk: offensive. The skill's own troubleshooting section includes steps for getting payloads past antivirus; we do not repeat them
•Static review only: we read the file at the commit below and did not test the skill in Antigravity
•Not an official Rapid7 or Google product; the collection's README says it is not affiliated with or endorsed by Google

Frequently Asked Questions

What is the Metasploit Framework skill?

A single Markdown file in sickn33's antigravity-awesome-skills collection that gives an agent a command reference for Metasploit, the open-source penetration-testing framework. It does not include Metasploit and it is marked risk: offensive upstream.

Is the Metasploit Framework skill safe?

The file itself is plain Markdown: we found no scripts, no network calls and no credentials in it. The risk is what it makes an agent do: run scanning and exploitation commands. Its own header requires the agent to ask for the target and written authorisation and to wait for your yes before each such command. Use it only in a lab or an authorised test.

Is it legal to use?

Only against systems you own or have explicit written permission to test. The skill says so itself, and we are not a source of legal advice.

How do I install it in Antigravity?

Clone sickn33/antigravity-awesome-skills, copy skills/metasploit-framework into .agents/skills/ and ask "What skills do you have?" (Antigravity CLI: /skills). You must install Metasploit separately, following docs.metasploit.com.

Why does this page not list attack commands?

This directory reviews skills for safety and shows how to install them. For an offensive tool we describe what it does and how to defend against it, and leave the command detail to the upstream file and to Metasploit's own documentation.

Supported Platforms

antigravityclaude

View Source on GitHub

Keep exploring this topic

Browse the full Antigravity skills directory for more source-linked skills with install steps and static safety reviews.

More security skills #security #metasploit #pentest #authorized-testing Use cases

Related Skills

🛡️

Container Security (Snyk)

@snyk

Snyk's container-security skill: scan Docker images for OS and app vulnerabilities via the Snyk MCP server and fix Dockerfiles.

Static reviewinstructions onlyneeds API keynetwork accesswrites files

container-securitydocker

🛡️

Secrets Management

@sickn33

Community skill with a short procedure for handling CI/CD secrets safely: Vault, cloud secret managers, GitHub Actions, workload identity and rotation.

Static review

secretsci-cd

🛡️

Vulnerability Scanner

@sickn33

Community skill that teaches an agent to analyse a project for vulnerabilities (OWASP Top 10:2025, supply chain, attack surface, risk ranking) and ships a Python script that scans a folder.

Static review

securityowasp