Immutable. This exact content is served forever at /api/v1/blob/098aee21f7a05cb8.
---
name: exploit-test
description: 'Generate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target. Use when validating that a fix actually closed the vulnerability path, confirming a patch deployed correctly, or producing a copy-pasteable test command for QA. The skill never executes — the user runs.'
license: Apache-2.0
allowed-tools: Bash(vulnetix:*) Read Grep Glob Bash(nuclei:*)
argument-hint: <vuln-id> [--target URL]
user-invocable: true
model: sonnet
metadata:
outputBudget: short
cooldown: per-session
chain: "verify-fix"
---
# Vulnetix Exploit Test Skill
## Use when
- You just applied a fix and want to validate the exploit path no longer responds.
- Confirming a patch deployed correctly to staging before promoting to production.
- Producing a copy-pasteable test command for QA hand-off.
- Comparing pre-fix vs post-fix behaviour with the same payload.
- Building authorised proof-of-fix evidence for an audit.
## Don't use for
- Unauthorised testing — the skill explicitly requires user-supplied authorised targets.
- Live attack simulation — use a dedicated red-team tooling chain.
- Generating detection rules — use `detection-rules`.
## Conventions
Follows `skills/_lib/contract.md`. In short: use the `vulnetix_*` MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes.
Builds a copy-pasteable exploit-validation command. Best used after a fix to confirm the vulnerability path no longer responds. **The user runs the command** — this skill does not auto-execute.
## Step 1: Load capabilities
Read `.vulnetix/capabilities.yaml`. Specifically `binaries.nuclei`, `binaries.curl`, `binaries.docker`.
## Step 2: Fetch exploit content
```bash
vulnetix vdb exploits "$ARGUMENTS" -o json
vulnetix vdb ai-assisted-exploits get "$ARGUMENTS" -o json
```
Capture: PoC URLs, Metasploit module IDs, Nuclei template IDs, AI-assisted demo scripts.
## Step 3: Fetch Nuclei template (preferred when binary present)
If `binaries.nuclei: true`:
```bash
vulnetix vdb nuclei get "$ARGUMENTS" --format yaml > .vulnetix/exploit-test/${ARGUMENTS}.yaml
```
## Step 4: Render commands
Pick the highest-fidelity option available. Order:
1. **Nuclei + binary present**:
```bash
nuclei -t .vulnetix/exploit-test/${ARGUMENTS}.yaml -u "$TARGET"
```
2. **Metasploit module ID present and `binaries.msfconsole`** (probe inline):
```bash
msfconsole -q -x "use <module>; set RHOSTS <target>; run; exit"
```
3. **AI-assisted Python demo script** — write to `.vulnetix/exploit-test/${ARGUMENTS}.py`. Suggest:
```bash
uv run --with requests .vulnetix/exploit-test/${ARGUMENTS}.py "$TARGET"
```
4. **Curl-based PoC** (last resort) — fetched from `vdb exploits` references.
Always include a `--target` placeholder if the user did not supply one. Refuse to run against any target without explicit user confirmation.
## Step 5: Verdict guidance
After the user runs the command, expected outcomes:
- Pre-fix: vulnerability triggers (response shape varies by CVE — describe expected indicator)
- Post-fix: command returns benign / 404 / 400
## Memory update
Append `event: exploit-test-prepared` with the chosen command class to the vuln entry.
## Safety
- Never store credentials or tokens in `.vulnetix/exploit-test/`.
- Treat any provided target as authorized testing only — surface a one-line authorization reminder.
## Edge cases & gotchas
- **Authorisation is the user's responsibility.** The skill surfaces an authorisation reminder; the LLM must NOT proceed if the user has not named an authorised target.
- Nuclei templates are downloaded into `.vulnetix/exploit-test/<VULN_ID>.yaml`. Review the template before running — some include intrusive payloads.
- Metasploit module hints reference module IDs, not module paths. Confirm the module is installed in your local msfconsole before invoking.
- AI-assisted Python demo scripts run with `uv run --with requests` — the script files live in `.vulnetix/exploit-test/` and should never carry secrets.
- For some CVEs no Nuclei template exists; the skill falls back to a curl-based PoC pulled from `vdb exploits` references. Curl PoCs are typically least reliable.
- After running, the skill reads the user-described result and writes the verification outcome to memory — but only if the user explicitly reports back.