Analyse a specific exploit (safety-first)

Use this skill when the user references a numeric exploit ID — typically the [id=12345] token shown in the output of search_exploits or get_vulnerability — and wants to know whether it is safe to run, what it does, and how it is classified.

Inputs

• exploit_id (required) — the integer platform exploit

ID (e.g. 12345). Range is 1 .. 2³¹ (the validator rejects zero, negatives, and anything above this cap).

Workflow

1. Check the AI classification first — always. Call

get_exploit_analysis for the exploit_id. The response contains:

• classification — one of working_poc, scanner,

tool, writeup, stub, no_code, suspicious, trojan.

• attack_type, complexity, reliability.
• MITRE ATT&CK techniques.
• Deception indicators if the LLM detected any.

1. Branch on the classification.

• If `trojan` or `suspicious`: STOP. Do not call

get_exploit_code. Tell the user the exploit is flagged as deceptive, list every deception indicator, and recommend they avoid it.

• If `stub` or `no_code`: tell the user the

entry has no usable code; suggest they look for a different exploit on the same CVE.

• If `working_poc`, `scanner`, `tool`, or

`writeup`: continue to step 3.

1. Review the code. Call get_exploit_code for the

exploit_id. Identify and summarise:

• The entry point and overall structure.
• The payload — what command(s) does it run, what

bytes does it send, what file does it drop.

• Prerequisites: authentication, network position,

specific affected version.

• Reliability assessment — is this one-shot, or

repeatable? Are there race conditions?

• The MITRE ATT&CK techniques actually used by the

code (compare against step 1 — they should agree).

Output

Return a structured Markdown analysis with these sections:

• Safety verdict — safe / suspicious / trojan,

one-line justification, and the LLM confidence score.

• Technical summary — what the exploit does in plain

English.

• Prerequisites & complexity — auth required? local

vs remote? specific version range?

• MITRE ATT&CK mapping — bullet list of techniques.
• Code review highlights — the 3–5 most important

fragments of the source, each with a one-paragraph explanation. Quote the code; do not paraphrase the payload.

Safety notes

• **Never present trojan or suspicious code without an

unmissable warning above the snippet.** The classifier exists precisely because public PoC repos are full of malware that targets the operator.

• The retrieved code is capped at 50 KB by the server.

If get_exploit_code reports truncation, mention this in the output.