Skills recon-nmap
📦
recon-nmap
v0.1.0 Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts
Run Authorized Network Reconnaissance with Nmap
Manual network discovery can miss exposed services and inconsistent configurations. This skill provides structured Nmap workflows for authorized discovery, enumeration, vulnerability checks, and reporting.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "recon-nmap" from https://skillstore.io/skills/agentsecops-recon-nmap.md and its manifest at https://skillstore.io/api/skills/agentsecops-recon-nmap/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "recon-nmap". Plan a low-impact inventory for an approved office subnet during a maintenance window.
Expected outcome:
- Scope: one approved subnet with excluded infrastructure documented before testing.
- Sequence: conservative discovery, targeted service checks, then manual validation.
- Controls: rate caps, timestamps, source logging, and immediate stop conditions.
Using "recon-nmap". Summarize an authorized scan that found web, SSH, and database services.
Expected outcome:
The report groups hosts by service, marks uncertain versions, identifies validation priorities, and separates observations from confirmed vulnerabilities.
Using "recon-nmap". Prepare a segmentation validation workflow for production and management zones.
Expected outcome:
The workflow defines approved source paths, expected blocked ports, conservative timing, evidence capture, exception handling, and stakeholder review.
Security Audit
Criticalv9 • 7/23/2026 Open versioned report
Most static hits in templates and Markdown are false positives caused by code fences, placeholders, defensive examples, and documentation links. Confirmed findings include privileged Nmap execution, active-scanning commands, offensive NSE guidance, scan-evasion techniques, mutable CI dependencies, and a remote installer piped to Bash. The skill requires substantial restriction and remediation before public marketplace distribution.
6
Files scanned
2,165
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (121)
Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a mutable remote installer and pipes it directly to Bash, enabling supply-chain code execution.
High
Network scanning tools
name: recon-nmap
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration,
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
tags: [reconnaissance, nmap, port-scanning, service-enumeration, network-security, osint]
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
packages: [nmap]
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
tools: [python3, masscan]
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
# Nmap Network Reconnaissance
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vu
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
Show all 121 confirmed findings
High
Network scanning tools
nmap -F <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -A <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sn <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sn -PR <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sn -PS22,80,443 <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sn -PU53,161 <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -Pn <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sn <target-network>/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -F -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p- -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 22,80,443,3389,8080 -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 1-1024,3000-9000 -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -sS <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sT <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -sU -p 53,161,500 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -A <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T0 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T1 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T2 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T3 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T4 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T5 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap --max-rate 100 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap --min-rate 10 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap --scan-delay 1s <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV --version-intensity 5 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV --version-intensity 0 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV -p 80,443 --script=http-headers,http-title <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 445 --script=smb-os-discovery,smb-security-mode <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 53 --script=dns-nsid,dns-recursion <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 80,443 --script=http-methods,http-robots.txt,http-title <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 3306 --script=mysql-info <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 1433 --script=ms-sql-info <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -O <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -A <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -O --osscan-limit <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -O --osscan-guess <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
Nmap Scripting Engine for advanced reconnaissance and vulnerability detection:
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
nmap -sC <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap --script=vuln <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --script=exploit <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --script=discovery <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap --script=http-sql-injection <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --script=smb-vuln-ms17-010,smb-vuln-cve-2017-7494 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --script=http-brute --script-args http-brute.path=/admin <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 445 --script=smb-vuln-ms17-010 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 443 --script=ssl-heartbleed <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --script=http-shellshock --script-args uri=/cgi-bin/test.sh <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 443 --script=ssl-enum-ciphers <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 80 --script=http-sql-injection <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 21 --script=ftp-anon <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap <target-ip> -oN scan_results.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap <target-ip> -oX scan_results.xml
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap <target-ip> -oG scan_results.gnmap
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap <target-ip> -oA scan_results
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap <target-ip> -oS scan_results.skid
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -f <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
sudo nmap -D RND:10 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --proxies http://proxy:8080 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
sudo nmap -sI <zombie-host> <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -sn -PE -PS80,443 -PA3389 <external-network>/24 -oG - | awk '/Up$/{print $2}' > external_hosts.
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -Pn -sV -p 21,22,25,53,80,110,143,443,587,993,995,3389,8080,8443 -iL external_hosts.txt -oA ext
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080,8443 -iL external_hosts.txt -oA external_vul
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -Pn -p 443,8443 --script=ssl-enum-ciphers,ssl-cert -iL external_hosts.txt -oA ssl_audit
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sn -PR <internal-network>/24 -oG - | awk '/Up$/{print $2}' > internal_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV -p- -T4 -iL internal_hosts.txt -oA internal_full_scan
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV --script=default,discovery -iL internal_hosts.txt -oA internal_services
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 80,443,8000,8080,8443 --open -oG - <target-network>/24 | grep 'open' | awk '{print $2}' > we
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -sV -p 80,443,8080,8443 --script=http-enum,http-headers,http-methods,http-title,http-server-hea
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 80,443 --script=http-sql-injection,http-csrf,http-vuln-cve2017-5638 -iL web_servers.txt -oA
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 445 --open <target-network>/24 -oG - | grep 'open' | awk '{print $2}' > smb_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 445 --script=smb-protocols,smb-security-mode,smb-os-discovery -iL smb_hosts.txt -oA smb_enum
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 445 --script=smb-vuln* -iL smb_hosts.txt -oA smb_vulns
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 445 --script=smb-enum-shares,smb-enum-users -iL smb_hosts.txt -oA smb_shares
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -sV -p 1433,1521,3306,5432,5984,6379,9200,27017 <target-network>/24 -oA database_scan
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 3306 --script=mysql-info,mysql-databases,mysql-variables <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 27017 --script=mongodb-info,mongodb-databases <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -p 6379 --script=redis-info <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080 \
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -Pn <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -PS80,443 -PA3389 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -PE -PS22,80,443 -PA3389 -PU53,161 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T4 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -F <target-ip> # Top 100 ports
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap --top-ports 1000 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T4 192.168.1.1-50 &
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T4 192.168.1.51-100 &
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
nmap -T4 192.168.1.101-150 &
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
High
Network scanning tools
# Use masscan for very fast port scanning
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
High
Network scanning tools
masscan -p 1-65535 --rate 10000 <target-network>/24
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -T1 --scan-delay 1s <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
sudo nmap -f <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -g 53 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 1-1000 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Network scanning tools
nmap -p 1001-2000 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
High
Mutable CI actions can execute with repository credentials
GitHub Actions use mutable tags, including a secrets scanner that receives GITHUB_TOKEN, allowing upstream tag changes to alter privileged CI code.
The workflow visibly uses version tags and master instead of immutable commit SHAs, while one action receives GITHUB_TOKEN.
High
Operational scan-evasion guidance
The guide provides fragmentation, decoy, source spoofing, proxy, idle-scan, and source-port techniques intended to bypass monitoring controls.
The sections explicitly describe firewall or IDS evasion and provide executable Nmap commands for each technique.
High
Brute-force and exploit NSE execution
The guide provides executable NSE commands for exploit categories, SQL injection checks, SMB vulnerabilities, and HTTP or PostgreSQL brute-force testing.
The cited commands directly invoke exploit, vulnerability, injection, enumeration, and brute-force NSE scripts against supplied targets.
Low
System reconnaissance
# Paranoid (0) - Extremely slow, IDS evasion
The text explicitly recommends timing behavior intended to evade detection during active reconnaissance.
Low
System reconnaissance
# Scan with delays to avoid detection
The text explicitly recommends timing behavior intended to evade detection during active reconnaissance.
Low
System reconnaissance
nmap <target-ip> -oS scan_results.skid
The example runs Nmap against a target and therefore performs active reconnaissance despite only demonstrating an output format.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo nmap -sS <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -sU -p 53,161,500 <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -A <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -A <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O --osscan-limit <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O --osscan-guess <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -f <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -D RND:10 <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -sI <zombie-host> <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -f <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
Low
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
This URL supplies executable installer content directly to a shell, so remote changes would execute inside CI.
Risk Factors
⚙️ External commands (50)
assets/ci-config-template.yml:298 assets/ci-config-template.yml:301 assets/ci-config-template.yml:304 assets/ci-config-template.yml:307 assets/ci-config-template.yml:310 assets/ci-config-template.yml:134 assets/ci-config-template.yml:250 assets/ci-config-template.yml:291 SKILL.md:36-45 SKILL.md:45-76 SKILL.md:76-91 SKILL.md:91-102 SKILL.md:102-104 SKILL.md:104-110 SKILL.md:110-125 SKILL.md:125-130 SKILL.md:130-132 SKILL.md:132-135 SKILL.md:135-137 SKILL.md:137-140 SKILL.md:140-142 SKILL.md:142-145 SKILL.md:145-147 SKILL.md:147-150 SKILL.md:150-152 SKILL.md:152-156 SKILL.md:156-174 SKILL.md:174-178 SKILL.md:178-187 SKILL.md:187-193 SKILL.md:193-205 SKILL.md:205-209 SKILL.md:209-226 SKILL.md:226-232 SKILL.md:232-244 SKILL.md:244-256 SKILL.md:256-273 SKILL.md:273-293 SKILL.md:293-311 SKILL.md:311-317 SKILL.md:317-332 SKILL.md:332-336 SKILL.md:336-345 SKILL.md:345-351 SKILL.md:351-370 SKILL.md:370-384 SKILL.md:384-413 SKILL.md:413-425 SKILL.md:425-429 SKILL.md:429-441
🌐 Network access (27)
assets/ci-config-template.yml:240 assets/rule-template.yaml:43 assets/rule-template.yaml:44 assets/rule-template.yaml:45 assets/rule-template.yaml:73 assets/rule-template.yaml:118 assets/rule-template.yaml:119 assets/rule-template.yaml:151 assets/rule-template.yaml:191 assets/rule-template.yaml:192 assets/rule-template.yaml:193 assets/rule-template.yaml:217 assets/rule-template.yaml:260 assets/rule-template.yaml:261 assets/rule-template.yaml:288 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:366 SKILL.md:631 SKILL.md:632 SKILL.md:633 SKILL.md:634 SKILL.md:635 SKILL.md:572 SKILL.md:573 SKILL.md:574
📁 Filesystem access (3)
🔑 Env variables (23)
assets/ci-config-template.yml:164 assets/rule-template.yaml:148 assets/rule-template.yaml:148 assets/rule-template.yaml:147 assets/rule-template.yaml:162 assets/rule-template.yaml:132 assets/rule-template.yaml:147 assets/rule-template.yaml:148 assets/rule-template.yaml:156 assets/rule-template.yaml:157 assets/rule-template.yaml:162 assets/rule-template.yaml:163 assets/rule-template.yaml:164 assets/rule-template.yaml:165 references/EXAMPLE.md:423 references/EXAMPLE.md:423 references/EXAMPLE.md:424 references/EXAMPLE.md:425 references/EXAMPLE.md:427 references/EXAMPLE.md:430 references/EXAMPLE.md:432 references/EXAMPLE.md:437 references/EXAMPLE.md:444
⚡ Contains scripts (2)
Detected Patterns
Pipe to shell patternSystem reconnaissance×3Network scanning tools×114
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/agentsecops-recon-nmap/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/agentsecops-recon-nmap?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/agentsecops-recon-nmap?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-recon-nmap/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/agentsecops-recon-nmap.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
AgentSecOps. (2026). recon-nmap security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-recon-nmap/audits/9BibTeX citation
@techreport{agentsecops-agentsecops-recon-nmap-2026,
author = {AgentSecOps},
title = {recon-nmap security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/agentsecops-recon-nmap/audits/9},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "recon-nmap security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-recon-nmap/audits/9"
identifiers:
- type: other
value: "skillstore:agentsecops-recon-nmap:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
73
Community
87
Spec Compliance
What You Can Build
Inventory an approved network
Create a conservative discovery and service inventory plan for an explicitly authorized address range.
Triage exposed services
Prioritize approved hosts and services for deeper validation during a documented security assessment.
Validate network controls
Design repeatable checks for segmentation, firewall exposure, and approved CI security gates.
Try These Prompts
Plan a basic discovery scan
I have written authorization for [scope] during [window]. Create a low-impact host discovery plan with rate limits, outputs, and stop conditions.
Review existing scan results
Review these authorized Nmap results: [results]. Summarize live hosts, open services, uncertain detections, and the safest validation steps.
Design service enumeration
Build an authorized enumeration plan for [host list]. Cover [services], safe NSE checks, timing controls, evidence collection, and false-positive validation.
Validate network segmentation
Create a phased segmentation test for [zones]. Include approved paths, rate caps, output formats, stop conditions, evidence requirements, and manual review gates.
Best Practices
- Obtain written authorization and confirm scope, timing, exclusions, and emergency contacts before scanning.
- Start with conservative discovery and rate limits, then increase depth only after reviewing impact.
- Validate service and vulnerability findings manually before assigning severity or recommending remediation.
Avoid
- Do not scan public, third-party, or production systems without explicit written permission.
- Do not run exploit, brute-force, denial-of-service, or evasion scripts as default checks.
- Do not treat version matches or NSE alerts as confirmed vulnerabilities without verification.
Frequently Asked Questions
Does this skill install Nmap?
No. Nmap and optional tools must be installed separately using approved package sources.
Can it scan any Internet host?
No. Only scan systems covered by explicit written authorization and a documented scope.
Does an NSE alert confirm a vulnerability?
No. NSE findings and version matches require manual validation and supporting evidence.
Which output formats are covered?
The guidance covers normal, XML, grepable, and combined Nmap output formats.
Can scans disrupt services?
Yes. Aggressive timing, UDP probes, privileged scans, and intrusive NSE scripts can affect availability.
How should scan scope be controlled?
Use approved target lists, exclusions, rate caps, maintenance windows, logging, and clear stop conditions.
Developer Details
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Ref
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Maintenance freshness
7/24/2026
Usage
8 downloads · 411 views
File structure