Versioned security assessment
Report ID: SA-22DFC558
7/6/2026, 1:03:20 AM
recon-nmap security assessment v7
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- recon-nmap
- Version
- v7
- Maintainer
- AgentSecOps
- Coverage
- 5 Files scanned · 2,155 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
136 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill is a genuine authorized-security Nmap guide, but it contains substantial dual-use reconnaissance content, elevated scan modes, evasion guidance, exploit/brute-force script workflows, and Metasploit integration. Many static findings in templates and references are false positives, but the main SKILL.md content and the CI curl-to-bash installer present real publication risks.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 2,155 Lines analyzed
152 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 27 evidence locations
Filesystem access
May read or write local files.
Observed in 2 evidence locations
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 82 evidence locations
Capability review items (16)
High
sudo privilege escalation
sudo nmap -sS <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -sU -p 53,161,500 <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -A <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -O <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -A <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -O --osscan-limit <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -O --osscan-guess <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -f <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -D RND:10 <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -sI <zombie-host> <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
High
sudo privilege escalation
sudo nmap -f <target-ip>
The referenced line uses sudo with Nmap to enable raw-packet scan modes, OS detection, or evasion techniques. Elevated packet-crafting capability increases operational and abuse risk.
Medium
Unix shell invocation
#!/bin/bash
The line begins an executable bash-style CI scanning example that runs Nmap against a supplied target network. The shell wrapper is part of a real scanning workflow, not only prose.
Low
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The hardcoded URL is part of the remote installer command that is piped into bash. The URL itself is not secret, but it anchors a CI supply-chain execution risk.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (136)
RISK-001 Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote tfsec installer with curl and pipes it directly into bash. This executes unauthenticated remote code in CI and creates a supply-chain compromise path.
RISK-002 Critical
Metasploit framework
- **Metasploit Integration**: Import Nmap XML with `db_import`
The skill explicitly references Metasploit integration through Nmap XML import. That links reconnaissance output to an exploitation framework and is a high-risk offensive workflow.
RISK-003 Critical
Evasion and Source-Spoofing Scan Guidance
The skill teaches packet fragmentation, decoy scans, source IP spoofing, proxy use, and idle scanning as firewall and IDS evasion techniques. This can help authorized testers, but it also directly supports stealthy reconnaissance against monitored networks.
The section title and commands explicitly describe evading firewall and IDS detection through fragmentation, decoys, spoofing, proxies, and idle scans.
RISK-004 High
Network scanning tools
name: recon-nmap
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-005 High
Network scanning tools
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration,
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-006 High
Network scanning tools
tags: [reconnaissance, nmap, port-scanning, service-enumeration, network-security, osint]
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-007 High
Network scanning tools
packages: [nmap]
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-008 High
Network scanning tools
tools: [python3, masscan]
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-009 High
Network scanning tools
- https://nmap.org/book/
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-010 High
Network scanning tools
- https://nmap.org/nsedoc/
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-011 High
Network scanning tools
# Nmap Network Reconnaissance
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-012 High
Network scanning tools
Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vu
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-013 High
Network scanning tools
nmap -F <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-014 High
Network scanning tools
nmap -sV <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-015 High
Network scanning tools
nmap -A <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-016 High
Network scanning tools
nmap -sn <target-network>/24
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-017 High
Network scanning tools
nmap -sn -PR <target-network>/24
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-018 High
Network scanning tools
nmap -sn -PS22,80,443 <target-network>/24
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-019 High
Network scanning tools
nmap -sn -PU53,161 <target-network>/24
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-020 High
Network scanning tools
nmap -Pn <target-network>/24
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-021 High
Network scanning tools
nmap -sn <target-network>/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-022 High
Network scanning tools
nmap -F -iL live_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-023 High
Network scanning tools
nmap -iL live_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-024 High
Network scanning tools
nmap -p- -iL live_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-025 High
Network scanning tools
nmap -p 22,80,443,3389,8080 -iL live_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-026 High
Network scanning tools
nmap -p 1-1024,3000-9000 -iL live_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-027 High
Network scanning tools
sudo nmap -sS <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-028 High
Network scanning tools
nmap -sT <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-029 High
Network scanning tools
sudo nmap -sU -p 53,161,500 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-030 High
Network scanning tools
nmap -sV <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-031 High
Network scanning tools
sudo nmap -A <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-032 High
Network scanning tools
nmap -T0 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-033 High
Network scanning tools
nmap -T1 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-034 High
Network scanning tools
nmap -T2 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-035 High
Network scanning tools
nmap -T3 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-036 High
Network scanning tools
nmap -T4 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-037 High
Network scanning tools
nmap -T5 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-038 High
Network scanning tools
nmap --max-rate 100 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-039 High
Network scanning tools
nmap --min-rate 10 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-040 High
Network scanning tools
nmap --scan-delay 1s <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-041 High
Network scanning tools
nmap -sV <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-042 High
Network scanning tools
nmap -sV --version-intensity 5 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-043 High
Network scanning tools
nmap -sV --version-intensity 0 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-044 High
Network scanning tools
nmap -sV -p 80,443 --script=http-headers,http-title <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-045 High
Network scanning tools
nmap -p 445 --script=smb-os-discovery,smb-security-mode <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-046 High
Network scanning tools
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-047 High
Network scanning tools
nmap -p 53 --script=dns-nsid,dns-recursion <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-048 High
Network scanning tools
nmap -p 80,443 --script=http-methods,http-robots.txt,http-title <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-049 High
Network scanning tools
nmap -p 3306 --script=mysql-info <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-050 High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-051 High
Network scanning tools
nmap -p 1433 --script=ms-sql-info <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-052 High
Network scanning tools
sudo nmap -O <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-053 High
Network scanning tools
sudo nmap -A <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-054 High
Network scanning tools
sudo nmap -O --osscan-limit <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-055 High
Network scanning tools
sudo nmap -O --osscan-guess <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-056 High
Network scanning tools
Nmap Scripting Engine for advanced reconnaissance and vulnerability detection:
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-057 High
Network scanning tools
nmap -sC <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-058 High
Network scanning tools
nmap --script=vuln <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-059 High
Network scanning tools
nmap --script=exploit <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-060 High
Network scanning tools
nmap --script=discovery <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-061 High
Network scanning tools
nmap --script=http-sql-injection <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-062 High
Network scanning tools
nmap --script=smb-vuln-ms17-010,smb-vuln-cve-2017-7494 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-063 High
Network scanning tools
nmap --script=http-brute --script-args http-brute.path=/admin <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-064 High
Network scanning tools
nmap -p 445 --script=smb-vuln-ms17-010 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-065 High
Network scanning tools
nmap -p 443 --script=ssl-heartbleed <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-066 High
Network scanning tools
nmap --script=http-shellshock --script-args uri=/cgi-bin/test.sh <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-067 High
Network scanning tools
nmap -p 443 --script=ssl-enum-ciphers <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-068 High
Network scanning tools
nmap -p 80 --script=http-sql-injection <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-069 High
Network scanning tools
nmap -p 21 --script=ftp-anon <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-070 High
Network scanning tools
nmap <target-ip> -oN scan_results.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-071 High
Network scanning tools
nmap <target-ip> -oX scan_results.xml
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-072 High
Network scanning tools
nmap <target-ip> -oG scan_results.gnmap
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-073 High
Network scanning tools
nmap <target-ip> -oA scan_results
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-074 High
Network scanning tools
nmap <target-ip> -oS scan_results.skid
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-075 High
Network scanning tools
xsltproc /usr/share/nmap/nmap.xsl scan_results.xml -o report.html
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-076 High
Network scanning tools
sudo nmap -f <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-077 High
Network scanning tools
sudo nmap -D RND:10 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-078 High
Network scanning tools
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-079 High
Network scanning tools
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-080 High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-081 High
Network scanning tools
nmap --proxies http://proxy:8080 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-082 High
Network scanning tools
sudo nmap -sI <zombie-host> <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-083 High
Network scanning tools
- Nmap command-line arguments used
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-084 High
Network scanning tools
nmap -sn -PE -PS80,443 -PA3389 <external-network>/24 -oG - | awk '/Up$/{print $2}' > external_hosts.
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-085 High
Network scanning tools
nmap -Pn -sV -p 21,22,25,53,80,110,143,443,587,993,995,3389,8080,8443 -iL external_hosts.txt -oA ext
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-086 High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080,8443 -iL external_hosts.txt -oA external_vul
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-087 High
Network scanning tools
nmap -Pn -p 443,8443 --script=ssl-enum-ciphers,ssl-cert -iL external_hosts.txt -oA ssl_audit
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-088 High
Network scanning tools
nmap -sn -PR <internal-network>/24 -oG - | awk '/Up$/{print $2}' > internal_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-089 High
Network scanning tools
nmap -sV -p- -T4 -iL internal_hosts.txt -oA internal_full_scan
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-090 High
Network scanning tools
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-091 High
Network scanning tools
nmap -sV --script=default,discovery -iL internal_hosts.txt -oA internal_services
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-092 High
Network scanning tools
nmap -p 80,443,8000,8080,8443 --open -oG - <target-network>/24 | grep 'open' | awk '{print $2}' > we
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-093 High
Network scanning tools
nmap -sV -p 80,443,8080,8443 --script=http-enum,http-headers,http-methods,http-title,http-server-hea
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-094 High
Network scanning tools
nmap -p 80,443 --script=http-sql-injection,http-csrf,http-vuln-cve2017-5638 -iL web_servers.txt -oA
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-095 High
Network scanning tools
nmap -p 445 --open <target-network>/24 -oG - | grep 'open' | awk '{print $2}' > smb_hosts.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-096 High
Network scanning tools
nmap -p 445 --script=smb-protocols,smb-security-mode,smb-os-discovery -iL smb_hosts.txt -oA smb_enum
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-097 High
Network scanning tools
nmap -p 445 --script=smb-vuln* -iL smb_hosts.txt -oA smb_vulns
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-098 High
Network scanning tools
nmap -p 445 --script=smb-enum-shares,smb-enum-users -iL smb_hosts.txt -oA smb_shares
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-099 High
Network scanning tools
nmap -sV -p 1433,1521,3306,5432,5984,6379,9200,27017 <target-network>/24 -oA database_scan
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-100 High
Network scanning tools
nmap -p 3306 --script=mysql-info,mysql-databases,mysql-variables <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-101 High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-102 High
Network scanning tools
nmap -p 27017 --script=mongodb-info,mongodb-databases <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-103 High
Network scanning tools
nmap -p 6379 --script=redis-info <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-104 High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080 \
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-105 High
Network scanning tools
if grep -i "VULNERABLE" "$OUTPUT_DIR/security_scan.nmap"; then
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-106 High
Network scanning tools
- **Metasploit Integration**: Import Nmap XML with `db_import`
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-107 High
Network scanning tools
- **Vulnerability Scanners**: Feed Nmap results to Nessus, OpenVAS, Qualys
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-108 High
Network scanning tools
- **SIEM Integration**: Parse Nmap output for security monitoring
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-109 High
Network scanning tools
Map Nmap reconnaissance to ATT&CK framework:
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-110 High
Network scanning tools
nmap -Pn <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-111 High
Network scanning tools
nmap -PS80,443 -PA3389 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-112 High
Network scanning tools
nmap -PE -PS22,80,443 -PA3389 -PU53,161 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-113 High
Network scanning tools
nmap -T4 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-114 High
Network scanning tools
nmap -F <target-ip> # Top 100 ports
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-115 High
Network scanning tools
nmap --top-ports 1000 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-116 High
Network scanning tools
nmap -T4 192.168.1.1-50 &
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-117 High
Network scanning tools
nmap -T4 192.168.1.51-100 &
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-118 High
Network scanning tools
nmap -T4 192.168.1.101-150 &
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-119 High
Network scanning tools
# Use masscan for very fast port scanning
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-120 High
Network scanning tools
masscan -p 1-65535 --rate 10000 <target-network>/24
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-121 High
Network scanning tools
nmap -T1 --scan-delay 1s <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-122 High
Network scanning tools
sudo nmap -f <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-123 High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-124 High
Network scanning tools
nmap -g 53 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-125 High
Network scanning tools
nmap -p 1-1000 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-126 High
Network scanning tools
nmap -p 1001-2000 <target-ip>
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-127 High
Network scanning tools
Organizations can detect Nmap scanning by:
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-128 High
Network scanning tools
- [Nmap Network Scanning Official Guide](https://nmap.org/book/)
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-129 High
Network scanning tools
- [NSE Script Documentation](https://nmap.org/nsedoc/)
SKILL.md is an operational Nmap reconnaissance guide with commands for host discovery, port scanning, service enumeration, NSE scripts, and broad target ranges. This is legitimate when authorized but dangerous if misused against third-party networks.
RISK-130 High
Exploit and Brute-Force NSE Workflow Guidance
The skill instructs users to run exploit, brute-force, intrusive, and vulnerability NSE scripts, including named examples for HTTP brute forcing and SQL injection testing. This goes beyond passive inventory and can cause unauthorized access attempts or service disruption.
The cited lines name exploit and brute-force script categories and provide concrete Nmap commands for vulnerable service testing.
RISK-131 High
High-Rate Broad Network Scanning Guidance
The troubleshooting section recommends parallel target splitting and Masscan with a high packet rate for full-port scanning. This supports rapid large-scale reconnaissance and can overload networks if used outside strict authorization.
The cited lines show multiple parallel Nmap ranges and a Masscan full-port command with a rate of 10000 packets per second.
RISK-132 Low
System reconnaissance
# Paranoid (0) - Extremely slow, IDS evasion
The line appears in the primary reconnaissance guide and supports host, OS, service, or scan-result discovery. This is expected for the skill but still represents real reconnaissance capability.
RISK-133 Low
System reconnaissance
# Scan with delays to avoid detection
The line appears in the primary reconnaissance guide and supports host, OS, service, or scan-result discovery. This is expected for the skill but still represents real reconnaissance capability.
RISK-134 Low
System reconnaissance
nmap <target-ip> -oS scan_results.skid
The line appears in the primary reconnaissance guide and supports host, OS, service, or scan-result discovery. This is expected for the skill but still represents real reconnaissance capability.
RISK-135 Low
System reconnaissance
- **Rate Limiting**: Use `--max-rate` to avoid overwhelming targets
The line appears in the primary reconnaissance guide and supports host, OS, service, or scan-result discovery. This is expected for the skill but still represents real reconnaissance capability.
RISK-136 Low
System reconnaissance
- Source IP address and scanner hostname
The line appears in the primary reconnaissance guide and supports host, OS, service, or scan-result discovery. This is expected for the skill but still represents real reconnaissance capability.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalEvasion and source-spoofing instructions in the main workflow.Remove or heavily gate fragmentation, decoy, spoofing, proxy, and idle-scan examples; keep only defensive detection guidance unless explicit marketplace policy allows them.
- FIX-002CriticalThe CI template installs tfsec by piping a remote script directly to bash.Replace curl-to-bash installation with a pinned release checksum, a trusted package manager, or a maintained GitHub Action with version pinning.
- FIX-003CriticalMetasploit integration links reconnaissance output to exploitation tooling.Remove Metasploit workflow references or restrict them to clearly separated, authorized lab documentation with strong legal and safety boundaries.
- FIX-004HighExploit, brute-force, intrusive, and DoS-related NSE categories are presented as usable scanning options.Limit default guidance to safe and default NSE scripts, and move intrusive checks behind explicit authorization, lab-only warnings, and safer validation alternatives.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static false positives ignored (2)
High
C2 keywords
- **T1041**: Exfiltration Over C2 Channel
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Malware type keywords
[ ] 10. Remove malicious artifacts (malware, backdoors, webshells)
Force-confirmed blocker/high static finding; AI dismissal overridden.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable