Versioned security assessment
Report ID: SA-D46E6208
7/7/2026, 9:28:22 PM
recon-nmap security assessment v8
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- recon-nmap
- Version
- v8
- Maintainer
- AgentSecOps
- Coverage
- 6 Files scanned · 2,165 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Critical
134 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Confirmed risks center on intentional Nmap reconnaissance, privileged scan examples, Metasploit handoff, intrusive NSE scripts, high-speed scanning, and firewall or IDS evasion guidance in SKILL.md. Most findings in templates and examples are false positives because they are documentation, public references, or educational snippets. No evidence found of prompt injection in the reviewed files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 2,165 Lines analyzed
150 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 27 evidence locations
Filesystem access
May read or write local files.
Observed in 2 evidence locations
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 82 evidence locations
Capability review items (16)
High
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The URL is used as the source for a remote installer that is executed by the shell. The fixed remote dependency contributes to supply-chain risk.
High
Git platform tokens
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow exposes GITHUB_TOKEN to a third-party security action. This may be necessary, but it is still a sensitive repository token handling risk.
High
sudo privilege escalation
sudo nmap -sS <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -sU -p 53,161,500 <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -A <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -O <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -A <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -O --osscan-limit <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -O --osscan-guess <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -f <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -D RND:10 <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -sI <zombie-host> <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
High
sudo privilege escalation
sudo nmap -f <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (134)
RISK-001 Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote install script and pipes it directly to bash. This is a real supply-chain execution risk if the source or network path is compromised.
RISK-002 Critical
Metasploit framework
- **Metasploit Integration**: Import Nmap XML with `db_import`
The line recommends importing Nmap output into Metasploit. This links reconnaissance results to offensive exploitation tooling.
RISK-003 Critical
Stealth and Firewall Evasion Guidance
The skill provides techniques to evade IDS and firewall controls, including packet fragmentation, decoys, source spoofing, idle scans, source-port selection, and splitting scans over time.
The referenced sections are explicitly titled around evasion and blocked scans, and the commands describe stealth and bypass methods. This is clear offensive tradecraft despite authorization disclaimers.
RISK-004 High
System reconnaissance
# Paranoid (0) - Extremely slow, IDS evasion
The line describes IDS evasion or delayed scanning. Evasion guidance is a real offensive risk even when framed as authorized testing.
RISK-005 High
System reconnaissance
# Scan with delays to avoid detection
The line describes IDS evasion or delayed scanning. Evasion guidance is a real offensive risk even when framed as authorized testing.
RISK-006 High
Network scanning tools
name: recon-nmap
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-007 High
Network scanning tools
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration,
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-008 High
Network scanning tools
tags: [reconnaissance, nmap, port-scanning, service-enumeration, network-security, osint]
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-009 High
Network scanning tools
packages: [nmap]
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-010 High
Network scanning tools
tools: [python3, masscan]
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-011 High
Network scanning tools
- https://nmap.org/book/
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-012 High
Network scanning tools
- https://nmap.org/nsedoc/
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-013 High
Network scanning tools
# Nmap Network Reconnaissance
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-014 High
Network scanning tools
Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vu
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-015 High
Network scanning tools
nmap -F <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-016 High
Network scanning tools
nmap -sV <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-017 High
Network scanning tools
nmap -A <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-018 High
Network scanning tools
nmap -sn <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-019 High
Network scanning tools
nmap -sn -PR <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-020 High
Network scanning tools
nmap -sn -PS22,80,443 <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-021 High
Network scanning tools
nmap -sn -PU53,161 <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-022 High
Network scanning tools
nmap -Pn <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-023 High
Network scanning tools
nmap -sn <target-network>/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-024 High
Network scanning tools
nmap -F -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-025 High
Network scanning tools
nmap -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-026 High
Network scanning tools
nmap -p- -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-027 High
Network scanning tools
nmap -p 22,80,443,3389,8080 -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-028 High
Network scanning tools
nmap -p 1-1024,3000-9000 -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-029 High
Network scanning tools
sudo nmap -sS <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-030 High
Network scanning tools
nmap -sT <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-031 High
Network scanning tools
sudo nmap -sU -p 53,161,500 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-032 High
Network scanning tools
nmap -sV <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-033 High
Network scanning tools
sudo nmap -A <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-034 High
Network scanning tools
nmap -T0 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-035 High
Network scanning tools
nmap -T1 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-036 High
Network scanning tools
nmap -T2 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-037 High
Network scanning tools
nmap -T3 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-038 High
Network scanning tools
nmap -T4 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-039 High
Network scanning tools
nmap -T5 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-040 High
Network scanning tools
nmap --max-rate 100 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-041 High
Network scanning tools
nmap --min-rate 10 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-042 High
Network scanning tools
nmap --scan-delay 1s <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-043 High
Network scanning tools
nmap -sV <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-044 High
Network scanning tools
nmap -sV --version-intensity 5 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-045 High
Network scanning tools
nmap -sV --version-intensity 0 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-046 High
Network scanning tools
nmap -sV -p 80,443 --script=http-headers,http-title <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-047 High
Network scanning tools
nmap -p 445 --script=smb-os-discovery,smb-security-mode <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-048 High
Network scanning tools
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-049 High
Network scanning tools
nmap -p 53 --script=dns-nsid,dns-recursion <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-050 High
Network scanning tools
nmap -p 80,443 --script=http-methods,http-robots.txt,http-title <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-051 High
Network scanning tools
nmap -p 3306 --script=mysql-info <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-052 High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-053 High
Network scanning tools
nmap -p 1433 --script=ms-sql-info <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-054 High
Network scanning tools
sudo nmap -O <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-055 High
Network scanning tools
sudo nmap -A <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-056 High
Network scanning tools
sudo nmap -O --osscan-limit <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-057 High
Network scanning tools
sudo nmap -O --osscan-guess <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-058 High
Network scanning tools
Nmap Scripting Engine for advanced reconnaissance and vulnerability detection:
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-059 High
Network scanning tools
nmap -sC <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-060 High
Network scanning tools
nmap --script=vuln <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-061 High
Network scanning tools
nmap --script=exploit <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-062 High
Network scanning tools
nmap --script=discovery <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-063 High
Network scanning tools
nmap --script=http-sql-injection <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-064 High
Network scanning tools
nmap --script=smb-vuln-ms17-010,smb-vuln-cve-2017-7494 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-065 High
Network scanning tools
nmap --script=http-brute --script-args http-brute.path=/admin <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-066 High
Network scanning tools
nmap -p 445 --script=smb-vuln-ms17-010 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-067 High
Network scanning tools
nmap -p 443 --script=ssl-heartbleed <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-068 High
Network scanning tools
nmap --script=http-shellshock --script-args uri=/cgi-bin/test.sh <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-069 High
Network scanning tools
nmap -p 443 --script=ssl-enum-ciphers <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-070 High
Network scanning tools
nmap -p 80 --script=http-sql-injection <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-071 High
Network scanning tools
nmap -p 21 --script=ftp-anon <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-072 High
Network scanning tools
nmap <target-ip> -oN scan_results.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-073 High
Network scanning tools
nmap <target-ip> -oX scan_results.xml
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-074 High
Network scanning tools
nmap <target-ip> -oG scan_results.gnmap
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-075 High
Network scanning tools
nmap <target-ip> -oA scan_results
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-076 High
Network scanning tools
nmap <target-ip> -oS scan_results.skid
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-077 High
Network scanning tools
xsltproc /usr/share/nmap/nmap.xsl scan_results.xml -o report.html
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-078 High
Network scanning tools
sudo nmap -f <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-079 High
Network scanning tools
sudo nmap -D RND:10 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-080 High
Network scanning tools
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-081 High
Network scanning tools
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-082 High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-083 High
Network scanning tools
nmap --proxies http://proxy:8080 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-084 High
Network scanning tools
sudo nmap -sI <zombie-host> <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-085 High
Network scanning tools
- Nmap command-line arguments used
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-086 High
Network scanning tools
nmap -sn -PE -PS80,443 -PA3389 <external-network>/24 -oG - | awk '/Up$/{print $2}' > external_hosts.
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-087 High
Network scanning tools
nmap -Pn -sV -p 21,22,25,53,80,110,143,443,587,993,995,3389,8080,8443 -iL external_hosts.txt -oA ext
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-088 High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080,8443 -iL external_hosts.txt -oA external_vul
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-089 High
Network scanning tools
nmap -Pn -p 443,8443 --script=ssl-enum-ciphers,ssl-cert -iL external_hosts.txt -oA ssl_audit
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-090 High
Network scanning tools
nmap -sn -PR <internal-network>/24 -oG - | awk '/Up$/{print $2}' > internal_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-091 High
Network scanning tools
nmap -sV -p- -T4 -iL internal_hosts.txt -oA internal_full_scan
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-092 High
Network scanning tools
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-093 High
Network scanning tools
nmap -sV --script=default,discovery -iL internal_hosts.txt -oA internal_services
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-094 High
Network scanning tools
nmap -p 80,443,8000,8080,8443 --open -oG - <target-network>/24 | grep 'open' | awk '{print $2}' > we
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-095 High
Network scanning tools
nmap -sV -p 80,443,8080,8443 --script=http-enum,http-headers,http-methods,http-title,http-server-hea
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-096 High
Network scanning tools
nmap -p 80,443 --script=http-sql-injection,http-csrf,http-vuln-cve2017-5638 -iL web_servers.txt -oA
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-097 High
Network scanning tools
nmap -p 445 --open <target-network>/24 -oG - | grep 'open' | awk '{print $2}' > smb_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-098 High
Network scanning tools
nmap -p 445 --script=smb-protocols,smb-security-mode,smb-os-discovery -iL smb_hosts.txt -oA smb_enum
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-099 High
Network scanning tools
nmap -p 445 --script=smb-vuln* -iL smb_hosts.txt -oA smb_vulns
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-100 High
Network scanning tools
nmap -p 445 --script=smb-enum-shares,smb-enum-users -iL smb_hosts.txt -oA smb_shares
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-101 High
Network scanning tools
nmap -sV -p 1433,1521,3306,5432,5984,6379,9200,27017 <target-network>/24 -oA database_scan
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-102 High
Network scanning tools
nmap -p 3306 --script=mysql-info,mysql-databases,mysql-variables <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-103 High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-104 High
Network scanning tools
nmap -p 27017 --script=mongodb-info,mongodb-databases <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-105 High
Network scanning tools
nmap -p 6379 --script=redis-info <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-106 High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080 \
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-107 High
Network scanning tools
if grep -i "VULNERABLE" "$OUTPUT_DIR/security_scan.nmap"; then
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-108 High
Network scanning tools
- **Metasploit Integration**: Import Nmap XML with `db_import`
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-109 High
Network scanning tools
- **Vulnerability Scanners**: Feed Nmap results to Nessus, OpenVAS, Qualys
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-110 High
Network scanning tools
- **SIEM Integration**: Parse Nmap output for security monitoring
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-111 High
Network scanning tools
Map Nmap reconnaissance to ATT&CK framework:
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-112 High
Network scanning tools
nmap -Pn <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-113 High
Network scanning tools
nmap -PS80,443 -PA3389 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-114 High
Network scanning tools
nmap -PE -PS22,80,443 -PA3389 -PU53,161 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-115 High
Network scanning tools
nmap -T4 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-116 High
Network scanning tools
nmap -F <target-ip> # Top 100 ports
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-117 High
Network scanning tools
nmap --top-ports 1000 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-118 High
Network scanning tools
nmap -T4 192.168.1.1-50 &
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-119 High
Network scanning tools
nmap -T4 192.168.1.51-100 &
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-120 High
Network scanning tools
nmap -T4 192.168.1.101-150 &
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-121 High
Network scanning tools
# Use masscan for very fast port scanning
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-122 High
Network scanning tools
masscan -p 1-65535 --rate 10000 <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-123 High
Network scanning tools
nmap -T1 --scan-delay 1s <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-124 High
Network scanning tools
sudo nmap -f <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-125 High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-126 High
Network scanning tools
nmap -g 53 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-127 High
Network scanning tools
nmap -p 1-1000 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-128 High
Network scanning tools
nmap -p 1001-2000 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-129 High
Network scanning tools
Organizations can detect Nmap scanning by:
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-130 High
Network scanning tools
- [Nmap Network Scanning Official Guide](https://nmap.org/book/)
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-131 High
Network scanning tools
- [NSE Script Documentation](https://nmap.org/nsedoc/)
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-132 High
Intrusive NSE Exploit and Brute-Force Guidance
The skill recommends Nmap NSE categories and scripts for exploit attempts, brute-force checks, SQL injection testing, SMB vulnerability checks, and other intrusive activity.
The guidance names exploit, brute, dos, fuzzer, intrusive, and vulnerability script categories and gives concrete examples. Legitimate assessment use is possible, but misuse risk is direct.
RISK-133 High
High-Speed Broad Network Scanning Guidance
The skill advises parallel subnet scanning and Masscan usage at a high packet rate, which can enable large-scale unauthorized discovery or service disruption.
The section gives concrete performance tuning and Masscan guidance for broad scans. It is dual-use, but the scale and speed create a clear marketplace risk.
RISK-134 Low
System reconnaissance
nmap <target-ip> -oS scan_results.skid
The line is part of an active Nmap output workflow. The specific pattern is weak, but the context still supports network reconnaissance use.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalFirewall and IDS evasion guidanceRemove decoy, source spoofing, idle scan, source-port bypass, packet fragmentation, and delayed split-scan instructions from marketplace-facing content.
- FIX-002CriticalMetasploit integration referenceRemove Metasploit handoff guidance from the published skill unless the marketplace explicitly accepts offensive exploitation workflows.
- FIX-003CriticalRemote installer executed with curl pipe to shellReplace the pipe-to-shell installer with a pinned release, checksum verification, or a maintained GitHub Action.
- FIX-004HighIntrusive NSE and brute-force examplesRemove exploit, brute-force, denial-of-service, fuzzer, and intrusive script examples, or restrict them to a clearly separated controlled-lab reference.
- FIX-005HighPrivileged scan commandsMinimize sudo examples and explain safer alternatives, least-privilege requirements, and approved environments for raw-packet scans.
- FIX-006MediumAuthorization controls rely on proseAdd explicit refusal and scope-confirmation prompts before producing target-specific scan plans or commands.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable