Versioned security assessment
Report ID: SA-9E952417
7/23/2026, 6:15:29 AM
recon-nmap security assessment v9
Skill Security Certification Report
Scanner version 3.0.0 Audit model: codex Latest published report
- Skill name
- recon-nmap
- Version
- v0.1.0
- Maintainer
- AgentSecOps
- Coverage
- 6 Files scanned · 2,165 Lines analyzed
- Policy version
- skillstore-security-audit-policy-v1
Highest confirmed finding severity
Critical
121 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static hits in templates and Markdown are false positives caused by code fences, placeholders, defensive examples, and documentation links. Confirmed findings include privileged Nmap execution, active-scanning commands, offensive NSE guidance, scan-evasion techniques, mutable CI dependencies, and a remote installer piped to Bash. The skill requires substantial restriction and remediation before public marketplace distribution.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Active attestation
A public attestation is available for this exact report.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
6 Files scanned · 2,165 Lines analyzed
136 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Observed in 2 evidence locations
Network access
May connect to external services.
Observed in 27 evidence locations
Filesystem access
May read or write local files.
Observed in 2 evidence locations
Env variables
May read values from the process environment.
Observed in 18 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 64 evidence locations
Capability review items (15)
High
sudo privilege escalation
sudo nmap -sS <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -sU -p 53,161,500 <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -A <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -A <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O --osscan-limit <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O --osscan-guess <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -f <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -D RND:10 <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -sI <zombie-host> <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
High
sudo privilege escalation
sudo nmap -f <target-ip>
This is an operational sudo command that grants Nmap raw-packet privileges and can send disruptive probes to a target.
Low
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
This URL supplies executable installer content directly to a shell, so remote changes would execute inside CI.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (121)
RISK-001 Critical
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a mutable remote installer and pipes it directly to Bash, enabling supply-chain code execution.
RISK-002 High
Network scanning tools
name: recon-nmap
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-003 High
Network scanning tools
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration,
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-004 High
Network scanning tools
tags: [reconnaissance, nmap, port-scanning, service-enumeration, network-security, osint]
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-005 High
Network scanning tools
packages: [nmap]
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-006 High
Network scanning tools
tools: [python3, masscan]
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-007 High
Network scanning tools
# Nmap Network Reconnaissance
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-008 High
Network scanning tools
Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vu
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-009 High
Network scanning tools
nmap -F <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-010 High
Network scanning tools
nmap -sV <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-011 High
Network scanning tools
nmap -A <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-012 High
Network scanning tools
nmap -sn <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-013 High
Network scanning tools
nmap -sn -PR <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-014 High
Network scanning tools
nmap -sn -PS22,80,443 <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-015 High
Network scanning tools
nmap -sn -PU53,161 <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-016 High
Network scanning tools
nmap -Pn <target-network>/24
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-017 High
Network scanning tools
nmap -sn <target-network>/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-018 High
Network scanning tools
nmap -F -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-019 High
Network scanning tools
nmap -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-020 High
Network scanning tools
nmap -p- -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-021 High
Network scanning tools
nmap -p 22,80,443,3389,8080 -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-022 High
Network scanning tools
nmap -p 1-1024,3000-9000 -iL live_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-023 High
Network scanning tools
sudo nmap -sS <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-024 High
Network scanning tools
nmap -sT <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-025 High
Network scanning tools
sudo nmap -sU -p 53,161,500 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-026 High
Network scanning tools
nmap -sV <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-027 High
Network scanning tools
sudo nmap -A <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-028 High
Network scanning tools
nmap -T0 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-029 High
Network scanning tools
nmap -T1 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-030 High
Network scanning tools
nmap -T2 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-031 High
Network scanning tools
nmap -T3 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-032 High
Network scanning tools
nmap -T4 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-033 High
Network scanning tools
nmap -T5 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-034 High
Network scanning tools
nmap --max-rate 100 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-035 High
Network scanning tools
nmap --min-rate 10 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-036 High
Network scanning tools
nmap --scan-delay 1s <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-037 High
Network scanning tools
nmap -sV <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-038 High
Network scanning tools
nmap -sV --version-intensity 5 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-039 High
Network scanning tools
nmap -sV --version-intensity 0 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-040 High
Network scanning tools
nmap -sV -p 80,443 --script=http-headers,http-title <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-041 High
Network scanning tools
nmap -p 445 --script=smb-os-discovery,smb-security-mode <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-042 High
Network scanning tools
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-043 High
Network scanning tools
nmap -p 53 --script=dns-nsid,dns-recursion <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-044 High
Network scanning tools
nmap -p 80,443 --script=http-methods,http-robots.txt,http-title <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-045 High
Network scanning tools
nmap -p 3306 --script=mysql-info <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-046 High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-047 High
Network scanning tools
nmap -p 1433 --script=ms-sql-info <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-048 High
Network scanning tools
sudo nmap -O <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-049 High
Network scanning tools
sudo nmap -A <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-050 High
Network scanning tools
sudo nmap -O --osscan-limit <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-051 High
Network scanning tools
sudo nmap -O --osscan-guess <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-052 High
Network scanning tools
Nmap Scripting Engine for advanced reconnaissance and vulnerability detection:
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-053 High
Network scanning tools
nmap -sC <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-054 High
Network scanning tools
nmap --script=vuln <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-055 High
Network scanning tools
nmap --script=exploit <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-056 High
Network scanning tools
nmap --script=discovery <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-057 High
Network scanning tools
nmap --script=http-sql-injection <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-058 High
Network scanning tools
nmap --script=smb-vuln-ms17-010,smb-vuln-cve-2017-7494 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-059 High
Network scanning tools
nmap --script=http-brute --script-args http-brute.path=/admin <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-060 High
Network scanning tools
nmap -p 445 --script=smb-vuln-ms17-010 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-061 High
Network scanning tools
nmap -p 443 --script=ssl-heartbleed <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-062 High
Network scanning tools
nmap --script=http-shellshock --script-args uri=/cgi-bin/test.sh <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-063 High
Network scanning tools
nmap -p 443 --script=ssl-enum-ciphers <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-064 High
Network scanning tools
nmap -p 80 --script=http-sql-injection <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-065 High
Network scanning tools
nmap -p 21 --script=ftp-anon <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-066 High
Network scanning tools
nmap <target-ip> -oN scan_results.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-067 High
Network scanning tools
nmap <target-ip> -oX scan_results.xml
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-068 High
Network scanning tools
nmap <target-ip> -oG scan_results.gnmap
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-069 High
Network scanning tools
nmap <target-ip> -oA scan_results
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-070 High
Network scanning tools
nmap <target-ip> -oS scan_results.skid
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-071 High
Network scanning tools
sudo nmap -f <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-072 High
Network scanning tools
sudo nmap -D RND:10 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-073 High
Network scanning tools
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-074 High
Network scanning tools
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-075 High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-076 High
Network scanning tools
nmap --proxies http://proxy:8080 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-077 High
Network scanning tools
sudo nmap -sI <zombie-host> <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-078 High
Network scanning tools
nmap -sn -PE -PS80,443 -PA3389 <external-network>/24 -oG - | awk '/Up$/{print $2}' > external_hosts.
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-079 High
Network scanning tools
nmap -Pn -sV -p 21,22,25,53,80,110,143,443,587,993,995,3389,8080,8443 -iL external_hosts.txt -oA ext
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-080 High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080,8443 -iL external_hosts.txt -oA external_vul
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-081 High
Network scanning tools
nmap -Pn -p 443,8443 --script=ssl-enum-ciphers,ssl-cert -iL external_hosts.txt -oA ssl_audit
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-082 High
Network scanning tools
nmap -sn -PR <internal-network>/24 -oG - | awk '/Up$/{print $2}' > internal_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-083 High
Network scanning tools
nmap -sV -p- -T4 -iL internal_hosts.txt -oA internal_full_scan
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-084 High
Network scanning tools
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-085 High
Network scanning tools
nmap -sV --script=default,discovery -iL internal_hosts.txt -oA internal_services
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-086 High
Network scanning tools
nmap -p 80,443,8000,8080,8443 --open -oG - <target-network>/24 | grep 'open' | awk '{print $2}' > we
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-087 High
Network scanning tools
nmap -sV -p 80,443,8080,8443 --script=http-enum,http-headers,http-methods,http-title,http-server-hea
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-088 High
Network scanning tools
nmap -p 80,443 --script=http-sql-injection,http-csrf,http-vuln-cve2017-5638 -iL web_servers.txt -oA
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-089 High
Network scanning tools
nmap -p 445 --open <target-network>/24 -oG - | grep 'open' | awk '{print $2}' > smb_hosts.txt
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-090 High
Network scanning tools
nmap -p 445 --script=smb-protocols,smb-security-mode,smb-os-discovery -iL smb_hosts.txt -oA smb_enum
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-091 High
Network scanning tools
nmap -p 445 --script=smb-vuln* -iL smb_hosts.txt -oA smb_vulns
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-092 High
Network scanning tools
nmap -p 445 --script=smb-enum-shares,smb-enum-users -iL smb_hosts.txt -oA smb_shares
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-093 High
Network scanning tools
nmap -sV -p 1433,1521,3306,5432,5984,6379,9200,27017 <target-network>/24 -oA database_scan
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-094 High
Network scanning tools
nmap -p 3306 --script=mysql-info,mysql-databases,mysql-variables <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-095 High
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-096 High
Network scanning tools
nmap -p 27017 --script=mongodb-info,mongodb-databases <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-097 High
Network scanning tools
nmap -p 6379 --script=redis-info <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-098 High
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080 \
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-099 High
Network scanning tools
nmap -Pn <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-100 High
Network scanning tools
nmap -PS80,443 -PA3389 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-101 High
Network scanning tools
nmap -PE -PS22,80,443 -PA3389 -PU53,161 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-102 High
Network scanning tools
nmap -T4 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-103 High
Network scanning tools
nmap -F <target-ip> # Top 100 ports
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-104 High
Network scanning tools
nmap --top-ports 1000 <target-ip>
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-105 High
Network scanning tools
nmap -T4 192.168.1.1-50 &
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-106 High
Network scanning tools
nmap -T4 192.168.1.51-100 &
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-107 High
Network scanning tools
nmap -T4 192.168.1.101-150 &
This is an executable Nmap command that sends discovery, port, service, operating-system, or vulnerability probes to a supplied target.
RISK-108 High
Network scanning tools
# Use masscan for very fast port scanning
The skill metadata or guidance explicitly declares operational Nmap or Masscan reconnaissance capability.
RISK-109 High
Network scanning tools
masscan -p 1-65535 --rate 10000 <target-network>/24
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-110 High
Network scanning tools
nmap -T1 --scan-delay 1s <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-111 High
Network scanning tools
sudo nmap -f <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-112 High
Network scanning tools
nmap --randomize-hosts -iL targets.txt
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-113 High
Network scanning tools
nmap -g 53 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-114 High
Network scanning tools
nmap -p 1-1000 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-115 High
Network scanning tools
nmap -p 1001-2000 <target-ip>
This operational command performs intrusive, evasive, brute-force, vulnerability, or high-rate network probing against a supplied target.
RISK-116 High
Mutable CI actions can execute with repository credentials
GitHub Actions use mutable tags, including a secrets scanner that receives GITHUB_TOKEN, allowing upstream tag changes to alter privileged CI code.
The workflow visibly uses version tags and master instead of immutable commit SHAs, while one action receives GITHUB_TOKEN.
RISK-117 High
Operational scan-evasion guidance
The guide provides fragmentation, decoy, source spoofing, proxy, idle-scan, and source-port techniques intended to bypass monitoring controls.
The sections explicitly describe firewall or IDS evasion and provide executable Nmap commands for each technique.
RISK-118 High
Brute-force and exploit NSE execution
The guide provides executable NSE commands for exploit categories, SQL injection checks, SMB vulnerabilities, and HTTP or PostgreSQL brute-force testing.
The cited commands directly invoke exploit, vulnerability, injection, enumeration, and brute-force NSE scripts against supplied targets.
RISK-119 Low
System reconnaissance
# Paranoid (0) - Extremely slow, IDS evasion
The text explicitly recommends timing behavior intended to evade detection during active reconnaissance.
RISK-120 Low
System reconnaissance
# Scan with delays to avoid detection
The text explicitly recommends timing behavior intended to evade detection during active reconnaissance.
RISK-121 Low
System reconnaissance
nmap <target-ip> -oS scan_results.skid
The example runs Nmap against a target and therefore performs active reconnaissance despite only demonstrating an output format.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001CriticalThe CI template pipes a mutable remote installer directly to Bash.Install a pinned tfsec release from a trusted package source, then verify its checksum before execution.
- FIX-002HighThe public guide includes exploit, brute-force, and monitoring-evasion commands.Remove these sections from the public skill or require explicit human approval, allowlisted targets, and isolated assessment environments.
- FIX-003HighMany workflows use sudo or raw-packet scanning without enforced scope controls.Default to unprivileged scans and require confirmation of approved ranges, exclusions, rate caps, and stop conditions before privileged execution.
- FIX-004HighGitHub Actions use mutable version tags, including an action that receives GITHUB_TOKEN.Pin every action to a reviewed full commit SHA and reduce job permissions to the minimum needed.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- 9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
- Content hash
- 9953cf3a8216a84f02f0a503a470ea7dd81463daa75fa56f847f10d9eb6a1065
- Tree hash
- e84bc379b5264587e461ba851da54d1351e10ee650f94fe06f0307b09f05d740
- Skill path
- skills/agentsecops/recon-nmap
- Audit payload hash
- 2c89819468d3d52a1882dbf8542ceaac
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: active