Skills webapp-nikto

📦

webapp-nikto

Name: webapp-nikto
Author: AgentSecOps

v0.1.0 Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Scan Web Servers with Nikto

Web teams need a repeatable way to identify server weaknesses before attackers find them. This skill guides authorized Nikto scans and structured remediation reporting.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "webapp-nikto" from https://skillstore.io/skills/agentsecops-webapp-nikto.md and its manifest at https://skillstore.io/api/skills/agentsecops-webapp-nikto/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-webapp-nikto.md Signed manifest GET /api/skills/agentsecops-webapp-nikto/manifest Signed lockfile GET /api/skills/agentsecops-webapp-nikto/lockfile

Test it

Using "webapp-nikto". Plan a low-impact scan of staging.example.com on HTTPS port 443 during an approved maintenance window.

Expected outcome:

Scope: staging.example.com on port 443 during the approved window.
Approach: start with limited tuning, a short maximum duration, and a pause between requests.
Records: preserve the command, timestamps, operator, result file, and any observed service impact.

Using "webapp-nikto". Summarize a Nikto report containing an outdated server banner, missing security headers, and an exposed backup file.

Expected outcome:

High priority: verify the exposed backup file and remove public access immediately.
Medium priority: confirm the server version and apply supported security updates.
Lower priority: add missing security headers after testing application compatibility.

Security Audit

Critical

v9 • 7/23/2026 Open versioned report

Most static findings are false positives from Markdown code fences, reserved example URLs, defensive samples, and standard local report processing. The CI template executes an unverified remote installer and uses mutable third-party actions in security-sensitive workflows. The skill also provides actionable IDS and WAF evasion guidance despite repeated authorization warnings.

Files scanned

1,972

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

Critical

assets/ci-config-template.yml:240

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The workflow downloads a script from a mutable branch and pipes it directly to Bash. A compromised upstream response would execute arbitrary code on the CI runner.

High

SKILL.md:186-215 SKILL.md:392-404

Actionable IDS and WAF Evasion Guidance

The skill teaches random user agents, URI mutations, IDS evasion, and WAF bypass techniques that can conceal unauthorized vulnerability scanning.

The headings and commands explicitly describe evading detection and continuing when a WAF blocks scans. Authorization warnings reduce misuse risk but do not remove the capability.

High

assets/ci-config-template.yml:161-165 assets/ci-config-template.yml:196-202

Mutable Third-Party CI Actions

The CI template uses third-party actions through mutable tags, including a master branch, allowing upstream changes to execute in security-sensitive workflows.

The template visibly selects gitleaks-action@v2 and trivy-action@master instead of immutable commit SHAs. These actions run on CI runners with repository context.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

assets/ci-config-template.yml:240

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The URL references an installer on the mutable master branch and its response is executed without checksum or signature verification. This creates a concrete supply-chain dependency.

Risk Factors

⚙️ External commands (42)

🌐 Network access (50)

📁 Filesystem access (2)

assets/ci-config-template.yml:323 assets/ci-config-template.yml:323

🔑 Env variables (23)

⚡ Contains scripts (2)

references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell pattern

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentsecops-webapp-nikto/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-webapp-nikto/security.svg)](https://skillstore.io/skills/agentsecops-webapp-nikto?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-webapp-nikto?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-webapp-nikto/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-webapp-nikto.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). webapp-nikto security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-webapp-nikto/audits/9

BibTeX citation

@techreport{agentsecops-agentsecops-webapp-nikto-2026,
  author = {AgentSecOps},
  title = {webapp-nikto security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/agentsecops-webapp-nikto/audits/9},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "webapp-nikto security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-webapp-nikto/audits/9"
identifiers:
  - type: other
    value: "skillstore:agentsecops-webapp-nikto:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Assess a staging server

Plan a focused Nikto scan, review exposed files and configuration findings, and prepare developer remediation tasks.

Validate server hardening

Compare authorized scan results before and after patching to confirm that risky server behavior is removed.

Prepare audit evidence

Create a scoped assessment record with timestamps, findings, validation notes, and remediation priorities.

Try These Prompts

Plan a basic scan

Plan an authorized Nikto scan for [target] on [ports]. Confirm scope, propose a low-impact command, and explain each option before execution.

Review scan findings

Review this Nikto output: [findings]. Group findings by severity, identify likely false positives, and propose manual validation steps.

Design authenticated testing

Design an authenticated Nikto assessment for [application] using [approved credential method]. Limit duration and request rate, then define secure report handling.

Build a gated CI scan

Create a gated CI workflow for authorized Nikto scans against [staging target]. Pin dependencies, validate targets, preserve reports, and fail on defined severity thresholds.

Best Practices

Obtain written authorization and record approved hosts, ports, credentials, and testing windows before scanning.
Start with narrow tuning and conservative timing, then expand only when scope and server capacity permit.
Validate findings manually and remove credentials or session data before sharing reports.

Avoid

Do not scan public, customer, or third-party systems without explicit written permission.
Do not treat every Nikto result as confirmed without reproduction and contextual review.
Do not use evasion options to bypass monitoring, access controls, or scope restrictions.

Frequently Asked Questions

Does this skill install or run Nikto automatically?

It provides commands and workflows. Execution requires Nikto, Perl, and explicit approval in the active environment.

Can I scan a production server?

Only with written authorization, an approved window, tested rate limits, backups, monitoring, and an emergency contact.

How should credentials be handled?

Use approved secret storage and temporary accounts. Never place real passwords, API keys, or session cookies in prompts or reports.

Are Nikto findings always accurate?

No. Validate each finding manually and consider server configuration, application behavior, and compensating controls before assigning severity.

Can Nikto run in CI?

Yes, against approved staging targets. Pin dependencies, validate targets, limit traffic, protect artifacts, and define failure thresholds.

What does Nikto not cover?

Nikto focuses on web server checks. It does not replace authenticated application testing, business logic review, code review, or complete compliance validation.