Skills nmap
📦
nmap
Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access
Map Authorized Networks with Nmap
Unknown services and exposed ports make authorized network assessment difficult. This skill guides structured Nmap scans, output capture, service detection, and result review.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "nmap" from https://skillstore.io/skills/brownfinesecurity-nmap.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-nmap/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "nmap". Assess authorized host 10.0.0.25 with low impact.
Expected outcome:
- Scope check: one approved private host with no excluded ports supplied.
- Plan: begin with limited discovery, save all formats, then inspect only confirmed open ports.
- Safety: use conservative timing and stop if the host becomes unstable.
Using "nmap". Summarize a saved scan showing ports 22, 80, and 443.
Expected outcome:
The host exposes remote administration and two web services. Validate versions, transport security, ownership, and whether each service is expected.
Using "nmap". Plan follow-up checks for an authorized camera with HTTP and RTSP.
Expected outcome:
Review HTTP methods and RTSP capabilities with approved low-impact scripts. Record evidence and avoid brute-force checks unless separately authorized.
Security Audit
High Riskv10 • 7/23/2026 Open versioned report
The skill contains actionable Nmap commands for privileged, broad, stealth, vulnerability, protocol, and brute-force scans. Markdown, hard-link, and private-address alerts are false positives, but confirmed scan guidance creates substantial dual-use risk. Authorization is advisory, while evasion techniques and automatic privileged scanning remain operational instructions.
1
Files scanned
533
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (50)
High
System reconnaissance
Use when trying to avoid detection (requires root/sudo):
The text explicitly recommends a root SYN scan when trying to avoid detection. This is actionable covert-reconnaissance guidance rather than neutral system inventory.
High
Network scanning tools
description: Professional network reconnaissance and port scanning using nmap. Supports various scan
The metadata explicitly advertises port scanning, service enumeration, vulnerability scanning, and reconnaissance. This accurately identifies the skill's active dual-use capability.
High
Network scanning tools
You are helping the user perform professional network reconnaissance and port scanning using nmap. T
The instruction explicitly directs the agent to help perform Nmap reconnaissance and port scanning. This confirms active network-scanning intent.
High
Network scanning tools
sudo nmap -p- <target> -oA <output-dir>/nmap-portscan
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -p- -Pn <target> -oA <output-dir>/nmap-portscan
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p <OPEN_PORT_LIST> -sV -sC <target> -oA <output-dir>/nmap-services
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -p- <target> -oA "$OUTPUT_DIR/nmap-portscan"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -p- -Pn <target> -oA "$OUTPUT_DIR/nmap-portscan"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
Show all 50 confirmed findings
High
Network scanning tools
nmap -p "$OPEN_PORTS" -sV -sC <target> -oA "$OUTPUT_DIR/nmap-services"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -sV -sC <target> -oA <output-prefix>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -sV -sC -p- <target> -oA <output-prefix>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -sS -sV -sC <target> -oA <output-prefix>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -sU --top-ports 100 <target> -oA <output-prefix>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -A -T4 <target> -oA <output-prefix>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -sV --script vuln <target> -oA <output-prefix>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -O <target> -oA <output-prefix>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 80,443,8080,8443 --script http-* <target> -oA <output-dir>/nmap-web
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 22 --script ssh-* <target> -oA <output-dir>/nmap-ssh
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 554 --script rtsp-* <target> -oA <output-dir>/nmap-rtsp
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 80,554,8000,8080 --script http-methods,http-headers <target> -oA <output-dir>/nmap-onvif
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap <ip-address>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap 192.168.1.0/24
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap 192.168.1.1-254
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap 192.168.1.1 192.168.1.10 192.168.1.100
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap 192.168.1.0/24 --exclude 192.168.1.1,192.168.1.254
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap --script auth <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap --script brute <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -sC <target> # equivalent to --script default
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap --script discovery <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap --script vuln <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap --script "http-*" <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 554 --script rtsp-methods,rtsp-url-brute <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 1900 --script upnp-info <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 1883,8883 --script mqtt-subscribe <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 502 --script modbus-discover <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p <ports> -sV -sC <target> -oA output/nmap-services
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -sV -sC -T4 <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -sV -sC -T2 <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap <options> <target>
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -p- $TARGET -oA "$OUTPUT_DIR/nmap-portscan"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -p- -Pn $TARGET -oA "$OUTPUT_DIR/nmap-portscan"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p "$OPEN_PORTS" -sV -sC $TARGET -oA "$OUTPUT_DIR/nmap-services"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 80 --script http-methods $TARGET -oA "$OUTPUT_DIR/nmap-http"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -p 554 --script rtsp-methods $TARGET -oA "$OUTPUT_DIR/nmap-rtsp"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -sU --top-ports 100 <target> -oA "$OUTPUT_DIR/nmap-udp"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
sudo nmap -O <target> -oA "$OUTPUT_DIR/nmap-os"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network scanning tools
nmap -sV --script vuln <target> -oA "$OUTPUT_DIR/nmap-vuln"
The cited line provides an actionable Nmap scan command. Executing it against an unapproved target performs active reconnaissance and may disrupt services or violate scope.
High
Network Scan Evasion Guidance
The skill recommends stealth scans, IDS-evasion timing, packet fragmentation, and trusted source ports. These techniques can facilitate covert reconnaissance.
The cited sections explicitly describe avoiding detection, IDS evasion, fragmented packets, and trusted source ports. The intent is direct and repeated.
High
Brute-Force and Endpoint Discovery Guidance
The skill recommends Nmap brute-force scripts and RTSP URL brute forcing. These actions can test credentials or enumerate protected endpoints.
The commands explicitly select the brute NSE category and rtsp-url-brute script. Their names and surrounding labels establish the intended behavior.
High
Privileged Broad Scanning Before Authorization
The default workflow mandates a privileged all-port scan and automatic firewall-bypass retry. Authorization appears only as a later question, not an execution gate.
The skill says to always use the privileged two-phase workflow, while authorization is only listed among questions near the end. No mandatory verification gate is defined.
Capability review items (13)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo nmap -p- <target> -oA <output-dir>/nmap-portscan
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -p- -Pn <target> -oA <output-dir>/nmap-portscan
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -p- <target> -oA "$OUTPUT_DIR/nmap-portscan"
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -p- -Pn <target> -oA "$OUTPUT_DIR/nmap-portscan"
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -sS -sV -sC <target> -oA <output-prefix>
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -sU --top-ports 100 <target> -oA <output-prefix>
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -O <target> -oA <output-prefix>
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
# Run with sudo
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap <options> <target>
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -p- $TARGET -oA "$OUTPUT_DIR/nmap-portscan"
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -p- -Pn $TARGET -oA "$OUTPUT_DIR/nmap-portscan"
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -sU --top-ports 100 <target> -oA "$OUTPUT_DIR/nmap-udp"
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
High
sudo privilege escalation
sudo nmap -O <target> -oA "$OUTPUT_DIR/nmap-os"
The skill instructs the agent to run Nmap through sudo, granting raw-packet and root capabilities for active scanning. This increases impact and crosses a privilege boundary.
Risk Factors
⚙️ External commands (50)
SKILL.md:13-21 SKILL.md:21-23 SKILL.md:23-30 SKILL.md:30-32 SKILL.md:32-40 SKILL.md:40-42 SKILL.md:42-43 SKILL.md:43-48 SKILL.md:48-50 SKILL.md:50-51 SKILL.md:51 SKILL.md:52-53 SKILL.md:53-66 SKILL.md:66-69 SKILL.md:69-71 SKILL.md:71-72 SKILL.md:72-74 SKILL.md:74-81 SKILL.md:81-84 SKILL.md:84-87 SKILL.md:87-89 SKILL.md:89-92 SKILL.md:92-97 SKILL.md:97-100 SKILL.md:100-102 SKILL.md:102-105 SKILL.md:105-111 SKILL.md:111-114 SKILL.md:114-116 SKILL.md:116-122 SKILL.md:122-124 SKILL.md:124-125 SKILL.md:125-126 SKILL.md:126-127 SKILL.md:127-134 SKILL.md:134-136 SKILL.md:136-137 SKILL.md:137-143 SKILL.md:143-145 SKILL.md:145-146 SKILL.md:146-152 SKILL.md:152-154 SKILL.md:154-155 SKILL.md:155-156 SKILL.md:156-162 SKILL.md:162-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-172 SKILL.md:172-174
🌐 Network access (6)
📁 Filesystem access (3)
Detected Patterns
System reconnaissanceNetwork scanning tools×46
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/brownfinesecurity-nmap/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/brownfinesecurity-nmap?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/brownfinesecurity-nmap?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-nmap/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-nmap.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
BrownFineSecurity. (2026). nmap security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-nmap/audits/10BibTeX citation
@techreport{brownfinesecurity-brownfinesecurity-nmap-2026,
author = {BrownFineSecurity},
title = {nmap security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/brownfinesecurity-nmap/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "nmap security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "BrownFineSecurity"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/brownfinesecurity-nmap/audits/10"
identifiers:
- type: other
value: "skillstore:brownfinesecurity-nmap:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
71
Community
87
Spec Compliance
What You Can Build
Inventory Authorized Assets
Discover exposed ports and identify services on approved internal hosts while preserving scan evidence.
Assess IoT Services
Map web, RTSP, MQTT, UPnP, and Modbus services during an authorized device assessment.
Investigate Network Exposure
Compare expected services with observed ports and document unexpected exposure for remediation.
Try These Prompts
Plan a Low-Impact Scan
Plan a low-impact Nmap scan for authorized host [target]. Confirm scope, explain selected options, and save all output under [directory].
Build a Two-Phase Workflow
Create a two-phase Nmap workflow for authorized target [target]. Discover ports, inspect detected services, and summarize expected output files.
Analyze Saved Results
Review the saved Nmap results from [file]. List open ports, identified versions, uncertain fingerprints, and recommended low-impact follow-up checks.
Design an IoT Assessment
Design an authorized IoT assessment for [target] within [scope]. Include rate limits, targeted NSE categories, stop conditions, evidence capture, and risk controls.
Best Practices
- Confirm written authorization, exact targets, exclusions, timing, and stop conditions before every scan.
- Start with the least intrusive scan that answers the question, then expand only with explicit approval.
- Save outputs securely, record parameters and timestamps, and validate automated findings before reporting.
Avoid
- Do not scan public or third-party systems without documented permission.
- Do not default to stealth, fragmentation, brute-force, or vulnerability scripts on production systems.
- Do not run broad privileged scans when a narrow unprivileged check is sufficient.
Frequently Asked Questions
Does this skill execute Nmap?
It provides workflows and commands that an agent may execute when Nmap, tools, and permissions are available.
Do I need authorization?
Yes. Obtain documented permission and confirm the exact target scope before scanning any host or network.
Which output formats are supported?
The guidance uses Nmap output options for normal, XML, and grepable files.
When is root access required?
SYN, UDP, operating-system detection, and other raw-packet features commonly require elevated privileges.
Can it assess IoT devices?
Yes. It includes targeted guidance for RTSP, ONVIF-related web services, UPnP, MQTT, and Modbus.
Are scan findings definitive?
No. Firewalls, rate limits, service behavior, and fingerprint uncertainty can produce incomplete or inaccurate results.
Developer Details
Author
BrownFineSecurityLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
7 downloads · 243 views
File structure
📄 SKILL.md