📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills security-scanning-tools
📦
security-scanning-tools
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Assess Security Scanning Workflows
Security teams need consistent methods for authorized vulnerability scans and assessment reports. This skill organizes common tools, workflows, outputs, and reporting steps for controlled security reviews.
Supports: Claude Codex Code(CC)
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "security-scanning-tools" from https://skillstore.io/skills/sickn33-security-scanning-tools.md and its manifest at https://skillstore.io/api/skills/sickn33-security-scanning-tools/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "security-scanning-tools". Plan an authorized internal network vulnerability assessment for a small office subnet.
Expected outcome:
- Scope summary with authorized assets and excluded systems.
- Discovery, service identification, vulnerability scanning, validation, and reporting phases.
- A report outline covering key findings, affected services, risk ratings, and remediation priorities.
Using "security-scanning-tools". Choose tools for a web application security review with authenticated areas.
Expected outcome:
- Recommended use of proxy-based testing, crawling, passive review, active checks, and manual validation.
- Notes about authentication setup, scope boundaries, rate limits, and evidence collection.
- A concise report structure for OWASP-style findings and remediation guidance.
Using "security-scanning-tools". Prepare compliance scanning evidence for Linux servers.
Expected outcome:
- Suggested compliance scanner categories and profile selection steps.
- Evidence requirements for scan reports, exceptions, and remediation tracking.
- Operational cautions about privileged access and production system impact.
Security Audit
Criticalv4 • 7/7/2026 Open versioned report
The Markdown backtick and some reference-table matches are false positives, but the skill contains extensive confirmed active scanning guidance. High-risk content includes Nmap and Masscan workflows, sudo-based tooling, command-line API key exposure, Metasploit exploitation validation, Internet-wide scanning, and wireless deauthentication or password cracking.
1
Files scanned
590
Lines analyzed
58
Review items
0
False positives ignored
Confirmed security concerns (61)
Critical
Metasploit framework
#### Metasploit Vulnerability Validation
The skill explicitly introduces Metasploit vulnerability validation and msfconsole usage. This framework can enable exploitation workflows, so marketplace publication requires strict controls.
Critical
Metasploit framework
# Start Metasploit
The skill explicitly introduces Metasploit vulnerability validation and msfconsole usage. This framework can enable exploitation workflows, so marketplace publication requires strict controls.
Critical
Wireless Deauthentication and Password Cracking Guidance
The Aircrack-ng section gives steps for deauthentication attacks and WPA or WEP cracking. These instructions can disrupt networks and support unauthorized credential attacks.
The section labels deauthentication as an attack and then provides concrete cracking commands, leaving little ambiguity about offensive capability.
Critical
Exploit Validation and Auto-Exploitation Workflow
The Metasploit section says to validate vulnerabilities with exploitation and includes commands to select an SMB scanner, run it, and suggest exploits. This goes beyond passive vulnerability assessment.
The text explicitly references exploitation and Metasploit workflow steps, including exploit suggestion through analyze.
High
Certificate/key files
zap.sh -daemon -port 8080 -config api.key=<your_key>
The ZAP API example places an API key value directly on a command line. If replaced with a real key, it may leak through shell history, process listings, or logs.
High
Network scanning tools
#### Nmap (Network Mapper)
The line is a heading, guide entry, or workflow reference that confirms the skill is built around network scanning tools. It supports the same operational scanning capability described throughout SKILL.md.
High
Network scanning tools
nmap -sn 192.168.1.0/24 # Ping scan (no port scan)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -sL 192.168.1.0/24 # List scan (DNS resolution)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
Show all 61 confirmed findings
High
Network scanning tools
nmap -Pn 192.168.1.100 # Skip host discovery
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -sS 192.168.1.100 # TCP SYN scan (stealth)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -sT 192.168.1.100 # TCP connect scan
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -sU 192.168.1.100 # UDP scan
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -sA 192.168.1.100 # ACK scan (firewall detection)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -p 80,443 192.168.1.100 # Specific ports
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -p- 192.168.1.100 # All 65535 ports
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -p 1-1000 192.168.1.100 # Port range
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap --top-ports 100 192.168.1.100 # Top 100 common ports
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -sV 192.168.1.100 # Service version detection
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -O 192.168.1.100 # OS detection
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -A 192.168.1.100 # Aggressive (OS, version, scripts)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -T4 192.168.1.100 # Aggressive (faster)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -T5 192.168.1.100 # Insane (fastest)
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap --script=vuln 192.168.1.100 # Vulnerability scripts
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap --script=http-enum 192.168.1.100 # Web enumeration
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap --script=smb-vuln* 192.168.1.100 # SMB vulnerabilities
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap --script=default 192.168.1.100 # Default script set
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -oN scan.txt 192.168.1.100 # Normal output
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -oX scan.xml 192.168.1.100 # XML output
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -oG scan.gnmap 192.168.1.100 # Grepable output
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
nmap -oA scan 192.168.1.100 # All formats
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
#### Masscan
The line is a heading, guide entry, or workflow reference that confirms the skill is built around network scanning tools. It supports the same operational scanning capability described throughout SKILL.md.
High
Network scanning tools
masscan -p80 192.168.1.0/24 --rate=1000
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
masscan -p80,443,8080 192.168.1.0/24 --rate=10000
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
masscan -p0-65535 192.168.1.0/24 --rate=5000
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt
The Masscan command targets 0.0.0.0/0 at a high rate, enabling Internet-wide active scanning. This is a concrete high-risk network scanning instruction.
High
Network scanning tools
masscan -p80 192.168.1.0/24 -oG results.gnmap
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
masscan -p80 192.168.1.0/24 -oJ results.json
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
masscan -p80 192.168.1.0/24 -oX results.xml
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
masscan -p80 192.168.1.0/24 --banners
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
# Import Nmap results
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
- Host discovery (Nmap ping sweep)
The line is a heading, guide entry, or workflow reference that confirms the skill is built around network scanning tools. It supports the same operational scanning capability described throughout SKILL.md.
High
Network scanning tools
| Network Discovery | Nmap, Masscan |
The line is a heading, guide entry, or workflow reference that confirms the skill is built around network scanning tools. It supports the same operational scanning capability described throughout SKILL.md.
High
Network scanning tools
# Nmap XML to HTML
The line is a heading, guide entry, or workflow reference that confirms the skill is built around network scanning tools. It supports the same operational scanning capability described throughout SKILL.md.
High
Network scanning tools
xsltproc nmap-output.xml -o report.html
The command converts Nmap scan output into a report rather than scanning directly. It is still part of an Nmap workflow and confirms the skill handles network scanning results.
High
Network scanning tools
### Nmap Cheat Sheet
The line is a heading, guide entry, or workflow reference that confirms the skill is built around network scanning tools. It supports the same operational scanning capability described throughout SKILL.md.
High
Network scanning tools
| Ping Scan | `nmap -sn <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
| Quick Scan | `nmap -T4 -F <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
| Full Scan | `nmap -p- <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
| Service Scan | `nmap -sV <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
| OS Detection | `nmap -O <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
| Aggressive | `nmap -A <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
| Vuln Scripts | `nmap --script=vuln <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
| Stealth Scan | `nmap -sS -T2 <target>` |
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
1. Try different discovery methods: `nmap -Pn` or `nmap -sn -PS/PA/PU`
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
3. Use TCP SYN scan: `nmap -PS22,80,443`
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
1. Increase timing: `nmap -T4` or `-T5`
The line provides an Nmap or Masscan command for host discovery, port scanning, service detection, vulnerability scripts, or troubleshooting. These are active network scanning instructions that require authorization.
High
Network scanning tools
3. Use Masscan for initial discovery
The line is a heading, guide entry, or workflow reference that confirms the skill is built around network scanning tools. It supports the same operational scanning capability described throughout SKILL.md.
High
Unbounded Internet-Wide High-Rate Scanning Guidance
The Masscan section includes a large-scale scan against 0.0.0.0/0 with a rate of 100000. This teaches Internet-wide probing unless the user replaces it with a tightly authorized scope.
The line directly targets the entire IPv4 space and sets a high packet rate, so the operational risk is explicit.
Medium
System reconnaissance
nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion)
The Nmap timing example describes a paranoid scan associated with IDS evasion. That is reconnaissance guidance with stealth implications even though the target is private-address example text.
Medium
System reconnaissance
sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon
The wireless capture command collects traffic for a specific BSSID. That is reconnaissance against a wireless target and requires explicit authorization.
Capability review items (58)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo systemctl start nessusd
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo apt install openvas
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo gvm-setup
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo gvm-start
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo airmon-ng start wlan0
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo airodump-ng wlan0mon
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo aireplay-ng -0 10 -a <bssid> wlan0mon
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo freshclam
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo lynis audit system
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo lynis audit system --quick
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo lynis audit system --profile server
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo lynis audit system --report-file /tmp/lynis-report.dat
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo lynis show profiles
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
sudo privilege escalation
sudo lynis audit system --tests-from-group malware
The line instructs running security tooling with sudo, which can change host state or access privileged interfaces. In an AI-assisted workflow this requires explicit human authorization and containment.
High
Hardcoded IP address
masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt
The command scans 0.0.0.0/0 with Masscan at a very high rate, which is Internet-wide active probing. That can affect third-party systems and violates safe default scope expectations.
High
Hardcoded IP address
set RHOSTS 192.168.1.0/24
The IP range is used as Metasploit RHOSTS for an SMB vulnerability scanner. Even though it is a private subnet example, the surrounding exploitation workflow makes this an operational attack-risk pattern.
Medium
Hardcoded IP address
nmap -sn 192.168.1.0/24 # Ping scan (no port scan)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -sL 192.168.1.0/24 # List scan (DNS resolution)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -Pn 192.168.1.100 # Skip host discovery
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -sS 192.168.1.100 # TCP SYN scan (stealth)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -sT 192.168.1.100 # TCP connect scan
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -sU 192.168.1.100 # UDP scan
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -sA 192.168.1.100 # ACK scan (firewall detection)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -p 80,443 192.168.1.100 # Specific ports
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -p- 192.168.1.100 # All 65535 ports
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -p 1-1000 192.168.1.100 # Port range
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap --top-ports 100 192.168.1.100 # Top 100 common ports
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -sV 192.168.1.100 # Service version detection
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -O 192.168.1.100 # OS detection
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -A 192.168.1.100 # Aggressive (OS, version, scripts)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -T0 192.168.1.100 # Paranoid (slowest, IDS evasion)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -T4 192.168.1.100 # Aggressive (faster)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -T5 192.168.1.100 # Insane (fastest)
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap --script=vuln 192.168.1.100 # Vulnerability scripts
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap --script=http-enum 192.168.1.100 # Web enumeration
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap --script=smb-vuln* 192.168.1.100 # SMB vulnerabilities
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap --script=default 192.168.1.100 # Default script set
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -oN scan.txt 192.168.1.100 # Normal output
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -oX scan.xml 192.168.1.100 # XML output
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -oG scan.gnmap 192.168.1.100 # Grepable output
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nmap -oA scan 192.168.1.100 # All formats
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 --rate=1000
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
masscan -p80,443,8080 192.168.1.0/24 --rate=10000
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
masscan -p0-65535 192.168.1.0/24 --rate=5000
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 -oG results.gnmap
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 -oJ results.json
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 -oX results.xml
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
masscan -p80 192.168.1.0/24 --banners
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
nessuscli scan --create --name "Internal Scan" --targets 192.168.1.0/24
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Hardcoded IP address
<hosts>192.168.1.0/24</hosts>
The address appears in active network or vulnerability scanner examples against a subnet or host. These examples are legitimate only inside authorized scope and can probe systems if executed.
Medium
Temp directory access
sudo lynis audit system --report-file /tmp/lynis-report.dat
The command writes a privileged Lynis audit report to /tmp, which may expose security posture details on shared systems. The risk depends on permissions, so confidence is moderate.
Low
Hardcoded URL
zap-cli quick-scan https://target.com
The example invokes active web scanners against https://target.com, which would send traffic to an external host if copied literally. It is likely a placeholder, but the skill does not enforce authorization or a reserved example domain.
Low
Hardcoded URL
zap-cli spider https://target.com
The example invokes active web scanners against https://target.com, which would send traffic to an external host if copied literally. It is likely a placeholder, but the skill does not enforce authorization or a reserved example domain.
Low
Hardcoded URL
zap-cli active-scan https://target.com
The example invokes active web scanners against https://target.com, which would send traffic to an external host if copied literally. It is likely a placeholder, but the skill does not enforce authorization or a reserved example domain.
Low
Hardcoded URL
-t https://target.com -r report.html
The example invokes active web scanners against https://target.com, which would send traffic to an external host if copied literally. It is likely a placeholder, but the skill does not enforce authorization or a reserved example domain.
Low
Hardcoded URL
-t https://target.com -r report.html
The example invokes active web scanners against https://target.com, which would send traffic to an external host if copied literally. It is likely a placeholder, but the skill does not enforce authorization or a reserved example domain.
Low
Hardcoded URL
nikto -h https://target.com
The example invokes active web scanners against https://target.com, which would send traffic to an external host if copied literally. It is likely a placeholder, but the skill does not enforce authorization or a reserved example domain.
Risk Factors
⚙️ External commands (61)
SKILL.md:42-81 SKILL.md:81-87 SKILL.md:87-105 SKILL.md:105-113 SKILL.md:113-125 SKILL.md:125-138 SKILL.md:138-159 SKILL.md:159-167 SKILL.md:167-181 SKILL.md:181-195 SKILL.md:195-211 SKILL.md:211-214 SKILL.md:214-222 SKILL.md:222-228 SKILL.md:228-249 SKILL.md:249-257 SKILL.md:257-278 SKILL.md:278-284 SKILL.md:284-297 SKILL.md:297-305 SKILL.md:305-326 SKILL.md:326-332 SKILL.md:332-351 SKILL.md:351-359 SKILL.md:359-380 SKILL.md:380-386 SKILL.md:386-401 SKILL.md:401-409 SKILL.md:409-425 SKILL.md:425-431 SKILL.md:431-445 SKILL.md:445-495 SKILL.md:495-512 SKILL.md:512-520 SKILL.md:520-521 SKILL.md:521-522 SKILL.md:522-523 SKILL.md:523-524 SKILL.md:524-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-569 SKILL.md:569 SKILL.md:571-577 SKILL.md:577 SKILL.md:578-580 SKILL.md:115 SKILL.md:140 SKILL.md:141 SKILL.md:144 SKILL.md:262 SKILL.md:265 SKILL.md:268 SKILL.md:271 SKILL.md:307 SKILL.md:411 SKILL.md:414 SKILL.md:417 SKILL.md:420 SKILL.md:423 SKILL.md:424
🌐 Network access (48)
SKILL.md:503 SKILL.md:118 SKILL.md:147 SKILL.md:200 SKILL.md:203 SKILL.md:204 SKILL.md:217 SKILL.md:221 SKILL.md:230 SKILL.md:292 SKILL.md:44 SKILL.md:45 SKILL.md:46 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:55 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:61 SKILL.md:62 SKILL.md:63 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:89 SKILL.md:90 SKILL.md:93 SKILL.md:96 SKILL.md:99 SKILL.md:100 SKILL.md:101 SKILL.md:104 SKILL.md:121 SKILL.md:157 SKILL.md:169 SKILL.md:345 SKILL.md:536
📁 Filesystem access (3)
Detected Patterns
Metasploit framework×2System reconnaissance×2Network scanning tools×53
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-security-scanning-tools/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-security-scanning-tools?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-security-scanning-tools?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-security-scanning-tools/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-security-scanning-tools.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). security-scanning-tools security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-security-scanning-tools/audits/4BibTeX citation
@techreport{sickn33-sickn33-security-scanning-tools-2026,
author = {sickn33},
title = {security-scanning-tools security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-security-scanning-tools/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "security-scanning-tools security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-security-scanning-tools/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-security-scanning-tools:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
78
Spec Compliance
What You Can Build
Plan an Internal Scan
Define scope, choose discovery tools, and outline expected outputs for an approved internal network review.
Prepare a Web Assessment
Select web scanners, proxy workflows, and reporting steps for an authorized application security test.
Document Compliance Evidence
Map compliance scanners and report formats to evidence needed for audit preparation.
Try These Prompts
Choose Scanning Tools
I have written authorization to assess this environment. Help me choose scanning tools for scope: [scope], asset types: [assets], and required report format: [format].
Create a Scan Plan
Build a phased scanning plan for an authorized security review. Include discovery, vulnerability checks, validation steps, reporting outputs, and safety limits.
Compare Tool Coverage
Compare Nmap, Nessus, OpenVAS, ZAP, Nikto, Lynis, and OpenSCAP for this authorized assessment: [goals]. Explain overlap, gaps, and reporting value.
Design a Controlled Assessment
Design a controlled scanning methodology for authorized network, web, cloud, and compliance testing. Include scope controls, risk limits, validation, and executive reporting.
Best Practices
- Use written authorization and explicit scope before any scan.
- Start with passive or low-impact checks before intrusive tests.
- Validate automated findings manually before reporting or remediation.
Avoid
- Do not scan public or third-party systems without permission.
- Do not run high-rate scans against production networks without change approval.
- Do not treat exploit validation as routine vulnerability confirmation.
Frequently Asked Questions
Does this skill run scans by itself?
No. It provides guidance and command examples. Users remain responsible for tools, permissions, and target authorization.
Is this skill safe for public targets?
No. It should only be used for systems where the user has explicit written authorization.
Which tools does it cover?
It covers tools including Nmap, Masscan, Nessus, OpenVAS, Burp Suite, ZAP, Nikto, Aircrack-ng, ClamAV, Prowler, ScoutSuite, Lynis, and OpenSCAP.
Can it help create reports?
Yes. It describes report types, output formats, and a basic executive summary structure.
Does it confirm vulnerabilities?
No. It explains validation concepts, but expert review is required before declaring a confirmed vulnerability.
Why are some examples restricted?
Some examples involve intrusive scanning, privileged commands, wireless disruption, or exploitation workflows that can harm systems without permission.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/web-app/public/skills/scanning-toolsRef
9f814fc6a43fd99946f2da5e0df231c65a38bc76
Maintenance freshness
7/18/2026
Usage
8 downloads · 131 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
python-web-app-security-audit
90Audit Python Web Apps Before Release
by glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Security & Compliance View
📦
isms-audit-expert
83Audit ISO 27001 ISMS Controls
by alirezarezvani
ISMS audits require clear scope, evidence, and risk-based priorities. This skill guides ISO 27001 audit planning, control testing, and readiness work.
Security & Compliance View
📦
senior-security
81Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Security & Compliance View
📦
senior-secops
81Automate SecOps Checks
by alirezarezvani
Security teams need consistent review workflows across projects. This skill provides SecOps CLI scaffolds and reference guides for repeatable checks.
Security & Compliance View
📦
security-engineering
81Strengthen Security Engineering Decisions
by 89jobrien
Security work often spans architecture, identity, compliance, testing, and response planning. This skill gives Claude, Codex, and Claude Code structured security engineering guidance.
Security & Compliance View
📦
security-analyzer
80Analyze Project Security Risks
by Cornjebus
Security reviews are slow when dependency, container, and IaC data are spread across a repository. This skill inventories assets, checks OSV.dev, and drafts prioritized remediation reports.
Security & Compliance View