此报告尚无所请求语言的翻译，当前显示规范英文报告。
版本化安全评估
报告编号: SA-D46E6208
7/7/2026, 9:28:22 PM
recon-nmap 安全评估 v8
Skill 安全认证报告
审计模型: codex 历史报告
- 技能名称
- recon-nmap
- 版本
- v8
- 维护者
- AgentSecOps
- 覆盖范围
- 6 已扫描文件 · 2,165 分析行数
- 策略版本
- 不可用
已确认问题的最高严重性
严重
有 134 个已确认的安全问题需要处理。
安装上下文
历史证据
本报告可能无法描述当前可安装的 artifact。请打开当前 Skill 详情页查看安装建议。
打开当前 Skill 详情页本报告不会阻止或授权 manifest 或 ZIP。
Confirmed risks center on intentional Nmap reconnaissance, privileged scan examples, Metasploit handoff, intrusive NSE scripts, high-speed scanning, and firewall or IDS evasion guidance in SKILL.md. Most findings in templates and examples are false positives because they are documentation, public references, or educational snippets. No evidence found of prompt injection in the reviewed files.
报告位置
历史报告
使用本报告安装前，请先查看审计历史。
审计证明
无法签发证明
所需的不可变绑定不完整。
人工验证
未进行人工验证
本报告没有人工验证记录。
覆盖范围
6 已扫描文件 · 2,165 分析行数
有 150 项内容需要查看
局限
本报告不声称进行了运行时或沙箱执行，也不证明不存在副作用。
证据链
证据从来源绑定延伸到安装契约。证据可用于验证，但不是安全保证。
来源
绑定不可用
构件
身份信息不完整
审计
已完成
观察到的能力
“已观察到”表示本报告记录了支持证据；“未记录”不证明该能力不存在。
包含脚本
可能执行 Skill 随附的代码。
在 2 个证据位置观察到
网络访问
可能连接外部服务。
在 27 个证据位置观察到
文件系统访问
可能读取或写入本地文件。
在 2 个证据位置观察到
环境变量
可能读取进程环境中的值。
在 18 个证据位置观察到
外部命令
可能调用 Skill 之外的命令或程序。
在 82 个证据位置观察到
能力复核项 (16)
高
Hardcoded URL
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The URL is used as the source for a remote installer that is executed by the shell. The fixed remote dependency contributes to supply-chain risk.
高
Git platform tokens
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
The workflow exposes GITHUB_TOKEN to a third-party security action. This may be necessary, but it is still a sensitive repository token handling risk.
高
sudo privilege escalation
sudo nmap -sS <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -sU -p 53,161,500 <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -A <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -O <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -A <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -O --osscan-limit <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -O --osscan-guess <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -f <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -D RND:10 <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -sI <zombie-host> <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
高
sudo privilege escalation
sudo nmap -f <target-ip>
The example runs Nmap with sudo or raw-packet privileges. Privileged scans increase misuse impact and can affect network or host behavior.
风险问题
已确认的安全问题与仍需审核的项目分开展示。
已确认安全问题 (134)
RISK-001 严重
Pipe to shell pattern
curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash
The CI template downloads a remote install script and pipes it directly to bash. This is a real supply-chain execution risk if the source or network path is compromised.
RISK-002 严重
Metasploit framework
- **Metasploit Integration**: Import Nmap XML with `db_import`
The line recommends importing Nmap output into Metasploit. This links reconnaissance results to offensive exploitation tooling.
RISK-003 严重
Stealth and Firewall Evasion Guidance
The skill provides techniques to evade IDS and firewall controls, including packet fragmentation, decoys, source spoofing, idle scans, source-port selection, and splitting scans over time.
The referenced sections are explicitly titled around evasion and blocked scans, and the commands describe stealth and bypass methods. This is clear offensive tradecraft despite authorization disclaimers.
RISK-004 高
System reconnaissance
# Paranoid (0) - Extremely slow, IDS evasion
The line describes IDS evasion or delayed scanning. Evasion guidance is a real offensive risk even when framed as authorized testing.
RISK-005 高
System reconnaissance
# Scan with delays to avoid detection
The line describes IDS evasion or delayed scanning. Evasion guidance is a real offensive risk even when framed as authorized testing.
RISK-006 高
Network scanning tools
name: recon-nmap
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-007 高
Network scanning tools
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration,
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-008 高
Network scanning tools
tags: [reconnaissance, nmap, port-scanning, service-enumeration, network-security, osint]
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-009 高
Network scanning tools
packages: [nmap]
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-010 高
Network scanning tools
tools: [python3, masscan]
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-011 高
Network scanning tools
- https://nmap.org/book/
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-012 高
Network scanning tools
- https://nmap.org/nsedoc/
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-013 高
Network scanning tools
# Nmap Network Reconnaissance
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-014 高
Network scanning tools
Nmap (Network Mapper) is the industry-standard tool for network discovery, security auditing, and vu
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-015 高
Network scanning tools
nmap -F <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-016 高
Network scanning tools
nmap -sV <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-017 高
Network scanning tools
nmap -A <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-018 高
Network scanning tools
nmap -sn <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-019 高
Network scanning tools
nmap -sn -PR <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-020 高
Network scanning tools
nmap -sn -PS22,80,443 <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-021 高
Network scanning tools
nmap -sn -PU53,161 <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-022 高
Network scanning tools
nmap -Pn <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-023 高
Network scanning tools
nmap -sn <target-network>/24 -oG - | awk '/Up$/{print $2}' > live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-024 高
Network scanning tools
nmap -F -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-025 高
Network scanning tools
nmap -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-026 高
Network scanning tools
nmap -p- -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-027 高
Network scanning tools
nmap -p 22,80,443,3389,8080 -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-028 高
Network scanning tools
nmap -p 1-1024,3000-9000 -iL live_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-029 高
Network scanning tools
sudo nmap -sS <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-030 高
Network scanning tools
nmap -sT <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-031 高
Network scanning tools
sudo nmap -sU -p 53,161,500 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-032 高
Network scanning tools
nmap -sV <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-033 高
Network scanning tools
sudo nmap -A <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-034 高
Network scanning tools
nmap -T0 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-035 高
Network scanning tools
nmap -T1 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-036 高
Network scanning tools
nmap -T2 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-037 高
Network scanning tools
nmap -T3 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-038 高
Network scanning tools
nmap -T4 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-039 高
Network scanning tools
nmap -T5 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-040 高
Network scanning tools
nmap --max-rate 100 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-041 高
Network scanning tools
nmap --min-rate 10 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-042 高
Network scanning tools
nmap --scan-delay 1s <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-043 高
Network scanning tools
nmap -sV <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-044 高
Network scanning tools
nmap -sV --version-intensity 5 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-045 高
Network scanning tools
nmap -sV --version-intensity 0 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-046 高
Network scanning tools
nmap -sV -p 80,443 --script=http-headers,http-title <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-047 高
Network scanning tools
nmap -p 445 --script=smb-os-discovery,smb-security-mode <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-048 高
Network scanning tools
nmap -p 22 --script=ssh-hostkey,ssh-auth-methods <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-049 高
Network scanning tools
nmap -p 53 --script=dns-nsid,dns-recursion <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-050 高
Network scanning tools
nmap -p 80,443 --script=http-methods,http-robots.txt,http-title <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-051 高
Network scanning tools
nmap -p 3306 --script=mysql-info <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-052 高
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-053 高
Network scanning tools
nmap -p 1433 --script=ms-sql-info <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-054 高
Network scanning tools
sudo nmap -O <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-055 高
Network scanning tools
sudo nmap -A <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-056 高
Network scanning tools
sudo nmap -O --osscan-limit <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-057 高
Network scanning tools
sudo nmap -O --osscan-guess <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-058 高
Network scanning tools
Nmap Scripting Engine for advanced reconnaissance and vulnerability detection:
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-059 高
Network scanning tools
nmap -sC <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-060 高
Network scanning tools
nmap --script=vuln <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-061 高
Network scanning tools
nmap --script=exploit <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-062 高
Network scanning tools
nmap --script=discovery <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-063 高
Network scanning tools
nmap --script=http-sql-injection <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-064 高
Network scanning tools
nmap --script=smb-vuln-ms17-010,smb-vuln-cve-2017-7494 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-065 高
Network scanning tools
nmap --script=http-brute --script-args http-brute.path=/admin <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-066 高
Network scanning tools
nmap -p 445 --script=smb-vuln-ms17-010 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-067 高
Network scanning tools
nmap -p 443 --script=ssl-heartbleed <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-068 高
Network scanning tools
nmap --script=http-shellshock --script-args uri=/cgi-bin/test.sh <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-069 高
Network scanning tools
nmap -p 443 --script=ssl-enum-ciphers <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-070 高
Network scanning tools
nmap -p 80 --script=http-sql-injection <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-071 高
Network scanning tools
nmap -p 21 --script=ftp-anon <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-072 高
Network scanning tools
nmap <target-ip> -oN scan_results.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-073 高
Network scanning tools
nmap <target-ip> -oX scan_results.xml
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-074 高
Network scanning tools
nmap <target-ip> -oG scan_results.gnmap
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-075 高
Network scanning tools
nmap <target-ip> -oA scan_results
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-076 高
Network scanning tools
nmap <target-ip> -oS scan_results.skid
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-077 高
Network scanning tools
xsltproc /usr/share/nmap/nmap.xsl scan_results.xml -o report.html
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-078 高
Network scanning tools
sudo nmap -f <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-079 高
Network scanning tools
sudo nmap -D RND:10 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-080 高
Network scanning tools
sudo nmap -D decoy1,decoy2,ME,decoy3 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-081 高
Network scanning tools
sudo nmap -S <spoofed-ip> -e <interface> <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-082 高
Network scanning tools
nmap --randomize-hosts -iL targets.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-083 高
Network scanning tools
nmap --proxies http://proxy:8080 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-084 高
Network scanning tools
sudo nmap -sI <zombie-host> <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-085 高
Network scanning tools
- Nmap command-line arguments used
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-086 高
Network scanning tools
nmap -sn -PE -PS80,443 -PA3389 <external-network>/24 -oG - | awk '/Up$/{print $2}' > external_hosts.
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-087 高
Network scanning tools
nmap -Pn -sV -p 21,22,25,53,80,110,143,443,587,993,995,3389,8080,8443 -iL external_hosts.txt -oA ext
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-088 高
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080,8443 -iL external_hosts.txt -oA external_vul
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-089 高
Network scanning tools
nmap -Pn -p 443,8443 --script=ssl-enum-ciphers,ssl-cert -iL external_hosts.txt -oA ssl_audit
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-090 高
Network scanning tools
nmap -sn -PR <internal-network>/24 -oG - | awk '/Up$/{print $2}' > internal_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-091 高
Network scanning tools
nmap -sV -p- -T4 -iL internal_hosts.txt -oA internal_full_scan
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-092 高
Network scanning tools
sudo nmap -O -iL internal_hosts.txt -oA internal_os_detection
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-093 高
Network scanning tools
nmap -sV --script=default,discovery -iL internal_hosts.txt -oA internal_services
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-094 高
Network scanning tools
nmap -p 80,443,8000,8080,8443 --open -oG - <target-network>/24 | grep 'open' | awk '{print $2}' > we
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-095 高
Network scanning tools
nmap -sV -p 80,443,8080,8443 --script=http-enum,http-headers,http-methods,http-title,http-server-hea
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-096 高
Network scanning tools
nmap -p 80,443 --script=http-sql-injection,http-csrf,http-vuln-cve2017-5638 -iL web_servers.txt -oA
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-097 高
Network scanning tools
nmap -p 445 --open <target-network>/24 -oG - | grep 'open' | awk '{print $2}' > smb_hosts.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-098 高
Network scanning tools
nmap -p 445 --script=smb-protocols,smb-security-mode,smb-os-discovery -iL smb_hosts.txt -oA smb_enum
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-099 高
Network scanning tools
nmap -p 445 --script=smb-vuln* -iL smb_hosts.txt -oA smb_vulns
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-100 高
Network scanning tools
nmap -p 445 --script=smb-enum-shares,smb-enum-users -iL smb_hosts.txt -oA smb_shares
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-101 高
Network scanning tools
nmap -sV -p 1433,1521,3306,5432,5984,6379,9200,27017 <target-network>/24 -oA database_scan
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-102 高
Network scanning tools
nmap -p 3306 --script=mysql-info,mysql-databases,mysql-variables <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-103 高
Network scanning tools
nmap -p 5432 --script=pgsql-brute <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-104 高
Network scanning tools
nmap -p 27017 --script=mongodb-info,mongodb-databases <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-105 高
Network scanning tools
nmap -p 6379 --script=redis-info <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-106 高
Network scanning tools
nmap -Pn -sV --script=vuln -p 21,22,25,80,443,3389,8080 \
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-107 高
Network scanning tools
if grep -i "VULNERABLE" "$OUTPUT_DIR/security_scan.nmap"; then
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-108 高
Network scanning tools
- **Metasploit Integration**: Import Nmap XML with `db_import`
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-109 高
Network scanning tools
- **Vulnerability Scanners**: Feed Nmap results to Nessus, OpenVAS, Qualys
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-110 高
Network scanning tools
- **SIEM Integration**: Parse Nmap output for security monitoring
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-111 高
Network scanning tools
Map Nmap reconnaissance to ATT&CK framework:
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-112 高
Network scanning tools
nmap -Pn <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-113 高
Network scanning tools
nmap -PS80,443 -PA3389 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-114 高
Network scanning tools
nmap -PE -PS22,80,443 -PA3389 -PU53,161 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-115 高
Network scanning tools
nmap -T4 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-116 高
Network scanning tools
nmap -F <target-ip> # Top 100 ports
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-117 高
Network scanning tools
nmap --top-ports 1000 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-118 高
Network scanning tools
nmap -T4 192.168.1.1-50 &
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-119 高
Network scanning tools
nmap -T4 192.168.1.51-100 &
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-120 高
Network scanning tools
nmap -T4 192.168.1.101-150 &
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-121 高
Network scanning tools
# Use masscan for very fast port scanning
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-122 高
Network scanning tools
masscan -p 1-65535 --rate 10000 <target-network>/24
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-123 高
Network scanning tools
nmap -T1 --scan-delay 1s <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-124 高
Network scanning tools
sudo nmap -f <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-125 高
Network scanning tools
nmap --randomize-hosts -iL targets.txt
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-126 高
Network scanning tools
nmap -g 53 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-127 高
Network scanning tools
nmap -p 1-1000 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-128 高
Network scanning tools
nmap -p 1001-2000 <target-ip>
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-129 高
Network scanning tools
Organizations can detect Nmap scanning by:
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-130 高
Network scanning tools
- [Nmap Network Scanning Official Guide](https://nmap.org/book/)
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-131 高
Network scanning tools
- [NSE Script Documentation](https://nmap.org/nsedoc/)
The skill intentionally teaches Nmap host discovery, port scanning, service enumeration, and vulnerability scanning. This is real dual-use reconnaissance capability against network targets.
RISK-132 高
Intrusive NSE Exploit and Brute-Force Guidance
The skill recommends Nmap NSE categories and scripts for exploit attempts, brute-force checks, SQL injection testing, SMB vulnerability checks, and other intrusive activity.
The guidance names exploit, brute, dos, fuzzer, intrusive, and vulnerability script categories and gives concrete examples. Legitimate assessment use is possible, but misuse risk is direct.
RISK-133 高
High-Speed Broad Network Scanning Guidance
The skill advises parallel subnet scanning and Masscan usage at a high packet rate, which can enable large-scale unauthorized discovery or service disruption.
The section gives concrete performance tuning and Masscan guidance for broad scans. It is dual-use, but the scale and speed create a clear marketplace risk.
RISK-134 低
System reconnaissance
nmap <target-ip> -oS scan_results.skid
The line is part of an active Nmap output workflow. The specific pattern is weak, but the context still supports network reconnaissance use.
补救措施
本次审计记录了建议的修复措施。实施这些措施是维护者的责任。
- FIX-001严重Firewall and IDS evasion guidanceRemove decoy, source spoofing, idle scan, source-port bypass, packet fragmentation, and delayed split-scan instructions from marketplace-facing content.
- FIX-002严重Metasploit integration referenceRemove Metasploit handoff guidance from the published skill unless the marketplace explicitly accepts offensive exploitation workflows.
- FIX-003严重Remote installer executed with curl pipe to shellReplace the pipe-to-shell installer with a pinned release, checksum verification, or a maintained GitHub Action.
- FIX-004高Intrusive NSE and brute-force examplesRemove exploit, brute-force, denial-of-service, fuzzer, and intrusive script examples, or restrict them to a clearly separated controlled-lab reference.
- FIX-005高Privileged scan commandsMinimize sudo examples and explain safer alternatives, least-privilege requirements, and approved environments for raw-packet scans.
- FIX-006中Authorization controls rely on proseAdd explicit refusal and scope-confirmation prompts before producing target-specific scan plans or commands.
专家证据
不可变主体身份、扫描器元数据、已排除匹配项和源码级证据。
Artifact 主体
- Marketplace 提交
- 不可用
- 内容哈希
- 不可用
- 目录树哈希
- 不可用
- Skill 路径
- 不可用
- 审计载荷哈希
- 不可用
分析元数据
审计模型: codex
分析状态: 已完成
范围仅限于已记录的文件、行数、方法和证据；本报告不声称进行了运行时或沙箱执行。
验证与导出
manifest 和 lockfile 将安装 artifact 绑定到加密哈希。该完整性声明独立于安全评估。
审计证明: not_attestable