Nmap Pentest Scans

• Verdict: Pass
• Analyzed: May 11, 2026, 5:00 AM
• Findings: 0
• Version: 0.1.0
• Hash: 3c4c5ce4813320c8b0f77fd5c399846512ea23b99c3bf14cdad76c4ee367cf0f
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: nmap-pentest-scans Version: 0.1.0 The `scripts/nmap_pentest_scans.py` script constructs Nmap commands by directly embedding the user-provided `--target` argument into f-strings without proper shell escaping. This creates a critical shell injection vulnerability. If the AI agent, which is instructed to 'run' these scans via `agents/openai.yaml`, executes the generated commands (e.g., from `recommended-commands.txt` or `scan-plan.json`), a malicious target input could lead to arbitrary command execution on the host running the agent. While the skill includes authorization and scope validation, these do not mitigate the shell injection risk from a malformed but in-scope target.