ClawHub
Back to skill

Security audit

Nmap Recon

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Nmap reconnaissance skill with real dual-use risk, but the reviewed evidence fits its stated security-assessment purpose and includes authorization warnings.

Install only if you intend to perform authorized security assessment. Before using it, confirm the target, scope, and permission, and avoid public or third-party systems unless you have explicit written approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The description contains broad activation phrases such as 'scan [target]', 'port scan', 'nmap', 'recon', and 'what ports are open', which can cause the skill to trigger in many loosely related contexts. Because this skill performs active network reconnaissance with a security tool, overbroad routing increases the chance of unintended use against arbitrary targets or accidental invocation during general security discussions.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Content
### Quick Scan (Top 1000 ports)
```bash
nmap -sC -sV -oA scan_$(date +%Y%m%d_%H%M%S) TARGET
```

### Full Port Scan
Confidence
95% confidence
Finding
nmap -s; nmap -p; nmap -s; nmap -s; nmap -A; nmap -s; nmap -p; nmap -s; nmap -A; nmap -s; nmap -o; nmap -p

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.