Nmap Recon

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

This is a coherent Nmap scanning helper, but it needs review because it provides broad, privileged, and evasive network-scanning commands without enough target validation or confirmation controls.

Install only if you intend to perform authorized network assessment. Require an explicit target, confirm authorization before each scan, avoid sudo and stealth/evasion modes unless truly needed, and validate targets as hostnames/IPs/CIDRs before running any generated command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:17

Finding

Unvalidated Target Substitution Can Enable Shell Command Injection

Content

View full analysis

/tmp/nmap-skill-proof # ``` into the fast-scan template would produce: ```bash nmap -F -T4 127.0.0.1; id > /tmp/nmap-skill-proof # ``` The shell would run both Nmap and the injected `id` command. The issue is especially sensitive around the documented `sudo` profiles. An injected command is not automatically elevated merely because `sudo nmap` appears earlier in the command; however, unsafe command construction combined with a privileged agent pro ...[truncated 1804 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 93% confidence

Finding

This skill is centered on Nmap, a legitimate administrative tool that is also widely used for offensive reconnaissance, including vulnerability discovery, service enumeration, and evasive scanning. In this context the danger is elevated because the skill provides ready-to-run commands for stealth, vuln, and aggressive scans, materially enabling dual-use offensive activity if invoked against unauthorized targets.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

services, check for vulnerabilities, or perform network reconnaissance.

Triggers

• "scan [target]", "port scan", "nmap", "what ports are open", "recon [target]", "service detection", "vulnerability scan"

Requirements

• nmap must be installed (standard on Kali, available via package managers)
• Root/sudo for SYN scans and OS detection

Usage

Quick Scan (Top 1000 ports)

bash

nmap -sC -sV -oA scan_$(date +%Y%m%d_%H%M%S) TARGET

Full Port Scan

bash

nmap -p- -sC -sV -oA fullscan_$(date +%Y%m%d_%H%M%S) TARGET

Fast Scan (Quick check)

bash

nmap -F -T4 TARGET

Stealth SYN Scan (requires root)

bash

sudo nmap -sS -sV -O -oA stealth_$(date +%Y%m%d_%H%M%S) TARGET

UDP Scan (Top 100 ports)

bash

sudo nmap -sU --top-ports 100 -oA udp_$(date +%Y%m%d_%H%M%S) TARGET

Vulnerability Scan

bash

nmap --script vuln -oA vulnscan_$(date +%Y%m%d_%H%M%S) TARGET

Aggressive Scan (OS, version, scripts, traceroute)

bash

nmap -A

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger examples include broad phrases such as "port scan," "what ports are open," and especially "service detection" and "vulnerability scan," which are generic enough to overlap with many security-related conversations. The skill does not provide exclusion conditions or scope limits to clarify when these phrases should invoke this skill versus another scanning or analysis skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill explicitly states that root/sudo may be required, normalizing privileged execution for network scanning tasks. While technically accurate for some Nmap features, encouraging elevation increases the chance that an agent or user runs commands with unnecessary privileges, amplifying damage if parameters are misused or combined with other unsafe behavior.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

## Requirements

- `nmap` must be installed (standard on Kali, available via package managers)
- Root/sudo for SYN scans and OS detection

## Usage

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This command instructs running a stealth SYN scan with sudo, combining privileged execution with evasive reconnaissance behavior. In an agent setting, this is dangerous because it facilitates higher-risk network probing under elevated privileges, which can increase both system and legal/security exposure.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Stealth SYN Scan (requires root)

bash

sudo nmap -sS -sV -O -oA stealth_$(date +%Y%m%d_%H%M%S) TARGET

UDP Scan (Top 100 ports)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The UDP scan example requires sudo and can generate broad privileged probing of network services. In the hands of an autonomous or insufficiently constrained agent, this expands the blast radius of misuse and may expose the host running the skill to unnecessary privilege-related risk.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

UDP Scan (Top 100 ports)

bash

sudo nmap -sU --top-ports 100 -oA udp_$(date +%Y%m%d_%H%M%S) TARGET

Vulnerability Scan

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Including a sudo-based 'Stealth' profile in the quick reference table makes privileged evasive scanning easy to select and reuse. This lowers friction for risky behavior and may encourage use of elevated, stealth-oriented commands without adequate review or authorization.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

| Quick | `nmap -F -T4` | Fast initial recon |
| Standard | `nmap -sC -sV` | Service detection + default scripts |
| Full | `nmap -p- -sC -sV` | All 65535 ports |
| Stealth | `sudo nmap -sS -T2` | Evasive scanning |
| Vuln | `nmap --script vuln` | Vulnerability detection |
| Aggressive | `nmap -A -T4` | Full enumeration |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

Never scan:
- Public infrastructure without permission
- Networks you don't control
- Production systems without approval

## Example Workflow

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description includes broad activation phrases such as 'scan [target]', 'nmap', 'recon', and 'what ports are open', which can cause the skill to trigger in loosely related conversations. Because this skill performs network reconnaissance with a security tool, unintended activation could lead to unauthorized or surprise scanning of systems the user did not clearly intend to target.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description advertises port scanning, service detection, and vulnerability identification but provides no warning that these actions may be sensitive, disruptive, or unauthorized in many environments. Without clear notice and authorization guidance, users may invoke the skill in inappropriate contexts, increasing the risk of policy violations, legal issues, or scanning of third-party infrastructure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.