nmap-pentest-scans

Plan and orchestrate authorized Nmap host discovery, port and service enumeration, NSE profiling, and reporting artifacts for in-scope targets.

3,891 stars
Complexity: medium

About this skill

This skill is designed to streamline and standardize Nmap-based penetration testing activities. It guides an AI agent through the process of defining scan objectives, selecting appropriate Nmap profiles (stealth, balanced, fast), and executing scans against specified, authorized targets. The skill ensures that all actions adhere to a predefined scope and requires explicit authorization for live execution. It produces a suite of structured outputs, including a detailed `scan-plan.json`, a list of `recommended-commands.txt`, normalized `nmap-pentest-findings.json`, and a comprehensive `nmap-pentest-scans-report.json`. These artifacts facilitate integration into broader reporting, compliance checks, or subsequent analysis workflows. Users would employ this skill to ensure consistency, reduce manual errors, and accelerate the initial reconnaissance phase of a penetration test. It provides structured outputs, making it easier to integrate Nmap results into broader reporting or subsequent analysis workflows, while also enforcing ethical and legal boundaries through its authorization requirements.

Best use case

The primary use case for this skill is automating the initial discovery and enumeration phases of a penetration test or vulnerability assessment. It enables security teams and AI-powered penetration testing agents to conduct Nmap scans systematically, ensuring all activities are within an authorized scope and producing standardized output artifacts for further analysis and reporting. Cybersecurity professionals and ethical hackers benefit most from this skill by gaining efficiency and consistency in their reconnaissance efforts.

Plan and orchestrate authorized Nmap host discovery, port and service enumeration, NSE profiling, and reporting artifacts for in-scope targets.

The user should expect structured JSON and Markdown reports detailing the scan plan, recommended commands, and normalized Nmap findings, all within the authorized scope.

Practical example

Example input

Initiate a Nmap pentest scan for `192.168.1.100` following a 'fast' profile, using the `scope.json` file for authorization and outputting all artifacts to `reports/nmap_scan_results`.

Example output

A `scan-plan.json` detailing the chosen profile and commands, a `nmap-pentest-findings.json` containing normalized host and service enumeration results (e.g., open ports, service versions), and a comprehensive `nmap-pentest-scans-report.json` summarizing the entire operation.

When to use this skill

  • Performing authorized network reconnaissance on defined targets.
  • Automating repeatable Nmap scanning tasks in a penetration test.
  • Generating standardized host discovery and port enumeration reports.
  • Ensuring Nmap activities adhere to a specific scope and authorization.

When not to use this skill

  • Scanning unauthorized networks or systems.
  • Requiring highly customized, ad-hoc Nmap commands outside predefined profiles.
  • When deep manual analysis of raw Nmap output is preferred over structured findings.
  • On production systems without prior dry-run or explicit authorization due to potential disruption.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/nmap-pentest-scans/SKILL.md --create-dirs "https://raw.githubusercontent.com/openclaw/skills/main/skills/0x-professor/nmap-pentest-scans/SKILL.md"

Manual Installation

  1. Download SKILL.md from GitHub
  2. Place it in .claude/skills/nmap-pentest-scans/SKILL.md inside your project
  3. Restart your AI agent — it will auto-discover the skill

How nmap-pentest-scans Compares

Feature / Agentnmap-pentest-scansStandard Approach
Platform SupportNot specifiedLimited / Varies
Context Awareness High Baseline
Installation ComplexitymediumN/A

Frequently Asked Questions

What does this skill do?

Plan and orchestrate authorized Nmap host discovery, port and service enumeration, NSE profiling, and reporting artifacts for in-scope targets.

How difficult is it to install?

The installation complexity is rated as medium. You can find the installation instructions above.

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

Related Guides

SKILL.md Source

# Nmap Pentest Scans

## Stage

- PTES: 2-3
- MITRE: TA0007 - Discovery

## Objective

Design reproducible Nmap scan workflows for authorized targets and produce deterministic scan-plan artifacts.

## Required Workflow

1. Validate scope before any active action and reject out-of-scope targets.
2. Require explicit authorization for non-dry-run execution.
3. Select profile (stealth, balanced, fast) and build command sequence.
4. Produce normalized findings and export deterministic artifacts.

## Execution

```bash
python skills/nmap-pentest-scans/scripts/nmap_pentest_scans.py --scope scope.json --target <target> --input <path> --output <path> --format json --dry-run
```

## Outputs

- `scan-plan.json`
- `scan-plan.md`
- `recommended-commands.txt`
- `findings/nmap-pentest-findings.json`
- `nmap-pentest-scans-report.json`

## References

- `references/tools.md`
- `references/scan-profiles.md`
- `skills/autonomous-pentester/shared/scope_schema.json`
- `skills/autonomous-pentester/shared/finding_schema.json`

## Legal and Ethical Notice

```text
WARNING AUTHORIZED USE ONLY
This skill prepares and can orchestrate live network scan workflows.
Use only with written authorization and approved scope.
```

Related Skills

pentest-c2-operator

3891
from openclaw/skills

Set up authorized C2 simulation workflows and measure defensive detection outcomes.

Security

pentest-auth-bypass

3891
from openclaw/skills

Test authentication and session management controls for bypass and account takeover scenarios.

Security

pentest-api-attacker

3891
from openclaw/skills

Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.

Security

pentest-active-directory

3891
from openclaw/skills

Assess Active Directory identity attack paths including roasting, relay, and delegation abuse.

Security

HIPAA Compliance for AI Agents

3891
from openclaw/skills

Generate HIPAA compliance checklists, risk assessments, and audit frameworks for healthcare organizations deploying AI agents.

Security

Data Governance Framework

3891
from openclaw/skills

Assess, score, and remediate your organization's data governance posture across 6 domains.

Security

Cybersecurity Risk Assessment

3891
from openclaw/skills

You are a cybersecurity risk assessment specialist. When the user needs a security audit, threat assessment, or compliance review, follow this framework.

Security

afrexai-cybersecurity-engine

3891
from openclaw/skills

Complete cybersecurity assessment, threat modeling, and hardening system. Use when conducting security audits, threat modeling, penetration testing, incident response, or building security programs from scratch. Works with any stack — zero external dependencies.

Security

Compliance & Audit Readiness Engine

3891
from openclaw/skills

Your AI compliance officer. Guides startups and scale-ups through SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS — from zero to audit-ready. No consultants needed.

Security

Compliance Audit Generator

3891
from openclaw/skills

Run internal compliance audits against major frameworks without hiring a consultant.

Security

AI Safety Audit

3891
from openclaw/skills

Comprehensive AI safety and alignment audit framework for businesses deploying AI agents. Built around the UK AI Security Institute Alignment Project standards (2026), EU AI Act requirements, and NIST AI RMF.

Security

clickhouse-github-forensics

3891
from openclaw/skills

Query GitHub event data via ClickHouse for supply chain investigations, actor profiling, and anomaly detection. Use when investigating GitHub-based attacks, tracking repository activity, analyzing actor behavior patterns, detecting tag/release tampering, or reconstructing incident timelines from public GitHub data. Triggers on GitHub supply chain attacks, repo compromise investigations, actor attribution, tag poisoning, or "query github events".

Security