Agent skill · security · aiskillstore
nmap
Professional network reconnaissance and port scanning using nmap. Supports various scan types (quick, full, UDP, stealth), service detection, vulnerability scanning, and NSE scripts. Use when you need to enumerate network services, detect versions, or perform network reconnaissance.
Why this skill is useful
Adds executable scripts for network reconnaissance and port scanning that automate complex nmap workflows and error handling.
What it needs
Requires nmap installed locally. About 9k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Nmap Scan - Professional Network Reconnaissance You are helping the user perform professional network reconnaissance and port scanning using nmap. This skill provides guidance for various scan types, output formats, and result analysis. Output Directory Directory Structure IMPORTANT: Always save nmap output to an organized directory structure. By default, use ./nmap-output/ or specify a custom directory. Default Scanning Strategy IMPORTANT: Unless the user explicitly requests a different scan type, ALWAYS use this two-phase approach: Phase 1: Fast Port Discovery (Root SYN Scan) Why sudo: Running as root enables fast SYN scan (-sS is implicit) Why -p-: Scans all 65535 ports quickly Duration: Typically 1-3 minutes for SYN scan Output: List of all open ports Host Down Detection: If the scan output contains "Note: Host seems down", automatically retry with: -Pn: Skip host discovery, treat host as online Use this when firewalls block ping probes Phase 2: Targeted Service Detection After Phase 1 completes, parse the open ports and run: -p <OPENPORTLIST>: Only scan the ports found to be open (e.g., -p 23,80,443,554,8000) -sV: Service version detection -sC: Run default NSE scripts for additional enumeration Duration: Usually 1-3 minutes since only scanning known open ports Why This Strategy? 1. Speed: Fast SYN scan finds all open ports in 1-3 minutes 2. Thoroughness: Covers all 65535 ports, not just top 1000 3. Efficiency: Service detection only runs on confirmed open ports 4. Accuracy: Two-phase approach reduces false negatives Parsing Open Ports After Phase 1, extract open ports using: Or parse from .nmap file (matches the STATE column exactly, so open filtered ports are excluded): Implementation Workflow When the nmap-scan skill is invoked: 1. Create output directory 2. Run Phase 1: Fast port discovery 3. Check for "Host seems down" error 4. Parse open ports from results 5. Run Phase 2: Service detection on open ports 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/nmap