Menu
Scoped host-level reconnaissance with the bundled Nmap distribution. Use when the operator explicitly asks for nmap, port scanning, service enumeration, host reachability checks, or low-risk host discovery on authorized targets.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Scoped web content discovery with the bundled dirsearch source tree. Use when the operator explicitly asks for dirsearch, directory enumeration, hidden file discovery, content brute forcing, or low-risk path discovery on authorized HTTP or HTTPS targets.
DNS out-of-band (OOB) reflection / exfiltration via CEYE platform. Use when the operator asks for DNS OOB testing, out-of-band data exfiltration, blind injection verification via DNS, or CEYE record queries.
Safe first-pass web reconnaissance workflow for browser-assisted pentesting. Use when starting assessment on a web app, mapping exposed pages and flows, collecting passive evidence, or deciding whether deeper scripted discovery such as dirsearch, nmap, or sqlmap is justified.
Scoped SQL injection verification with the bundled sqlmap source tree. Use when the operator explicitly asks for sqlmap, SQL injection testing, raw HTTP request replay, form or anti-CSRF-aware injectable parameter verification, or conservative database fingerprinting and schema enumeration on authorized HTTP or HTTPS targets.
| name | nmap-recon |
| description | Scoped host-level reconnaissance with the bundled Nmap distribution. Use when the operator explicitly asks for nmap, port scanning, service enumeration, host reachability checks, or low-risk host discovery on authorized targets. |
| activation | auto |
| version | 1.0 |
| tags | ["recon","network","port-scan"] |
| requires_tools | ["list_skill_scripts","run_skill_script"] |
| requires_bins | ["nmap"] |
| when_to_use | When the operator asks for port scanning, service enumeration, host discovery, or nmap-related tasks. |
Use this skill for low-risk host reconnaissance inside the authorized scope.
list_skill_scripts(skill_name="nmap-recon") if you need to confirm the packaged script names.scripts/nmap_status.py through run_skill_script first to confirm the bundled binary is available.scripts/nmap_scan.py through run_skill_script for actual scans.top_ports before broad ports ranges.service_version=true when service fingerprinting matters.os_detection=false unless the operator clearly needs OS guesses.skip_host_discovery=true as a fallback for hosts that block ping discovery.artifacts/.../nmap/ and summarize only evidence-backed conclusions.scripts/ directory is for deterministic helper logic. Use list_skill_scripts to inspect it.run_skill_script(skill_name="nmap-recon", script_name="nmap_scan.py", args_json='["--target","app.example.internal","--top-ports","20"]') is the preferred scan entrypoint.nmap_scan.py enforces scope, rejects CIDR ranges, and records structured artifacts..xml, .txt, and .json, plus an nmap-log.jsonl audit trail.ok=false, inspect stderr, parse_error, and the saved text output before concluding the host is unreachable.