skills/wgpsec/aboutsecurity/nmap-scan/Gen Agent Trust Hub

nmap-scan

Warn

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for executing nmap with administrative privileges using sudo. This is used for advanced network probing features such as SYN stealth scanning (-sS), operating system fingerprinting (-O), and firewall bypass via packet fragmentation (-f).
  • [COMMAND_EXECUTION]: The documentation includes templates for the Nmap Scripting Engine (NSE) to perform active vulnerability scanning (--script vuln) and service brute-forcing (--script ssh-brute).
  • [COMMAND_EXECUTION]: The skill exhibits an indirect injection surface as it interpolates untrusted user data (target hostnames/IPs) directly into shell command templates.
  • Ingestion points: Target parameters in file SKILL.md (e.g., target.com).
  • Boundary markers: None present; commands are executed directly in the shell.
  • Capability inventory: Full shell access to execute nmap with sudo privileges.
  • Sanitization: No evidence of input validation or escaping for the target input before shell execution.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 16, 2026, 03:13 AM
Security Audit — agent-trust-hub — nmap-scan