nmap-pentest-scans

What This Skill Does

The nmap-pentest-scans skill is a robust orchestration framework designed to automate the process of network reconnaissance, host discovery, and service enumeration within authorized pentesting environments. Acting as an interface for the powerful Nmap utility, this agentic skill allows security professionals to design, validate, and execute complex scanning workflows. It emphasizes reproducibility by generating deterministic scan-plan artifacts and ensuring that every action is mapped against a pre-validated scope schema. By automating the transition from target definition to actionable findings, it streamlines the Discovery phase of the PTES (Penetration Testing Execution Standard) and aligns with MITRE ATT&CK TA0007.

Installation

To integrate this capability into your OpenClaw environment, execute the following command in your terminal: clawhub install openclaw/skills/skills/0x-professor/nmap-pentest-scans Ensure that the local environment has Nmap installed and that your OpenClaw user permissions allow for network-level interactions.

Use Cases

This skill is intended for authorized security assessments where mapping network architecture and identifying exposed attack surfaces is required. Use cases include:

1. Infrastructure discovery for large-scale internal or external penetration tests.
2. Auditing segment security through stealth-based service profiling.
3. Automated reporting of service versions and open ports for vulnerability assessment workflows.

Example Prompts

1. "Perform a dry-run nmap scan on the target 192.168.1.0/24 using the balanced profile, and save the scan-plan to my workspace."
2. "Execute an authorized stealth scan on target-alpha.corp using the fast profile, then generate the nmap-pentest-scans-report.json in my outputs directory."
3. "Verify the scope defined in scope.json and perform full port enumeration on the target host 10.0.0.5 with NSE scripts enabled."

Tips & Limitations

Always conduct a dry-run first to validate your target scope against the scope_schema.json. This avoids accidental scanning of out-of-scope assets which could lead to service disruption. Ensure you have explicit written authorization before removing the --dry-run flag. While this skill provides excellent automation, it is limited by network connectivity, firewall egress/ingress restrictions, and the rate-limiting capabilities of the target environment. Always review the recommended-commands.txt generated before committing to a full-scale scan, as high-intensity scans can potentially cause instability on legacy hardware or sensitive industrial control systems.