Nmap Recon

What This Skill Does

The Nmap Recon skill provides a powerful interface for network exploration and security auditing directly within your OpenClaw environment. It leverages the industry-standard Nmap tool to perform comprehensive network reconnaissance. This skill enables you to discover live hosts, identify open ports, detect service versions, and probe for potential vulnerabilities. By automating the execution of various Nmap scan profiles—ranging from rapid discovery to deep-dive vulnerability assessment—it streamlines the initial phases of security testing and network troubleshooting. It also handles the output processing, providing you with readable summaries extracted from Nmap's raw data formats.

Installation

To integrate this skill into your OpenClaw agent, use the package manager command within your terminal environment. Ensure that Nmap is installed on your host system beforehand, as this skill acts as an interface layer for the underlying binary. Use the following command: clawhub install openclaw/skills/skills/nsahal/nmap-recon. Note that for advanced functionality, such as SYN stealth scans, OS detection, or specific protocol probes, the agent process or the system user must have root or sudo privileges available to ensure network packet manipulation capabilities are not restricted.

Use Cases

This skill is ideal for security professionals and network administrators conducting authorized penetration tests or asset discovery. Use it when you need to audit an internal network range for unauthorized services, map the attack surface of a specific target host, or verify if specific ports are exposed to the public. It is also highly effective for service inventory management, where you need to track which versions of software (e.g., Apache, SSH, SMB) are running across a server farm. Whether you are performing a quick triage scan or a full-blown vulnerability assessment, this skill adapts to your technical requirements.

Example Prompts

1. "Perform an aggressive scan on 192.168.1.50 to identify open services and potential vulnerabilities."
2. "Run a quick port scan on the target range 10.0.0.0/24 and extract a list of all open ports."
3. "Execute a full TCP port scan on scanme.nmap.org using the default scripts to detect service versions."

Tips & Limitations

Always ensure you have explicit written authorization before scanning any network target; unauthorized scanning is illegal and unethical. For large network ranges, prefer the -T4 timing template to maintain performance without overwhelming the target host or network infrastructure. Conversely, if you are working in an environment with strict IDS/IPS, use -T2 to remain subtle. Remember that Nmap's vulnerability detection scripts are not a replacement for specialized vulnerability scanners; use them as a preliminary indicator. Regularly clean up the scan output files generated in your workspace to maintain disk hygiene.