codexskills.dev

Nmap Scanning skill for Codex

Right flags, honest reading of output. This skill runs authorized nmap scans with the least aggressive technique that answers the question, then interprets the output instead of dumping it: precise port states, version strings treated as leads not proof, and a prioritized service inventory. It keeps intrusive NSE categories behind explicit permission and respects rate limits.

  • Security
  • $nmap-scanning
  • 107 lines
  • 2 files
  • ~1,150 tokens
  • MIT
  • Updated

Install

curl -fsSL codexskills.dev/install.sh \  | sh -s -- nmap-scanning

Installs to ~/.agents/skills/nmap-scanning/ for every project on this machine.

Download nmap-scanning.zip

104-line POSIX script. No sudo, no telemetry. Read install.sh

Use it in Codex

Start a prompt with $nmap-scanning, or pick it from /skills. You can also just describe the task: Codex reads the description below and loads the playbook when your request matches.

What Codex reads before loading it

Runs authorized network scanning with nmap — host discovery, TCP/UDP port scans, service/version and OS detection, and NSE scripts — then interprets the results into a prioritized service inventory. Use when you have written permission to scan a network or host and need the right flags and a sane reading of the output. Not for scanning networks you do not own or lack authorization to assess.

Use it when

  • You have written permission to scan a host or network
  • You need the correct nmap flags for the task
  • You want open ports turned into prioritized leads

Use something else when

  • You still need to discover domains and assets first: use recon-osint
  • You are moving on to test a discovered web app: use web-app-pentest
  • You want deep TLS config testing beyond a cipher check: use tls-hardening

How to check the result

Re-scan surprising results with a second technique before reporting, and cross-check any version-to-vulnerability claim against an advisory rather than trusting the banner.

The mistake it prevents

Running aggressive -A or vuln/dos NSE scripts on everything up front, which is loud, can crash services, and may exceed the rules of engagement.

~/.agents/skills/nmap-scanning/SKILL.md

--- name: nmap-scanning description: Runs authorized network scanning with nmap — host discovery, TCP/UDP port scans, service/version and OS detection, and NSE scripts — then interprets… license: MIT ---

A scan is useful when it is accurate, scoped and read correctly. Default to the least aggressive scan that answers the question, confirm what is actually listening, and turn open ports into a prioritized list of things to look at — not a wall of output. Scan only what you are authorized to scan.

Gate 0 — authorization

Confirm written authorization and the exact in-scope IPs/ranges/hosts before scanning. Scanning hosts you do not own or lack permission for is out of bounds — stop and ask if scope is unclear. Nmap needs raw-socket/network access: Codex’s sandbox usually blocks this and most SYN/OS-detection scans need root/sudo, so call out when a step needs elevated access or network and let the user run it if the sandbox refuses.

Flag cheat sheet

GoalCommandNotes
Host discovery onlynmap -sn 10.0.0.0/24Ping sweep, no port scan
Fast top portsnmap -T4 --top-ports 100 <target>Quick triage
Full TCP default scannmap -sS -T4 -p- <target>SYN scan all 65535 ports (needs root)
Service + versionnmap -sV <target>Fingerprint what listens
OS + version + scriptsnmap -A <target>Loud; OS detect + default scripts + traceroute
UDP (slow, selective)nmap -sU --top-ports 50 <target>UDP is slow; limit ports
Default safe scriptsnmap -sC <target>Equivalent to --script=default
Save all formats-oA <basename>Writes .nmap/.gnmap/.xml for later parsing

A solid first pass on a host you may scan actively:

sudo nmap -sS -sV -T4 -p- --open -oA scans/host1 <target>   # all TCP ports, versions, open only

Then follow up selectively (UDP top ports, targeted NSE) rather than scanning everything aggressively up front.

Timing and stealth

  • -T0–-T2 are slow/quiet; -T3 default; -T4 fast on reliable networks; -T5 can drop results. Use -T4 for owned internal ranges; slow down on fragile or monitored ones.
  • Respect any rate limits in the RoE. --max-rate/--min-rate cap packet rate when the network is sensitive. Do not treat a scan as a stress test.

NSE scripts

Scripts extend nmap but some are intrusive. Know the categories:

  • safe / default — fine to run on in-scope hosts.
  • vuln — checks for known vulnerabilities (--script vuln); useful but can be noisy.
  • intrusive / dos / exploit / brute — only with explicit RoE permission; dos and exploit can crash services. Never run these without written sign-off.
nmap -sV --script "default and safe" <target>      # conservative
nmap -p 443 --script ssl-enum-ciphers <target>     # targeted: TLS config

Interpreting results

Do not hand over raw output. For each open port, record: port, protocol, service, version, and why it matters. State types precisely:

  • open = something is listening. filtered = a firewall dropped the probe (unknown). closed = reachable host, nothing listening. open|filtered = ambiguous (common on UDP).
  • Service/version is a guess from banners — confirm anything you will act on. A version string is a lead to check advisories, not proof of a vulnerability.
  • Flag the high-interest surface: management interfaces (SSH 22, RDP 3389, DBs 3306/5432/ 27017, Redis 6379, Elastic 9200), admin panels, outdated versions, and anything unexpected for the host’s role.

Verification

  • Re-scan a surprising result with a different technique (-sT vs -sS, or a targeted -p <port> -sV) before reporting it; firewalls and rate limits cause false readings.
  • Cross-check version→vulnerability claims against an advisory source; do not assert a CVE from a banner alone.
  • Confirm your target list matches the authorized scope before every active scan.

Output contract

## Nmap scan — <scope> (<date>)
Authorization: <ref>. Command(s): <exact commands>. Files: scans/<basename>.*

### Service inventory
| Host | Port | Proto | Service | Version | Interest |
|------|------|-------|---------|---------|----------|
| 10.0.0.5 | 22/tcp | ssh | OpenSSH 8.2 | mgmt |
| 10.0.0.5 | 5432/tcp | postgres | 14.1 | DB exposed — check access |

### Leads / next steps
- <host:port> — <why> — <which skill / check next>

Hard rules

  • Scan only in-scope hosts, confirmed before each run. No scope → stop.
  • Never run dos, exploit or brute NSE categories without explicit RoE permission.
  • Keep rates within the RoE; a scan is reconnaissance, not a load test.
  • Report port states precisely; never claim a vulnerability from a version banner alone.

What the zip contains

SKILL.md plus the interface file below. Nothing runs on install.

agents/openai.yamlgenerated from this page

Gives the Codex app a display name, a one-line description and a starter prompt for this skill.

interface:
  display_name: "Nmap Scanning"
  short_description: "Right flags, honest reading of output"
  default_prompt: "$nmap-scanning I'm authorized to scan this /24 — what nmap commands should I run?"

About this skill

Written and maintained by the Codex Skills editors to the same editorial standard as every skill here: a selective description, a real workflow, known pitfalls and a way to verify the work. First published , last updated . MIT licensed. Something wrong or out of date? Tell us.

Related skills

All 45 Security skills
esc