How do I install the Fofamap skill?

Run npx skillmds@latest add asaotomo/fofamap-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Fofamap safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Fofamap?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Fofamap free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Fofamap?

asaotomo (@asaotomo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Fofamap by asaotomo — Agent Skill

Name: Fofamap
Author: asaotomo

Fofamap

Use FofaMap to validate FOFA syntax, search and profile internet assets, aggregate statistics, export bounded results, and manage authorized scan plans through its MCP tools. Trigger for FOFA queries, external attack-surface discovery, host intelligence, favicon searches, asset inventory, exposure analysis, or FOFA result exports.

asaotomo Updated Sep 21, 2026

File contents

FofaMap

Use the FofaMap MCP server for evidence-based FOFA asset research. Prefer the MCP tools over shell commands when they are available.

Workflow

Clarify the target, ownership or authorization boundary, desired fields, time range, and result limit when these materially affect the request. Call fofa_account and fofa_fields when membership-dependent capabilities matter; these tools work even in hosts that do not expose MCP Resources.
If the user names a product, OA, VPN, middleware, database, camera, CMS, or ops panel, call fofa_rules before fofa_search. Use the returned query values verbatim. Do not invent app= names. An empty keyword lists the bundled catalog (no FOFA quota).
Call fofa_validate_query before spending FOFA quota. Repair invalid syntax before searching.
Call fofa_search for the first bounded page. Use the smallest useful field set and size.
Use fofa_search_next only when more records are needed, passing its opaque cursor unchanged.
Use fofa_host_profile only when fofa_account shows Host aggregation (not registered users). Use fofa_stats only when the account has the stats API (professional / business / enterprise). Personal, ordinary, and education accounts should use fofa_search instead of stats.
Use fofa_export for large or reusable result sets, then poll fofa_job_status. Return the artifact path instead of pasting large tables.
Use fofa_icon_search for an explicit public website favicon. Prefer fofa_agent_run for open-ended Chinese/English discovery intents; for organization website discovery, return its structured website_candidates first, preserving corroborated, observed, and candidate status instead of flattening them into confirmed ownership.
State that FOFA observations and even cross-consistent title/certificate/ICP clues indicate exposed or corroborated candidates, not legal ownership or vulnerability, unless separately verified.

Safety

Treat searches, profiles, and statistics as passive intelligence collection, but still respect the user's scope and applicable rules.
Never call nuclei_plan unless the user explicitly asks for active scanning and identifies an authorized scope.
Review every target, template, and severity in the plan before asking for approval.
Call nuclei_execute only after explicit approval for that exact plan. Never broaden or reuse an approval token.
Do not interpret authentication, quota, timeout, or provider errors as an empty FOFA result.
Never place FOFA_API_KEY, provider keys, bearer tokens, or approval tokens in reports or committed files.

Host Fallback

If the host cannot expose MCP tools, use FofaMap's machine-readable CLI only for passive operations, for example fofamap -q 'domain="example.com"' --output-format json --no-save or fofamap --rule 致远OA --output-format json --no-save. Do not use the CLI to bypass host approval controls.

Read references/tool-catalog.md when exact tool selection, pagination, resources, or host capability differences matter.

---name: fofamap-2description: Use FofaMap to validate FOFA syntax, search and profile internet assets, aggregate statistics, export bounded results, and manage authorized scan plans through its MCP tools. Trigger for FOFA queries, external attack-surface discovery, host intelligence, favicon searches, asset inventory, exposure analysis, or FOFA result exports.---# FofaMapUse the FofaMap MCP server for evidence-based FOFA asset research. Prefer the MCP tools over shell commands when they are available.## Workflow1. Clarify the target, ownership or authorization boundary, desired fields, time range, and result limit when these materially affect the request. Call `fofa_account` and `fofa_fields` when membership-dependent capabilities matter; these tools work even in hosts that do not expose MCP Resources.2. If the user names a product, OA, VPN, middleware, database, camera, CMS, or ops panel, call `fofa_rules` **before** `fofa_search`. Use the returned `query` values verbatim. Do not invent `app=` names. An empty keyword lists the bundled catalog (no FOFA quota).3. Call `fofa_validate_query` before spending FOFA quota. Repair invalid syntax before searching.4. Call `fofa_search` for the first bounded page. Use the smallest useful field set and size.5. Use `fofa_search_next` only when more records are needed, passing its opaque cursor unchanged.6. Use `fofa_host_profile` only when `fofa_account` shows Host aggregation (not registered users). Use `fofa_stats` only when the account has the stats API (professional / business / enterprise). Personal, ordinary, and education accounts should use `fofa_search` instead of stats.7. Use `fofa_export` for large or reusable result sets, then poll `fofa_job_status`. Return the artifact path instead of pasting large tables.8. Use `fofa_icon_search` for an explicit public website favicon. Prefer `fofa_agent_run` for open-ended Chinese/English discovery intents; for organization website discovery, return its structured `website_candidates` first, preserving `corroborated`, `observed`, and `candidate` status instead of flattening them into confirmed ownership.9. State that FOFA observations and even cross-consistent title/certificate/ICP clues indicate exposed or corroborated candidates, not legal ownership or vulnerability, unless separately verified.## Safety- Treat searches, profiles, and statistics as passive intelligence collection, but still respect the user's scope and applicable rules.- Never call `nuclei_plan` unless the user explicitly asks for active scanning and identifies an authorized scope.- Review every target, template, and severity in the plan before asking for approval.- Call `nuclei_execute` only after explicit approval for that exact plan. Never broaden or reuse an approval token.- Do not interpret authentication, quota, timeout, or provider errors as an empty FOFA result.- Never place `FOFA_API_KEY`, provider keys, bearer tokens, or approval tokens in reports or committed files.## Host FallbackIf the host cannot expose MCP tools, use FofaMap's machine-readable CLI only for passive operations, for example `fofamap -q 'domain="example.com"' --output-format json --no-save` or `fofamap --rule 致远OA --output-format json --no-save`. Do not use the CLI to bypass host approval controls.Read [references/tool-catalog.md](references/tool-catalog.md) when exact tool selection, pagination, resources, or host capability differences matter.

Frequently asked questions