How do I install the Nmap Recon skill?

Run npx skillmds@latest add commonhuman-lab/nmap-recon in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Nmap Recon skill do?

Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools It is listed under Productivity on SkillMD.

Is Nmap Recon safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Nmap Recon?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Nmap Recon free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Nmap Recon?

commonhuman-lab (@commonhuman-lab) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Nmap Recon by commonhuman-lab — Agent Skill

Name: Nmap Recon
Author: commonhuman-lab

File contents

nmap-recon

Step-by-step network reconnaissance skill for NyxStrike. Use this skill when a user asks to scan a host, discover open ports, enumerate services, or perform OS detection.

Workflow

1. Fast port discovery (rustscan or masscan)

Start with a fast sweep to identify open ports before running detailed scans.

Prefer rustscan for speed on a single target.
Prefer masscan for large CIDR ranges.

run_tool(tool="rustscan", target="<target>", ports="1-65535")

2. Service & version detection (nmap)

Run nmap against the open ports discovered in step 1 to enumerate services, versions, and scripts.

run_tool(tool="nmap", target="<target>", ports="<open_ports>", flags="-sV -sC -O")

Useful nmap flag combinations:

Goal	Flags
Service + version detection	`-sV`
Default NSE scripts	`-sC`
OS detection	`-O`
Aggressive (all of the above + traceroute)	`-A`
UDP scan	`-sU`
Full port range	`-p-`

3. Targeted NSE scripts (optional)

If specific services are found, run targeted NSE scripts for deeper enumeration.

Service	Suggested scripts
SMB (445)	`--script smb-vuln-*,smb-enum-shares`
HTTP (80/443)	`--script http-title,http-headers,http-methods`
FTP (21)	`--script ftp-anon,ftp-bounce`
SSH (22)	`--script ssh-hostkey,ssh-auth-methods`
SNMP (161/udp)	`--script snmp-info,snmp-interfaces`

run_tool(tool="nmap_advanced", target="<target>", ports="<port>", scripts="<script_list>")

4. ARP scan (local network only)

For targets on the same subnet, use arp_scan to identify live hosts before deeper scanning.

run_tool(tool="arp_scan", target="<subnet_cidr>")

Tips

Always confirm scope before scanning. Only scan targets you are authorized to test.
Start with -T3 (default timing) and increase to -T4 only on reliable networks.
Save output with -oN, -oX, or -oG flags for later analysis; pass via the output_file parameter where supported.
Chain results: feed open ports from rustscan/masscan directly into nmap to avoid redundant full-port scans.

NyxStrike Tool Reference

Tool	Use case
`nmap`	Service/version/script scanning
`nmap_advanced`	NSE script targeting
`masscan`	High-speed large-range port sweep
`rustscan`	Fast single-target port discovery
`arp_scan`	Local subnet host discovery

---name: nmap-recondescription: Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools---# nmap-reconStep-by-step network reconnaissance skill for NyxStrike. Use this skill when a user asks to scan a host, discover open ports, enumerate services, or perform OS detection.## Workflow### 1. Fast port discovery (rustscan or masscan)Start with a fast sweep to identify open ports before running detailed scans.- Prefer `rustscan` for speed on a single target.- Prefer `masscan` for large CIDR ranges.```run_tool(tool="rustscan", target="<target>", ports="1-65535")```### 2. Service & version detection (nmap)Run nmap against the open ports discovered in step 1 to enumerate services, versions, and scripts.```run_tool(tool="nmap", target="<target>", ports="<open_ports>", flags="-sV -sC -O")```Useful nmap flag combinations:| Goal | Flags ||---|---|| Service + version detection | `-sV` || Default NSE scripts | `-sC` || OS detection | `-O` || Aggressive (all of the above + traceroute) | `-A` || UDP scan | `-sU` || Full port range | `-p-` |### 3. Targeted NSE scripts (optional)If specific services are found, run targeted NSE scripts for deeper enumeration.| Service | Suggested scripts ||---|---|| SMB (445) | `--script smb-vuln-*,smb-enum-shares` || HTTP (80/443) | `--script http-title,http-headers,http-methods` || FTP (21) | `--script ftp-anon,ftp-bounce` || SSH (22) | `--script ssh-hostkey,ssh-auth-methods` || SNMP (161/udp) | `--script snmp-info,snmp-interfaces` |```run_tool(tool="nmap_advanced", target="<target>", ports="<port>", scripts="<script_list>")```### 4. ARP scan (local network only)For targets on the same subnet, use arp_scan to identify live hosts before deeper scanning.```run_tool(tool="arp_scan", target="<subnet_cidr>")```## Tips- Always confirm scope before scanning. Only scan targets you are authorized to test.- Start with `-T3` (default timing) and increase to `-T4` only on reliable networks.- Save output with `-oN`, `-oX`, or `-oG` flags for later analysis; pass via the `output_file` parameter where supported.- Chain results: feed open ports from rustscan/masscan directly into nmap to avoid redundant full-port scans.## NyxStrike Tool Reference| Tool | Use case ||---|---|| `nmap` | Service/version/script scanning || `nmap_advanced` | NSE script targeting || `masscan` | High-speed large-range port sweep || `rustscan` | Fast single-target port discovery || `arp_scan` | Local subnet host discovery |

Frequently asked questions

Nmap Recon