How do I install the Openvas skill?

Run npx skillmds@latest add timsonner/openvas in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Openvas safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Openvas?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Openvas free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Openvas?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Openvas by timsonner — Agent Skill

Name: Openvas
Author: timsonner

Openvas

Use for vulnerability scanning and baseline exposure review during authorized pentests. Trigger on broad host hygiene assessment, scanner-led coverage of approved environments, and repeatable validation workflows that still require analyst triage.

timsonner c8c6f4e 2.2 KB Updated Sep 17, 2026

File contents

OpenVAS

Purpose

Use this skill for broad vulnerability scanning when the engagement needs baseline coverage of approved assets using an OpenVAS or Greenbone-style workflow.

Phase Fit

Primary: Vulnerability Analysis
Secondary: Discovery and Reconnaissance, Retest and Closure

Use When

Need scanner-led breadth coverage across approved hosts or services.
Need a repeatable open-source scanning workflow.
Need a retest baseline after remediation.

Avoid When

Scanner scope or performance constraints are unclear.
Findings would be reported without analyst validation.

Inputs

Approved target list and scan windows
Credential mode, plugin scope, and exclusions
Output and evidence requirements

Procedure

Scope the scan to the smallest approved asset set that fits the objective.
Tune scan configuration to the current phase objective.
Triage results for material, reachable issues.
Manually validate important findings before escalation.
Preserve the same scan configuration for retest.

Command Syntax

Launch and management syntax varies by distribution. On Greenbone-based installs, the most stable command-line examples are the service wrapper and a small gvm-cli GMP request.

# Start GVM services
gvm-start

# Stop GVM services
gvm-stop

# Check setup and prerequisites
gvm-check-setup

# Send a GMP XML request (get version)
gvm-cli socket --xml "<get_version/>"

# List existing tasks
gvm-cli socket --xml "<get_tasks/>"

# List targets
gvm-cli socket --xml "<get_targets/>"

# Start a task by ID
gvm-cli socket --xml "<start_task task_id='<task-id>'/>"

Evidence to Capture

Material scanner findings tied to approved assets
Exact configuration, credential mode, and target scope used
Which findings were manually validated versus triage-only

Safety Boundaries

Keep scans within approved targets, windows, and plugin scope.
Treat raw scanner output as triage input until validated.

---name: openvasdescription: Use for vulnerability scanning and baseline exposure review during authorized pentests. Trigger on broad host hygiene assessment, scanner-led coverage of approved environments, and repeatable validation workflows that still require analyst triage.license: MIT---# OpenVAS## PurposeUse this skill for broad vulnerability scanning when the engagement needs baseline coverage of approved assets using an OpenVAS or Greenbone-style workflow.## Phase Fit- Primary: Vulnerability Analysis- Secondary: Discovery and Reconnaissance, Retest and Closure## Use When- Need scanner-led breadth coverage across approved hosts or services.- Need a repeatable open-source scanning workflow.- Need a retest baseline after remediation.## Avoid When- Scanner scope or performance constraints are unclear.- Findings would be reported without analyst validation.## Inputs- Approved target list and scan windows- Credential mode, plugin scope, and exclusions- Output and evidence requirements## Procedure1. Scope the scan to the smallest approved asset set that fits the objective.2. Tune scan configuration to the current phase objective.3. Triage results for material, reachable issues.4. Manually validate important findings before escalation.5. Preserve the same scan configuration for retest.## Command SyntaxLaunch and management syntax varies by distribution. On Greenbone-based installs, the most stable command-line examples are the service wrapper and a small `gvm-cli` GMP request.```bash# Start GVM servicesgvm-start# Stop GVM servicesgvm-stop# Check setup and prerequisitesgvm-check-setup# Send a GMP XML request (get version)gvm-cli socket --xml "<get_version/>"# List existing tasksgvm-cli socket --xml "<get_tasks/>"# List targetsgvm-cli socket --xml "<get_targets/>"# Start a task by IDgvm-cli socket --xml "<start_task task_id='<task-id>'/>"```## Evidence to Capture- Material scanner findings tied to approved assets- Exact configuration, credential mode, and target scope used- Which findings were manually validated versus triage-only## Safety Boundaries- Keep scans within approved targets, windows, and plugin scope.- Treat raw scanner output as triage input until validated.

Frequently asked questions