# Openvas

> Use for vulnerability scanning and baseline exposure review during authorized pentests. Trigger on broad host hygiene assessment, scanner-led coverage of approved environments, and repeatable validation workflows that still require analyst triage.

- Skill: `timsonner/openvas` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/openvas`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/openvas/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/openvas

---


# OpenVAS

## Purpose

Use this skill for broad vulnerability scanning when the engagement needs baseline coverage of approved assets using an OpenVAS or Greenbone-style workflow.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Discovery and Reconnaissance, Retest and Closure

## Use When

- Need scanner-led breadth coverage across approved hosts or services.
- Need a repeatable open-source scanning workflow.
- Need a retest baseline after remediation.

## Avoid When

- Scanner scope or performance constraints are unclear.
- Findings would be reported without analyst validation.

## Inputs

- Approved target list and scan windows
- Credential mode, plugin scope, and exclusions
- Output and evidence requirements

## Procedure

1. Scope the scan to the smallest approved asset set that fits the objective.
2. Tune scan configuration to the current phase objective.
3. Triage results for material, reachable issues.
4. Manually validate important findings before escalation.
5. Preserve the same scan configuration for retest.

## Command Syntax

Launch and management syntax varies by distribution. On Greenbone-based installs, the most stable command-line examples are the service wrapper and a small `gvm-cli` GMP request.

```bash
# Start GVM services
gvm-start

# Stop GVM services
gvm-stop

# Check setup and prerequisites
gvm-check-setup

# Send a GMP XML request (get version)
gvm-cli socket --xml "<get_version/>"

# List existing tasks
gvm-cli socket --xml "<get_tasks/>"

# List targets
gvm-cli socket --xml "<get_targets/>"

# Start a task by ID
gvm-cli socket --xml "<start_task task_id='<task-id>'/>"
```

## Evidence to Capture

- Material scanner findings tied to approved assets
- Exact configuration, credential mode, and target scope used
- Which findings were manually validated versus triage-only

## Safety Boundaries

- Keep scans within approved targets, windows, and plugin scope.
- Treat raw scanner output as triage input until validated.