Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/akashrpatil/awesome-offensive-security-skillsnpx agentmods add skills/akashrpatil/awesome-offensive-security-skills/nmap-advanced-network-scanningWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/nmap-advanced-network-scanning)<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/nmap-advanced-network-scanning"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/nmap-advanced-network-scanning/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akashrpatil/awesome-offensive-security-skills/nmap-advanced-network-scanning"><img src="https://agentmods.dev/badge/skills/akashrpatil/awesome-offensive-security-skills/nmap-advanced-network-scanning.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01953 |
| Opus 5 | $0.00034 | $0.00977 |
| Sonnet 5 | $0.00014 | $0.00391 |
| Haiku 4.5 | $0.00007 | $0.00195 |
Grade A, and why
nmap-advanced-network-scanning scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo nmap -sS -sV -sC -O -p- 10.10.10.100 -oA full_scan Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Nmap Advanced Network Scanning
When to Use
- As the first step in network penetration tests
- When mapping network topology and identifying live hosts
- When enumerating services and versions running on targets
- When performing OS fingerprinting for exploit selection
- When running vulnerability scripts via NSE
Prerequisites
- Network access to the target subnet (VPN, pivot, or direct connection)
- Nmap and relevant network scanning tools installed
- Understanding of TCP/IP, common protocols, and network segmentation
- Root/admin access on the attack machine for raw socket operations
Workflow
Phase 1: Host Discovery
# Ping sweep (find live hosts)
nmap -sn 10.10.10.0/24 -oA host_discovery
# ARP scan (same subnet, most reliable)
nmap -PR -sn 10.10.10.0/24
# Without ping (bypass ICMP blocking)
nmap -Pn -sn 10.10.10.0/24
# TCP SYN ping on common ports
nmap -PS22,80,443,445 -sn 10.10.10.0/24
# Multiple ranges
nmap -sn 10.10.10.0/24 192.168.1.0/24 172.16.0.0/16
Phase 2: Port Scanning
# Quick top 100 ports
nmap -F 10.10.10.100
# Full TCP scan (all 65535 ports)
nmap -p- 10.10.10.100
# Common pentest scan (SYN scan + version + scripts + OS)
sudo nmap -sS -sV -sC -O -p- 10.10.10.100 -oA full_scan
# UDP scan (slow but important)
sudo nmap -sU --top-ports 200 10.10.10.100
# Speed-optimized full scan
nmap -p- --min-rate 10000 -T4 10.10.10.100
# Stealth SYN scan (default with root)
sudo nmap -sS -p- 10.10.10.100
# Connect scan (without root)
nmap -sT -p- 10.10.10.100
# Masscan for ultra-fast initial scan (then Nmap for details)
masscan 10.10.10.0/24 -p1-65535 --rate=10000 -oJ masscan_results.json
# Parse results and feed to Nmap for service detection
Phase 3: Service & Version Detection
# Version detection
nmap -sV -p 22,80,443,445,3306,8080 10.10.10.100
# Aggressive version detection
nmap -sV --version-intensity 5 -p- 10.10.10.100
# OS detection
sudo nmap -O 10.10.10.100
# Combined scan (version + OS + default scripts)
sudo nmap -A -p- 10.10.10.100 -oA aggressive_scan
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 207 lines · 68 tokens per session scan A c26a3091c777
nmap-advanced-network-scanning is a skill published in the GitHub repository akashrpatil/awesome-offensive-security-skills (5 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 68 tokens to every session and 1,953 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
recon-nmap
Network reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detection. Use when: (1) Conducting authorized network reconnaissance and asset discovery, (2) Enumerating network services and identifying running versions, (3) Detecting security vulnerabilities through…
performing-port-scanning-in-safe-lab
Perform TCP and UDP port scanning against isolated lab targets using Nmap to discover open services, identify running software versions, and enumerate the attack surface. Covers SYN scans, version detection, and OS fingerprinting techniques exclusively in controlled Docker lab environments.
active-directory-full-attack-chain
Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via…
nmap-usage
Professional nmap scanning techniques and optimization for penetration testing. Use this skill when you need to perform network reconnaissance, port scanning, or service enumeration during authorized security assessments.
port-scan
Discovers open ports and services on target hosts using naabu, masscan, and nmap. Use when needing to identify attack surface, discover running services, find non-standard ports, or enumerate network infrastructure during reconnaissance phase.
analyzing-network-flow-data-with-netflow
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port scanning, data exfiltration, and C2 beaconing patterns. Uses the Python netflow library to decode flow records, builds traffic baselines, and applies statistical analysis to identify flows with abnormal byte counts, connection durations, and…