New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Scanning Infrastructure With Nessus

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.

Apache-2.0Auto-check: notesSecurity

Install Scanning Infrastructure With Nessus

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills scanning-infrastructure-with-nessus --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/scanning-infrastructure-with-nessus .claude/skills/scanning-infrastructure-with-nessus && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
scanning-infrastructure-with-nessus
GitHub stars
34k
Token cost
~1.7k tokens
SKILL.md length
603 words
Files
8 (incl. scripts, references, assets)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.

  • Works in 6 steps: Initial Configuration → Create Scan Policy → Configure Credentials → …
  • Tasks that involve Vulnerability scanning
  • SKILL.md covers Overview, When to Use, Prerequisites and Core Concepts, plus 4 more sections
  • Runs Python scripts from its folder; calls curl

What it does

Scanning Infrastructure With Nessus is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 10 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/api-reference.md` and `references/standards.md`).

It sits in Security, covering Vulnerability scanning. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Vulnerability scanning

Example prompts

  • “/scanning-infrastructure-with-nessus”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Initial Configuration
  2. Create Scan Policy
  3. Configure Credentials
  4. Run the Scan
  5. Analyze Results
  6. Export and Report

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • curl

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use curl, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Scanning Infrastructure With Nessus loads about 1.7k tokens when it runs, and up to ~3.8k if it reads all its reference files. Until then it costs about 59 tokens; SKILL.md has 603 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~59
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteRuns commands with sudoSKILL.md:75
    sudo systemctl start nessusd
  • NoteRuns commands with sudoSKILL.md:76
    sudo systemctl enable nessusd

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 603 words, ~1,704 tokens.

Download SKILL.mdSave it as .claude/skills/scanning-infrastructure-with-nessus/SKILL.md (or your agent's skills folder). This skill also uses 7 other files; get the full folder from GitHub.
name
scanning-infrastructure-with-nessus
description
Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.
domain
cybersecurity
subdomain
vulnerability-management
tags
vulnerability-management, cve, nessus, tenable, infrastructure-scanning, risk
version
1.0
author
mahipal
license
Apache-2.0
nist_csf
ID.RA-01, ID.RA-02, ID.IM-02, ID.RA-06
mitre_attack
T1190, T1203, T1068, T1046

Scanning Infrastructure with Nessus

Overview

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. This skill covers configuring scan policies, running authenticated and unauthenticated scans, interpreting results, and integrating Nessus into continuous vulnerability management workflows.

When to Use

  • When conducting security assessments that involve scanning infrastructure with nessus
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • Nessus Professional or Essentials license installed and activated
  • Network access to target systems (firewall rules allowing scanner IP)
  • Administrative credentials for authenticated scanning
  • Understanding of TCP/IP networking and common services
  • Written authorization for scanning target environments

Core Concepts

Nessus Architecture

Nessus operates as a client-server application where the Nessus scanner engine runs as a service (nessusd) on the host system. It uses a plugin-based architecture with over 200,000 plugins updated weekly by Tenable's research team. Each plugin tests for a specific vulnerability, misconfiguration, or compliance check.

Scan Types
  1. Host Discovery - Identifies live hosts using ICMP, TCP, UDP, and ARP
  2. Basic Network Scan - Default policy covering common vulnerabilities
  3. Advanced Scan - Custom policy with granular plugin selection
  4. Credentialed Patch Audit - Authenticated scan checking installed patches
  5. Web Application Tests - Scans for web-specific vulnerabilities
  6. Compliance Audit - Checks against CIS, DISA STIG, PCI DSS benchmarks
Plugin Families

Nessus organizes plugins into families including:

  • Operating Systems: Windows, Linux, macOS, Solaris
  • Network Devices: Cisco, Juniper, Palo Alto, Fortinet
  • Web Servers: Apache, Nginx, IIS, Tomcat
  • Databases: Oracle, MySQL, PostgreSQL, MSSQL
  • Services: DNS, SMTP, FTP, SSH, SNMP

Workflow

Step 1: Initial Configuration
bash
# Start Nessus service
sudo systemctl start nessusd
sudo systemctl enable nessusd

# CLI management with nessuscli
/opt/nessus/sbin/nessuscli update --all
/opt/nessus/sbin/nessuscli fix --list

# Verify plugin count
/opt/nessus/sbin/nessuscli update --plugins-only
Step 2: Create Scan Policy

Configure a custom scan policy through the Nessus web UI at https://localhost:8834:

  1. Navigate to Policies > New Policy > Advanced Scan
  2. Configure General settings: name, description, targets
  3. Set Discovery settings:
    • Host Discovery: Ping methods (ICMP, TCP SYN on ports 22,80,443)
    • Port Scanning: SYN scan on common ports or all 65535 ports
    • Service Discovery: Probe all ports for services
  4. Configure Assessment settings:
    • Accuracy: Override normal accuracy (reduce false positives)
    • Web Applications: Enable if scanning web servers
  5. Select Plugin families relevant to target environment
Show full SKILL.md (237 more words)Show less
Step 3: Configure Credentials

For authenticated scanning, configure credentials under the Credentials tab:

  • SSH: Username/password or SSH key pair
  • Windows: Domain credentials via SMB, WMI
  • SNMP: Community strings (v1/v2c) or USM credentials (v3)
  • Database: Oracle, MySQL, PostgreSQL connection strings
  • VMware: vCenter or ESXi credentials
Step 4: Run the Scan
# Using Nessus REST API via curl
# Authenticate and get token
curl -k -X POST https://localhost:8834/session \
  -d '{"username":"admin","password":"password"}' \
  -H "Content-Type: application/json"

# Create scan
curl -k -X POST https://localhost:8834/scans \
  -H "X-Cookie: token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "uuid": "<TEMPLATE_UUID>",
    "settings": {
      "name": "Infrastructure Scan Q1",
      "text_targets": "192.168.1.0/24",
      "enabled": true,
      "launch": "ON_DEMAND"
    }
  }'

# Launch scan
curl -k -X POST https://localhost:8834/scans/<SCAN_ID>/launch \
  -H "X-Cookie: token=<TOKEN>"

# Check scan status
curl -k -X GET https://localhost:8834/scans/<SCAN_ID> \
  -H "X-Cookie: token=<TOKEN>"
Step 5: Analyze Results

Nessus categorizes findings by severity:

  • Critical (CVSS 9.0-10.0): Immediate remediation required
  • High (CVSS 7.0-8.9): Remediate within 7-14 days
  • Medium (CVSS 4.0-6.9): Remediate within 30 days
  • Low (CVSS 0.1-3.9): Remediate during next maintenance window
  • Informational: No immediate action required
Step 6: Export and Report
bash
# Export via REST API
curl -k -X POST "https://localhost:8834/scans/<SCAN_ID>/export" \
  -H "X-Cookie: token=<TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"format":"nessus"}'

# Supported formats: nessus (XML), csv, html, pdf

Best Practices

  1. Schedule scans during maintenance windows to minimize production impact
  2. Use authenticated scanning for 45-60% more vulnerability detection
  3. Exclude fragile systems (medical devices, legacy SCADA) from aggressive scans
  4. Maintain separate scan policies for different network segments
  5. Update plugins before every scan to catch recently disclosed CVEs
  6. Validate critical findings manually before escalating to remediation teams
  7. Implement scan result trending to track remediation progress over time
  8. Store scan results in Tenable.sc or Tenable.io for centralized management

Common Pitfalls

  • Running unauthenticated scans only (misses 45-60% of vulnerabilities)
  • Scanning without written authorization (legal and ethical violations)
  • Ignoring scan performance impact on production systems
  • Failing to tune plugins leading to excessive false positives
  • Not validating scanner network connectivity before launching scans
  • Using default scan policies without customization for the environment
  • performing-authenticated-vulnerability-scan
  • prioritizing-vulnerabilities-with-cvss-scoring
  • implementing-continuous-vulnerability-monitoring
  • performing-network-vulnerability-assessment

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 7 other files (scripts, references, assets) in skills/scanning-infrastructure-with-nessus of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Scanning Infrastructure With Nessus next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Scanning Infrastructure With Nessus compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Scanning Infrastructure With Nessus this skillmukul975/Anthropic-Cybersecurity-Skills34k—~1.7kAutomated safety check: NotesApache-2.0
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0
Shiro Attack CLISummerSec/ShiroAttack22.6k—~945Automated safety check: PassMIT
Cve Remediationrundeck/rundeck6.3k—~2.9kAutomated safety check: PassApache-2.0
Native Dependency Updatemono/SkiaSharp5.6k—~4.1kAutomated safety check: PassMIT
Forensifyalexgreensh/repo-forensics190—~2.5kAutomated safety check: NotesCustom licence

Similar skills

  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 11 days ago
    SecurityAuto-check passed

  • Shiro Attack CLI

    SummerSec/ShiroAttack2

    当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…

    2.6k GitHub stars~945 tokensUpdated 4 mo ago
    SecurityAuto-check passed

  • Cve Remediation

    rundeck/rundeck

    Verify if a CVE affects the project and remediate it. An agent skill from rundeck/rundeck.

    6.3k GitHub stars~2.9k tokensUpdated yesterday
    SecurityAuto-check passed

  • Native Dependency Update

    mono/SkiaSharp

    Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.

    5.6k GitHub stars~4.1k tokensUpdated today
    SecurityAuto-check passed

  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    190 GitHub stars~2.5k tokensUpdated 13 days ago
    SecurityAuto-check: notes

  • Write Cve Rule

    evdenis/cvehound

    Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.

    138 GitHub stars~2.5k tokensUpdated 2 days ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Scanning Infrastructure With Nessus

What does Scanning Infrastructure With Nessus do?

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems. Scanning Infrastructure With Nessus is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.

When should I use Scanning Infrastructure With Nessus?

Scanning Infrastructure With Nessus fits situations like: tasks that involve Vulnerability scanning.

How do I install Scanning Infrastructure With Nessus in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus -a claude-code`. Or copy the skill folder (skills/scanning-infrastructure-with-nessus in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/scanning-infrastructure-with-nessus in your project. Claude Code loads it when a task matches its description.

How do I install Scanning Infrastructure With Nessus in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus -a codex`. Or copy the skill folder (skills/scanning-infrastructure-with-nessus in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/scanning-infrastructure-with-nessus in your project. Codex loads it when a task matches its description.

Can I use Scanning Infrastructure With Nessus in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill scanning-infrastructure-with-nessus -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/scanning-infrastructure-with-nessus, .gemini/skills/scanning-infrastructure-with-nessus, .github/skills/scanning-infrastructure-with-nessus and .opencode/skills/scanning-infrastructure-with-nessus in your project.

What does Scanning Infrastructure With Nessus need to run?

Going by SKILL.md and its folder, Scanning Infrastructure With Nessus needs Python for the scripts in its folder and the command-line tools its instructions call (curl). Our summary lists: Python 3.

Does Scanning Infrastructure With Nessus access the network?

SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Scanning Infrastructure With Nessus safe to install?

Our automated static check of SKILL.md found notes only (runs commands with sudo), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Scanning Infrastructure With Nessus use?

Scanning Infrastructure With Nessus is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Scanning Infrastructure With Nessus use?

About 1.7k tokens (SKILL.md is roughly 6.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.1k tokens, read only when the agent opens those files.

What are the alternatives to Scanning Infrastructure With Nessus?

Skills that share tags, products or a category with Scanning Infrastructure With Nessus: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Shiro Attack CLI (SummerSec/ShiroAttack2, 2.6k stars), Cve Remediation (rundeck/rundeck, 6.3k stars) and Native Dependency Update (mono/SkiaSharp, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Scanning Infrastructure With Nessus?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.