Skill

performing-vulnerability-scanning-with-nessus

skill:mukul975/anthropic-cybersecurity-skills#performing-vulnerability-scanning-with-nessus

Performs authenticated and unauthenticated vulnerability scanning using Tenable Nessus to identify known vulnerabilities, misconfigurations, default credentials, and missing patches across network infrastructure, servers, and applications. The scanner correlates findings with CVE databases and CVSS scores to produce prioritized remediation guidance. Activates for requests involving vulnerability scanning, Nessus assessment, patch compliance checking, or automated vulnerability detection.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:42 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

67/67

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/performing-vulnerability-scanning-with-nessus:skills/performing-vulnerability-scanning-with-nessus/scripts/agent.py:24:CRED

Security findings 1

Credential access

highContextual riskhigh confidence

The skill's undeclared behavior: its Nessus API client hard-disables TLS certificate verification and suppresses the matching InsecureRequestWarning while sending the NESSUS access/secret keys in the X-ApiKeys header on every request, so the credentials (and scan data) can be intercepted by any man-in-the-middle on the path to NESSUS_URL; the documented description and api-reference.md never disclose this insecurity.

skills/performing-vulnerability-scanning-with-nessus/scripts/agent.py:24

self.session.verify = False

vector:code

Counter-argument considered

Against refutation: the env-key carve-out covers authenticating to the wrapped service, not disabling TLS verification while doing so, and no mitigation or declaration exists (declared claims: none). For the finding: the __main__ block executes the client with real credentials over a session that hard-disables certificate verification and silently suppresses the matching warning, so the X-ApiKeys credentials and scan data are exposed to any MITM on the path to NESSUS_URL, an undeclared insecurity.