{"uuid": "9f490531-d7e6-428e-965a-fb6986f3cc78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-0144", "type": "seen", "source": "https://gist.github.com/utrawal9185-cmd/96e36077ce8085608c94f7b499c04cfd", "content": "---\ndescription: Use Shodan CLI to perform reconnaissance, asset discovery\n  and infrastructure intelligence for red team operations.\nhomepage: \"https://www.shodan.io\"\nmetadata:\n  author: jpacora\n  category: recon\n  openclaw:\n    homepage: \"https://www.shodan.io\"\n  tools:\n  - exec\n  - memory\nname: shodan-redteam-assistant\nuser-invocable: true\n---\n\n# Shodan Red Team Assistant\n\nThis skill enables the agent to perform internet-wide reconnaissance\nusing Shodan CLI to support red team operations.\n\nThe agent interacts conversationally with the user but executes\nreconnaissance tasks using the Shodan CLI through the `exec` tool.\n\nThis skill automatically:\n\n-   Detects if Shodan CLI is installed\n-   Installs it if missing (with user approval)\n-   Verifies API key configuration\n-   Stores state using memory\n-   Executes reconnaissance queries\n\n# Tools\n\nThis skill uses the following tools:\n\n-   exec \u2192 execute system commands\n-   memory \u2192 persist environment state in your MEMORY\n\nAll CLI commands must be executed via:\n\nexec(\"``{=html}\")\n\nNever simulate command output.\n\n# memory Keys\n\n  Key                     Meaning\n  ----------------------- ----------------------------\n  shodan_cli_installed    Shodan CLI binary exists\n  shodan_api_configured   API key already configured\n\n# Environment Validation Workflow\n\n## Step 1 --- Check memory\n\nmemoryGet(\"shodan_cli_installed\")\n\nIf TRUE \u2192 skip binary detection. If FALSE or NULL \u2192 check system.\n\n## Step 2 --- Detect Shodan CLI\n\nexec(\"which shodan\")\n\nIf found:\n\nmemorySet(\"shodan_cli_installed\", true)\n\nIf not found \u2192 determine OS.\n\n## Step 3 --- Detect Operating System\n\nexec(\"uname -a\") exec(\"cat /etc/os-release\")\n\n## Step 4 --- Installation (User Confirmation Required)\n\nThe agent must ask the user before installing.\n\nExample message:\n\n\"Shodan CLI is not installed. Would you like me to install it?\"\n\nPossible installation commands:\n\n### Debian / Ubuntu\n\nexec(\"sudo apt update && sudo apt install -y python3-pip\") exec(\"pip3\ninstall --user shodan\")\n\n### Arch Linux\n\nexec(\"sudo pacman -S python-pip\") exec(\"pip install --user shodan\")\n\n### macOS\n\nexec(\"brew install shodan\")\n\n### Generic Python Install\n\nexec(\"pip3 install --user shodan\")\n\nAfter installation:\n\nmemorySet(\"shodan_cli_installed\", true)\n\n# Step 5 --- Verify API Key\n\nexec(\"shodan info\")\n\nIf the command fails or requests initialization, ask the user:\n\n\"Please provide your Shodan API key so I can initialize the CLI.\"\n\nWhen the user provides a key:\n\nexec(\"shodan init USER_API_KEY\")\n\nThen store:\n\nmemorySet(\"shodan_api_configured\", true)\n\n# Failure Recovery\n\nIf a command returns:\n\nPlease run \"shodan init ``{=html}\"\n\nReset memory:\n\nmemorySet(\"shodan_api_configured\", false)\n\nThen request the API key again.\n\n# Example Queries\n\nFind exposed MongoDB servers:\n\nexec(\"shodan search 'port:27017' --fields ip_str,port,org\")\n\nFind Elasticsearch servers:\n\nexec(\"shodan search 'port:9200' --fields ip_str,port,org\")\n\nFind open RDP servers:\n\nexec(\"shodan search 'port:3389' --fields ip_str,port,org\")\n\nFind Grafana dashboards:\n\nexec(\"shodan search 'title:\\\"Grafana\\\"' --fields ip_str,port,org\")\n\nFind Jenkins servers:\n\nexec(\"shodan search 'product:Jenkins' --fields ip_str,port,org\")\n\nFind assets belonging to Google:\n\nexec(\"shodan search 'org:\\\"Google\\\"' --fields ip_str,port,org\")\n\nFind infrastructure in Germany:\n\nexec(\"shodan search 'country:DE' --fields ip_str,port\")\n\nFind systems vulnerable to Log4Shell:\n\nexec(\"shodan search 'vuln:CVE-2021-44228' --fields ip_str,port,org\")\n\nFind systems vulnerable to EternalBlue:\n\nexec(\"shodan search 'vuln:CVE-2017-0144' --fields ip_str,port,org\")\n\n# Example Pipeline\n\nExport Apache servers:\n\nexec(\"shodan search 'apache' --fields ip_str \\> targets.txt\")\n\n# Behavior Rules\n\nThe agent must:\n\n-   Always validate environment before using Shodan\n-   Use exec for every CLI command\n-   Persist environment state using memory\n-   Never install software without user confirmation\n-   Ask for the API key if not configured\n-   Use Shodan queries to support reconnaissance tasks\n-   Respond conversationally while executing commands programmatically", "creation_timestamp": "2026-09-29T12:43:22.000000Z"}