---
name: "nikto-web-server-scanner"
description: "Scan web servers for dangerous files, outdated server software, and misconfigurations."
metadata:
  author: "Sullo"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run nikto web scan"
  - "audit web server misconfiguration"
  - "scan for default server files"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Nikto Web Server Misconfiguration Scanner

Performs comprehensive web server checks with Nikto: testing for 6,700+ dangerous files/programs, outdated server versions, default files, and insecure HTTP header settings.

## When to Invoke
Invoke this skill whenever you need to:
- run nikto web scan
- audit web server misconfiguration
- scan for default server files

## Execution SOP & Rules
1. Execute nikto -h https://example.com -output scan_report.html on authorized servers.
2. Review reported findings and remove identified backup files (.bak, .old) from web roots.
3. Disable server signature banners (e.g. ServerTokens Prod in Apache) to limit information leakage.
4. Re-scan servers post-remediation to verify clean audit results.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.