This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.
SkillScore86Maintained
Automatic
◆Security & AppSec pack
Last verified 8/10/2026
What it changes
Passed 18 of 21 test cases with the skill, and 13 of 21 without it.
Without skill64%
With skill86%
Checks it passed that the model alone missed
The response uses shodan scan submit.
The response includes the --verbose flag.
The response includes the -f port:22 filter option.
and 5 more in the full report
5 fixed14 passed either way3 still failing0 broke
Pass-rate lift
+23 pp
Tokens
+192%
Agent turns
0%
Response time
-59%
Model gemini-3.6-flashMeasured 8/10/2026v119 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 4
Prompt
I want to get a summary breakdown of top domains, ports, and ASNs for nginx servers without downloading all records. What CLI subcommand generates facet summaries, and how do you specify multiple facets?
What was checked, without and with the skill
Checked
Without skill
With skill
The response uses the shodan stats command.
Passed
Passed
The response uses the --facets option followed by comma-separated fields domain,port,asn.
Missed
Passed
case-13 · gemini-3.6-flash · 8/10/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md495 linessingle file
Shodan Reconnaissance and Pentesting
Purpose
Provide systematic methodologies for leveraging Shodan as a reconnaissance tool during penetration testing engagements. This skill covers the Shodan web interface, command-line interface (CLI), REST API, search filters, on-demand scanning, and network monitoring capabilities for discovering exposed services, vulnerable systems, and IoT devices.
Inputs / Prerequisites
Shodan Account: Free or paid account at shodan.io
API Key: Obtained from Shodan account dashboard
Target Information: IP addresses, domains, or network ranges to investigate