# Shodan Skill > Use the installed shodan-skill CLI for documented Shodan REST, Streaming, Trends, and Exploits operations, including host intelligence, search and facets, DNS, scans, alerts, notifiers, bulk datasets, organizations, API-plan and credit-balance checks, and real-time feeds. Trigger for Shodan lookups, exposure research, scan or monitoring requests, API coverage questions, and Shodan account or Ente… - **Type:** Skill - **Install:** `agentstack add skill-liuweitao-shodan-skill-shodan-skill` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [liuweitao](https://agentstack.voostack.com/s/liuweitao) - **Installs:** 0 - **Category:** [Search](https://agentstack.voostack.com/c/search) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [liuweitao](https://github.com/liuweitao) - **Source:** https://github.com/liuweitao/shodan-skill/tree/master/platforms/openclaw/shodan-skill - **Website:** https://liuweitao.github.io/shodan-skill/ ## Install ```sh agentstack add skill-liuweitao-shodan-skill-shodan-skill ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Shodan Skill Use `shodan-skill` as the single implementation on every supported agent platform. ## Run the workflow 1. Confirm the command is installed with `shodan-skill --help`. If it is missing, direct the user to install this package before attempting an API operation. 2. Use `SHODAN_API_KEY` or the official Shodan CLI configuration for authentication. Never request that a key be pasted into a command, prompt, source file, or log. 3. Identify whether the request is read-only, credit-consuming, state-changing, destructive, or Enterprise-only. Consult [API coverage](references/api-coverage.yaml) for the exact method, path, access class, credit impact, and collected contract test. Use the [official API snapshot](references/official-api-snapshot.yaml) when checking whether the inventory matches the last retrieved documentation. 4. Translate the request to the grouped kebab-case CLI. Prefer `shodan-skill GROUP ACTION --help` when parameters are uncertain. 5. Route API-plan, usage-limit, quota, remaining-credit, credit-balance, query-credit, and scan-credit requests to `shodan-skill account api-info`. Use `shodan-skill account profile` only for membership and profile metadata. Never treat the profile response's generic `credits` field as the query- or scan-credit balance. 6. Treat an explicit user request as the instruction to execute that operation, including credits, mutations, downloads, scans, monitoring, streams, and Enterprise operations. Do not ask for a second confirmation or authorization acknowledgement. 7. Use the default `direct` safety mode. The CLI emits deterministic previews for applicable operations and continues immediately. Use `--dry-run` only when the user asks to preview without execution. Use `strict` mode only when the user explicitly requests it. 8. Validate every target and dynamic path segment locally, and do not add operations or expand targets beyond what the user requested. Treat Streaming and Enterprise entitlements as account requirements. 9. Parse stdout as the stable JSON envelope, JSON Lines for default streams, or SSE `data:` events when `--stream-format sse` is selected. Treat stderr as diagnostics and preserve nonzero exit codes. Never expose redacted values, signed URLs, authorization headers, cookies, or API keys. 10. Report skipped live verification honestly. Keep repository live-test gates separate from normal CLI execution; do not interpret a configured test environment as a request to run live tests. ## Choose the focused reference - Read [search and host](references/search-and-host.md) for host intelligence, search, count, pagination, facets, filters, tokens, and saved queries. - Read [DNS and tools](references/dns-and-tools.md) for DNS, account, ports, protocols, public IP, HTTP headers, and official data-field references. - Read [scans and alerts](references/scan-and-alerts.md) for scans, alerts, triggers, notifiers, and their request forms. - Read [streaming](references/streaming.md) for feeds, JSONL/SSE, limits, idle timeouts, and reconnects. - Read [Trends and Exploits](references/trends-and-exploits.md) for the separate Trends and Exploits services. - Read [Enterprise](references/enterprise.md) for datasets, verified downloads, organizations, and entitlement boundaries. - Read [official data schemas](references/data-schemas.md) for banner, exploit, and Threatnet event shapes. - Read the [official SDK baseline](references/sdk-baseline.md) and [SDK-only operations](references/sdk-only.md) only for compatibility or API-coverage questions. - Read [safety](references/safety.md) before any credit-consuming, state-changing, destructive, scanning, monitoring, or download operation. Use deprecated underscore aliases only to preserve an existing workflow. Generate new instructions and examples with the grouped interface. ## OpenClaw installation Install the `shodan-skill` Python package first, then place this generated directory at `~/.openclaw/skills/shodan-skill`. Confirm discovery with `shodan-skill --help` before an API request. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [liuweitao](https://github.com/liuweitao) - **Source:** [liuweitao/shodan-skill](https://github.com/liuweitao/shodan-skill) - **License:** MIT - **Homepage:** https://liuweitao.github.io/shodan-skill/ Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-liuweitao-shodan-skill-shodan-skill - Seller: https://agentstack.voostack.com/s/liuweitao - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.