A powerful FOFA-integrated reconnaissance skill that automates asset discovery, host profiling, and security monitoring for AI agents.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install fofamap
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install fofamap using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is fofamap?
fofamap transforms natural-language requests into high-precision FOFA API operations. It is a specialized tool for Openclaw Skills that enables AI agents to map external attack surfaces, identify product fingerprints, and analyze global asset distributions with deterministic accuracy. By wrapping the complex FOFA query syntax into actionable workflows, it allows developers and security analysts to perform deep reconnaissance without manually constructing API calls.
This skill is built for stability and efficiency, handling everything from permission-aware field selection to automated query retries when results are thin. It emphasizes a structured approach to asset management, turning raw search data into analyst-ready reports and handoff files.
fofamap Use Cases
- Identify exposed subdomains, services, or specific product fingerprints globally using FOFA.
- Generate icon_hash queries from a target website to find similar assets across the web.
- Profile specific IPs or domains to aggregate host data, protocol details, and ISP information.
- Monitor organizational asset drift by comparing snapshots to identify new or removed exposures over time.
- Perform broad-scale security research into ASN, organization rankings, and service distribution statistics.
How fofamap Works
- The skill identifies the user's intent and selects the appropriate FOFA operation mode such as search, host, or stats.
- It verifies account permissions and VIP levels to determine which data fields and APIs are accessible.
- Deterministic API calls are executed through a Python-based recon script to fetch raw asset data.
- If initial queries return no results, the skill automatically implements broader fallback logic to refine the search.
- Optional live reachability checks are performed to verify if discovered assets are currently active.
- The skill generates structured reports and exports findings into XLSX or CSV formats for further analysis.
fofamap Setup
To get started with this component for Openclaw Skills, you need to configure your FOFA credentials in your environment.
export FOFA_EMAIL="[email protected]"
export FOFA_API_KEY="your_api_key"
You can then initialize the skill and verify your connection using the helper script:
python3 scripts/fofa_recon.py login
fofamap Data Schema & Taxonomy
The skill organizes reconnaissance data through structured outputs and local memory buffers for consistent retrieval.
| Data Component | Purpose | Format |
|---|---|---|
| Asset Lists | Tabular data of IPs, ports, and metadata | .xlsx, .csv |
| Snapshots | Point-in-time captures used for drift monitoring | .json |
| Reports | Human-readable analyst summaries | .md |
| Memory | Local episodic data for self-improvement | .json |
| Profile | FOFA account tier and capability metadata | JSON Object |
fofamap Advanced Features
- Automated query expansion logic that retries failed searches by intelligently broadening filters and scopes.
- Built-in monitoring mode to track recurring asset changes and alert on infrastructure drift.
- Integration with project-based workflows that generate targets for follow-up validation tools.
- Semantic local memory that allows the skill to learn from past reconnaissance failures and improve report quality.
- Native support for FOFA's cursor-based pagination to harvest large-scale datasets efficiently.
SKILL.md
Loading
Related Openclaw Skills
Info-Common
A shared library crate providing standardized IAAA authentication, TOTP, and session persistence for PKU-related CLI tools.
International Flights Skill
A powerful travel automation skill that enables AI agents to search international flights from China, provide real-time booking links, and proactively check visa requirements.
Amazon Seasonal Planning
An AI-driven planning assistant for Amazon sellers to manage seasonal calendars, inventory cycles, and peak-period promotions.
SF Novel Writer
A specialized AI writing assistant designed to guide authors through the structured creation of science fiction novels from worldbuilding to final manuscript.
SCI Translation Polish
A high-performance AI translation skill that converts Chinese academic papers into native-level English manuscripts ready for international journals.
Info-Auth
Info-Auth is a secure credential management CLI designed to handle PKU IAAA authentication via the OS keyring for AI agents and users.
Featured*
