Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
MUKI is an active and passive asset fingerprinting tool for authorized red team reconnaissance. It scans targets using 30,000+ passive signatures and 300+ active probing rules to identify services, detect exposed paths, and extract sensitive information from HTTP responses.
It combines passive fingerprinting, active probing, directory scanning, and sensitive data extraction into one binary, replacing the need to chain separate tools like whatweb, gobuster, and custom regex scripts.
When to use it
- Mapping service versions across a client's web infrastructure before a pentest
- Finding exposed admin panels and config files during an engagement
- Detecting WAFs and CMS types across a large IP range
- Identifying leaked credentials or API keys in HTTP responses
- Building an asset inventory from a list of discovered subdomains
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Scan these 50 URLs for services and sensitive paths
- 1Writes all target URLs to targets.txt, one per line
- 2Runs `muki -l targets.txt -o results.json -t 20` to perform a full scan
- 3Reviews service fingerprints with `cat results.json | jq '.fingerprints[]'`
- 4Checks sensitive paths returned with HTTP 200 status
- 5Exports findings to report.xlsx for the engagement deliverable
JSON and Excel report listing identified services with versions, exposed admin and config paths, and any extracted credentials or API keys
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.