## TL;DR
nikto writes findings to its output file as it goes; the agent just needs to read that file instead of waiting for the process to exit. Run nikto with `-o` to a file, flush findings into the run notes per host as the file grows, and treat a timeout as "scan incomplete", not "scan empty".

```text
agent timed out waiting for nikto scan; the agent failed to record partial findings
```

## Use this when
- nikto is killed by a timeout and the agent discards the run with zero findings recorded.
- The agent waits for nikto to exit before reading any results.
- A long multi-host nikto run dies partway with most hosts unscanned.

## Not for this skill when
- nikto exits immediately with an error. That is a startup problem.
- nikto completes but finds nothing. An empty result on a completed scan is a real outcome.
- The agent already streams nikto output. Then the fix is elsewhere.

## Steps
1. Always run nikto with a file output, for example `nikto -h TARGET_HOST -o nikto_out.txt`. Verify: the file exists and grows while the scan runs.
2. Bound the run: `-maxtime 30m` plus an outer `timeout` so the kill is predictable, not a surprise. Verify: an overlong scan exits on schedule.
3. Every 10 minutes, have the agent read the output file and append any new findings to the engagement notes with the host and timestamp. Verify: the notes hold findings even if the scan is killed at minute 31.
4. Split multi-host work so each host gets its own nikto invocation and output file. Verify: a timeout on host 3 does not destroy findings from hosts 1 and 2.
5. After the run, label each host's results complete or partial in the notes. Verify: the report distinguishes "scanned, nothing found" from "scan timed out, partial results".

## Variant phrasings
### nikto timeout wiped agent findings
Same flush-early fix.
### agent lost nikto results on kill
Process-kill variant.
### partial nikto scan has no recorded findings
Reporting-focused phrasing.

Compatibility: nikto 2.5+. `-o` file output and `-maxtime` are long-standing flags.

## Why it happens
Agents are trained on the pattern "run command, read output when done". nikto is slow against big targets, so "done" never arrives before the step timeout, and the findings sitting in the output file die unread. Flushing findings on a timer breaks the run-command-then-read habit and makes partial progress durable.

## Edge cases / pitfalls
- nikto's output file is overwritten on each run by default. Use a fresh filename per host or per attempt, or a completed host's findings vanish.
- Partial findings need severity triage like full ones; do not let "partial" become an excuse to skip verification of what was found.
- A host that always times out nikto may be dropping the scan traffic. Note the pattern; it can indicate filtering worth reporting.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_60ALSNtiFPSGDHjzePh9Yg