## TL;DR
The HTML report is for humans; the agent should never parse it. Re-run or configure nikto to emit CSV or XML alongside the HTML, and parse the structured format. If the HTML is all that exists, treat extraction as unreliable and re-run the scan rather than scraping markup.

```text
agent failed to parse nikto HTML report; findings list came back empty
```

## Use this when
- The agent scraped nikto's HTML report and produced an empty findings list despite the report showing findings.
- The agent has only the HTML file and no structured output.
- Findings are visible to a human reading the report but missing from the agent's list.

## Not for this skill when
- nikto completed and genuinely found nothing. An empty structured report is a real outcome.
- The agent already parses nikto's CSV or XML output. Then the bug is elsewhere.
- nikto never produced a report. That is a scan failure.

## Steps
1. Change the nikto invocation to write a machine-readable format from the start, for example `nikto -h TARGET_HOST -o nikto.csv -Format csv`. Verify: the CSV file exists and has one row per finding.
2. Parse the CSV or XML with a real parser (csv module, ElementTree), mapping each row to host, path, finding text, and severity. Verify: the parsed count matches the row count in the file.
3. If only the HTML exists, do not scrape it: re-run nikto with structured output for the affected hosts. Verify: the re-run's structured file parses cleanly.
4. As a stopgap for a single unrepeatable HTML report, extract findings by the report's item markers and flag every extracted item as unverified. Verify: the notes mark these findings as HTML-derived and unverified.
5. Add a runbook rule: every nikto invocation in the engagement writes CSV or XML, never HTML alone. Verify: the run plan shows a structured output flag on each nikto command.

## Variant phrasings
### nikto HTML report parse returned nothing
Same structured-format fix.
### agent scraped nikto report, lost findings
Scraping-focused variant.
### empty findings from nikto HTML
Symptom phrasing.

Compatibility: nikto 2.5+. `-Format csv` and `-Format xml` are stable output options.

## Why it happens
nikto's HTML is a presentation layer: tables, styling, and layout that change between versions and carry no stable structure contract. Agents reach for it because it is the default output they were shown, then write brittle scrapers that silently return nothing when the markup differs. The CSV and XML formats exist precisely for machine consumption and have a stable shape.

## Edge cases / pitfalls
- CSV fields can contain commas inside quoted finding text; use a real CSV parser, not line splitting, or findings corrupt on parse.
- An HTML-derived finding is evidence-weak: verify each one against the target or a fresh scan before it goes in the report.
- Keep the HTML report anyway for the human-readable deliverable; structured output is for the agent, HTML is for the tester.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wEcRcQRJjy3TtWAkgVwkrg