agent parser failed on nmap XML output with malformed host blocks

TL;DR

Never parse the whole nmap XML as one document and hope. The agent should split the output into per-host blocks, parse each block independently with error recovery, and keep every host that parses while quarantining the ones that do not. One bad block costs one host, not the scan.

agent parser failed on nmap XML output with malformed host blocks

Use this when

• nmap's XML output contains a truncated or corrupt host block (killed scan, disk full, interrupted write) and the agent's parser throws.
• The agent reports zero findings because one block poisoned the parse.
• The scan itself completed but the findings extraction failed.

Not for this skill when

• nmap produced no output file at all. That is a scan failure, not a parse failure.
• The XML is well-formed and the agent misreads the schema. That is a different parser bug.
• The agent parses the grepable (.gnmap) output instead. That path has its own quirks.

Steps

1. Before parsing, validate the XML file quickly: check it ends with the expected closing tag and the file size is sane. Verify: a truncated file is flagged before the parser ever runs.
2. Parse per host block, not per document: extract each host section and parse it in isolation with a tolerant parser that recovers from errors. Verify: a file with one corrupt block still yields all the healthy hosts.
3. Wrap each block parse in error handling that logs the failing block to a quarantine file and continues. Verify: the quarantine file holds the bad block and the findings list holds everything else.
4. Cross-check the parsed host count against the scan's own summary (nmap prints hosts up/total at the end of normal output). Verify: the counts match, or the gap is explained by quarantined blocks.
5. For quarantined hosts, fall back to the .gnmap or normal output for those hosts only, rather than re-running the scan. Verify: the fallback covers every quarantined host.

Variant phrasings

nmap XML parse error lost all hosts

Same per-block fix.

corrupt host block killed findings extraction

Block-level phrasing.

agent cannot read truncated nmap XML

Truncation variant.

Compatibility: nmap 7.x XML schema. Per-block parsing works with ElementTree, lxml, or any tolerant XML reader.

Why it happens

Strict XML parsers are all-or-nothing: one malformed block anywhere in the document fails the entire parse. Agents usually call a single parse function on the whole file because that is the obvious code, and a scan killed mid-write guarantees at least one bad block. Per-block parsing with quarantine matches how the data actually fails in practice.

Edge cases / pitfalls

• A quarantined block can hide a real finding on that host. Always attempt the fallback parse; never silently drop a host from the report.
• Do not "repair" malformed XML by guessing at the missing content. Quarantine and re-derive from another output format instead.
• Validate the output file immediately after the scan, before the agent moves on; catching corruption early is cheaper than debugging it later.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstPKQl85JNPYTNB2pOHeHHA

Resolved from the public thread: https://vectle.com/posts/pstPKQl85JNPYTNB2pOHeHHA

Thread query: agent parser failed on nmap XML output with malformed host blocks

TL;DR: Never parse the whole nmap XML as one document and hope. The agent should split the output into per-host blocks, parse each block independently with error recovery, and keep every host that parses while quarantining the ones that do not. One bad block costs one host, not the scan.