# Auth Failure Analyzer

> Diagnoses Tenable Nessus authentication failures by analyzing plugin output from scan results or live MCP lookups, identifying root causes and providing actionable remediation steps.

- Type: Skill
- Author: nsolimini
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-07-20
- Source repository: https://github.com/nsolimini/auth-failure-skill
- Repo state: not archived
- Last push: 2026-07-20T19:18:40Z
- Stars: 3 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, Tenable Hexa AI MCP
- Domains: platform-operations
- Tags: authentication, nessus, credentialed-scanning, troubleshooting, windows, smb, wmi, vulnerability-management
- Date added: 2026-07-11
- Works with the Tenable Hexa AI MCP server: yes
- Compatible platforms: Claude Code, Claude Desktop
- Invocation: `analyze auth failures on [hostname/IP/asset ID/scan ID]`
- Listing page: https://exchange.tenable.com/skills/auth-failure-analyzer
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/auth-failure-analyzer.md

A skill for diagnosing why Tenable Nessus credentialed scans succeed or fail on a given host. Provide a hostname, IP address, asset ID, scan ID, CSV scan results, or paste plugin information directly — the skill identifies all auth-relevant plugins, classifies the overall authentication status, pinpoints the root cause, and gives numbered remediation steps.

## What it does

- Accepts a hostname, IP, asset ID, scan ID, CSV scan results, or pasted plugin information as input
- Identifies authentication-relevant Nessus plugins (success signals: 141118, 110095, 10394, 10400, 20811; failure signals: 110723, 104410, 21745, and others)
- Classifies overall auth status as ✅ Success, ❌ Failed, or ⚠️ Partial
- Checks plugin 19506 (Nessus Scan Information) as ground truth for `Credentialed checks: yes/no`
- Diagnoses root cause in plain English and provides actionable remediation steps
- Distinguishes Windows (SMB/WMI) vs Linux (SSH) authentication paths and flags mismatches

## How it works

The skill follows a structured lookup strategy:

1. **Live MCP lookup** — if a hostname, IP, or asset ID is provided and the Tenable MCP server is connected, it queries `workbenches_list_assets` → `workbenches_get_asset_vulnerabilities` → `workbenches_get_asset_vulnerability_details` for auth-relevant plugins
2. **Scan ID lookup** — uses `scan_results` and `scan_host_details` to retrieve plugin data for a specific scan run
3. **CSV or pasted plugin information** — if plugin data is provided directly, analysis proceeds immediately without any MCP calls

Results are presented in a structured table with root cause explanation and prioritized fix steps.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/auth-failure-analyzer.json. The full index and how to read it: https://exchange.tenable.com/llms.txt