New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Recon

by briiirussell in briiirussell/cybersecurity-skills

Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs.

MITAuto-check: notesSecurity

Install Recon

skills CLI
$ npx skills add briiirussell/cybersecurity-skills --skill recon -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install briiirussell/cybersecurity-skills recon --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/briiirussell/cybersecurity-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/recon .claude/skills/recon && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
recon
GitHub stars
413
Token cost
~1.1k tokens
SKILL.md length
416 words
Files
1
Skills in repo
25
Repo updated
First seen
Licence
MIT

At a glance

Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs.

  • Works in 3 steps: Passive Recon → Active Recon (explicit authorization only) → Analysis
  • The user mentions recon
  • SKILL.md covers Authorization Check, Methodology, Output Format and Boundaries, plus 1 more section
  • Calls curl and jq; reaches crt.sh

What it does

Recon is an agent skill from briiirussell/cybersecurity-skills. Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs. Use when the user mentions 'recon,' 'reconnaissance,' 'enumerate,' 'attack surface,' 'subdomain enumeration,' 'port scan,' 'fingerprint,' 'asset discovery,' or needs to map a target's external footprint.

Its SKILL.md is about 1.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Bug bounty, Threat modeling and Capture the flag. The repository describes itself as: Cybersecurity skills for AI coding agents (Claude Code, Cursor, Codex). The licence is MIT.

When your agent uses it

  • The user mentions recon
  • Subdomain enumeration
  • Asset discovery
  • Needs to map a targets external footprint

Example prompts

  • “recon,”
  • “reconnaissance,”
  • “enumerate,”
  • “/recon”

Requirements

  • Pre-approved tools (allowed-tools): Bash, Read, Write, WebSearch, WebFetch

Workflow steps

3 steps, taken from the step headings in SKILL.md.

  1. Passive Recon
  2. Active Recon (explicit authorization only)
  3. Analysis

What it can do on your machine

Read from SKILL.md and the folder at commit c9ade03. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Bash
    • Read
    • Write
    • WebSearch
    • WebFetch

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • curl
    • jq

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • crt.sh

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Recon loads about 1.1k tokens when it runs. Until then it costs about 87 tokens; SKILL.md has 416 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~87
When it runs · the whole SKILL.md, loaded when a task matches
~1.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Bash, Read, Write, WebSearch, WebFetch

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from briiirussell/cybersecurity-skills at commit c9ade03, republished under its MIT licence (© briiirussell). 416 words, ~1,094 tokens.

Download SKILL.mdSave it as .claude/skills/recon/SKILL.md (or your agent's skills folder).
name
recon
description
Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs. Use when the user mentions 'recon,' 'reconnaissance,' 'enumerate,' 'attack surface,' 'subdomain enumeration,' 'port scan,' 'fingerprint,' 'asset discovery,' or needs to map a target's external footprint.
allowed-tools
Bash, Read, Write, WebSearch, WebFetch

Recon — Penetration Testing Reconnaissance

Perform structured reconnaissance against an authorized target, organizing findings into an actionable attack surface map.

Cross-references: osint-recon for the deeper open-source-intelligence pass (people, organizations, historical data) — this skill is the active/passive target-mapping side, osint-recon is the broader investigative side; they pair naturally. web-pentest for the next stage once recon has produced an attack surface map and an authorized target list. owasp-audit for source-code review when you have access to the target's code.

Authorization Check

Before running any commands, confirm:

  1. The user has written authorization for the target (pentest engagement, bug bounty program, CTF/lab environment)
  2. The target is within the defined scope

If authorization is unclear, ask before proceeding. Never assume authorization.

Methodology

Phase 1: Passive Recon

Gather information without touching the target directly.

DNS enumeration:

  • Run dig any $ARGUMENTS for A, AAAA, MX, TXT, NS, CNAME records
  • Attempt zone transfer: dig axfr @ns-server $ARGUMENTS
  • Enumerate subdomains via certificate transparency:
    curl -s "https://crt.sh/?q=%25.$ARGUMENTS&output=json" | jq -r '.[].name_value' | sort -u

WHOIS and registration: Run whois $ARGUMENTS for registrant, nameserver, and creation date info.

Search engine dorking: Use targeted queries — site:, inurl:, filetype:, intitle: — to find exposed pages, documents, and admin panels.

Technology fingerprinting: Identify frameworks, CMS, server software, and JavaScript libraries from public-facing pages.

Public code repositories: Search GitHub/GitLab for the target's org name, domain, API keys, or internal paths.

Historical data: Check the Wayback Machine for old endpoints, removed pages, and configuration files.

Show full SKILL.md (187 more words)Show less
Phase 2: Active Recon (explicit authorization only)

Port scanning:

bash
nmap -sC -sV -oN scan-results.txt $ARGUMENTS

Start with top 1000 ports. Expand to full range (-p-) if needed. Use -Pn if the host appears down but is in scope.

Service enumeration: Based on open ports, probe for version info and default configurations.

Web content discovery:

  • Directory bruting with gobuster, feroxbuster, or dirsearch
  • Virtual host enumeration
  • API endpoint discovery (check /api/, /v1/, /graphql, /swagger.json)

SSL/TLS analysis: Run testssl.sh or sslyze to check for weak ciphers, expired certificates, and misconfigurations.

Phase 3: Analysis

Correlate all findings. Identify the most promising attack vectors and prioritize by:

  1. Severity of potential impact
  2. Likelihood of exploitation
  3. Exposure level (internet-facing vs. internal)

Output Format

Produce a structured recon report:

markdown
# Recon Report
## Target: [target]
## Scope: [confirmed scope]
## Date: [date]

### Passive Findings
| Finding | Details | Relevance |
|---------|---------|-----------|

### Subdomains Discovered
- [list]

### Technologies Detected
- [list with versions where identified]

### Active Findings
| Port | Service | Version | Notes |
|------|---------|---------|-------|

### Attack Surface Summary
[Prioritized list of interesting findings with risk assessment]

### Recommended Next Steps
[Ordered list of what to investigate further]

Boundaries

  • Stay within the defined scope — never scan adjacent or out-of-scope systems
  • Rate-limit aggressive scans to avoid disruption
  • Log all commands run for the engagement record
  • If you discover evidence of active compromise by a third party, alert the user immediately
  • Refuse requests targeting systems without explicit authorization
  • Refuse requests for mass scanning of unrelated targets

References

  • PTES (Penetration Testing Execution Standard)
  • OWASP Testing Guide
  • Bug Bounty Methodology (jhaddix/tbhm)

© briiirussell, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/recon of briiirussell/cybersecurity-skills.

Open the folder on GitHubat commit c9ade03

Compare with similar skills

Recon next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Recon compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Recon this skillbriiirussell/cybersecurity-skills413—~1.1kAutomated safety check: NotesMIT
Osint Methodologyelementalsouls/Claude-OSINT2.8k—~8.7kAutomated safety check: NotesMIT
Adaptive Web FuzzingEncod3d-Sec/TORCH329—~1.3kAutomated safety check: PassMIT
Web2 Reconawarexone/Agentic-Bug-Hunter5.3k2 repos~6.4kAutomated safety check: WarnMIT
Security Specialistfabricioctelles/skills106—~2.8kAutomated safety check: PassApache-2.0
Audit Context Buildingtrailofbits/skills7.5k—~996Automated safety check: PassCC-BY-SA-4.0

Similar skills

  • Osint Methodology

    elementalsouls/Claude-OSINT

    Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.

    2.8k GitHub stars~8.7k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Adaptive Web Fuzzing

    Encod3d-Sec/TORCH

    Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

    329 GitHub stars~1.3k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Web2 Recon

    awarexone/Agentic-Bug-Hunter

    Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis…

    5.3k GitHub starsUsed in 2 repos~6.4k tokens
    SecurityAuto-check: warnings

  • Security Specialist

    fabricioctelles/skills

    Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking.

    106 GitHub stars~2.8k tokensUpdated today
    SecurityAuto-check passed

  • Audit Context Building

    trailofbits/skills

    Official

    Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.

    7.5k GitHub stars~996 tokensUpdated yesterday
    SecurityAuto-check passed

  • Performing Ot Network Security Assessment

    mukul975/Anthropic-Cybersecurity-Skills

    This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths.

    34k GitHub stars~6.1k tokensUpdated 1 mo ago
    SecurityAuto-check passed

More from briiirussell/cybersecurity-skills

All 25 skills in this repo

  • AI Risk Management

    briiirussell/cybersecurity-skills

    Apply the NIST AI Risk Management Framework (AI RMF 1.0) and adjacent guidance to AI / ML systems — model lifecycle governance, fairness and bias evaluation, robustness, transparency…

    413 GitHub stars~3.7k tokensUpdated 4 mo ago
    Auto-check: notes

  • API Audit

    briiirussell/cybersecurity-skills

    Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023).

    413 GitHub stars~2.8k tokensUpdated 4 mo ago
    Auto-check: notes

  • Breach Patterns

    briiirussell/cybersecurity-skills

    Learn from public breach disclosures — extract the audit question each one implies and check your own stack.

    413 GitHub stars~3.5k tokensUpdated 4 mo ago
    Auto-check: notes

  • Cloud Audit

    briiirussell/cybersecurity-skills

    Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.

    413 GitHub stars~1.3k tokensUpdated 4 mo ago
    Auto-check: notes

  • Container Audit

    briiirussell/cybersecurity-skills

    Audit container images, Dockerfiles, and Kubernetes manifests for misconfigurations, excessive privileges, exposed secrets, and runtime risks.

    413 GitHub stars~2.5k tokensUpdated 4 mo ago
    Auto-check: notes

  • Crypto Audit

    briiirussell/cybersecurity-skills

    Audit cryptography implementation — algorithm choice, key sizes, KDF parameters, IV/nonce handling, signature verification, randomness, TLS configuration, and key rotation.

    413 GitHub stars~2.8k tokensUpdated 4 mo ago
    Auto-check: notes

Categories

Questions about Recon

What does Recon do?

Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs. Recon is an agent skill from briiirussell/cybersecurity-skills. Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs.

When should I use Recon?

Recon fits situations like: the user mentions recon; subdomain enumeration; asset discovery; needs to map a targets external footprint.

How do I install Recon in Claude Code?

Run `npx skills add briiirussell/cybersecurity-skills --skill recon -a claude-code`. Or copy the skill folder (skills/recon in briiirussell/cybersecurity-skills) into .claude/skills/recon in your project. Claude Code loads it when a task matches its description.

How do I install Recon in Codex?

Run `npx skills add briiirussell/cybersecurity-skills --skill recon -a codex`. Or copy the skill folder (skills/recon in briiirussell/cybersecurity-skills) into .agents/skills/recon in your project. Codex loads it when a task matches its description.

Can I use Recon in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add briiirussell/cybersecurity-skills --skill recon -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/recon, .gemini/skills/recon, .github/skills/recon and .opencode/skills/recon in your project.

What does Recon need to run?

Going by SKILL.md and its folder, Recon needs the command-line tools its instructions call (curl and jq). Its frontmatter pre-approves these tools: Bash, Read, Write, WebSearch, WebFetch.

Does Recon access the network?

SKILL.md names 1 domain. In commands or code: crt.sh; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is Recon safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Recon use?

Recon is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Recon use?

About 1.1k tokens (SKILL.md is roughly 4.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Recon?

Skills that share tags, products or a category with Recon: Osint Methodology (elementalsouls/Claude-OSINT, 2.8k stars), Adaptive Web Fuzzing (Encod3d-Sec/TORCH, 329 stars), Web2 Recon (awarexone/Agentic-Bug-Hunter, 5.3k stars) and Security Specialist (fabricioctelles/skills, 106 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Recon?

briiirussell (a GitHub user) maintains it in briiirussell/cybersecurity-skills, which has 413 GitHub stars. The repository holds 25 skills in this directory. The repository was last updated on May 27, 2026.

Source: briiirussell/cybersecurity-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.