Fla Ascend Performance
fla-org/flash-linear-attention
Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.
Attack-surface crawling with the crawl tool — BFS link/form/hidden-field collection, JS-bundle API route extraction, and auth boundary mapping through the scoped browser.
Install Recon Crawl
$ npx skills add Ch1nfo/RiftX --skill recon-crawl -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Ch1nfo/RiftX recon-crawl --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .claude/skills && cp -r skills-src/recommended-skills/recon-crawl .claude/skills/recon-crawl && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "recon-crawl" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/recon-crawl into .claude/skills/recon-crawl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "recon-crawl", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/recon-crawlType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Ch1nfo/RiftX --skill recon-crawl -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Ch1nfo/RiftX recon-crawl --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .agents/skills && cp -r skills-src/recommended-skills/recon-crawl .agents/skills/recon-crawl && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "recon-crawl" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/recon-crawl into .agents/skills/recon-crawl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "recon-crawl", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Ch1nfo/RiftX --skill recon-crawl -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Ch1nfo/RiftX recon-crawl --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/recommended-skills/recon-crawl .cursor/skills/recon-crawl && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "recon-crawl" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/recon-crawl into .cursor/skills/recon-crawl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "recon-crawl", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Ch1nfo/RiftX.git --path recommended-skills/recon-crawl--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Ch1nfo/RiftX --skill recon-crawl -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Ch1nfo/RiftX recon-crawl --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/recommended-skills/recon-crawl .gemini/skills/recon-crawl && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "recon-crawl" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/recon-crawl into .gemini/skills/recon-crawl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "recon-crawl", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Ch1nfo/RiftX recon-crawlInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Ch1nfo/RiftX --skill recon-crawl -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .github/skills && cp -r skills-src/recommended-skills/recon-crawl .github/skills/recon-crawl && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "recon-crawl" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/recon-crawl into .github/skills/recon-crawl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "recon-crawl", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Ch1nfo/RiftX --skill recon-crawl -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Ch1nfo/RiftX recon-crawl --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Ch1nfo/RiftX.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/recommended-skills/recon-crawl .opencode/skills/recon-crawl && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "recon-crawl" agent skill from https://github.com/Ch1nfo/RiftX/tree/main/recommended-skills/recon-crawl into .opencode/skills/recon-crawl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "recon-crawl", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
recon-crawl- GitHub stars
- 113
- Token cost
- ~718 tokens
- SKILL.md length
- 214 words
- Files
- 2 (incl. references)
- Skills in repo
- 6
- Repo updated
- First seen
- Licence
- MIT
At a glance
Attack-surface crawling with the crawl tool — BFS link/form/hidden-field collection, JS-bundle API route extraction, and auth boundary mapping through the scoped browser.
- Works in 5 steps: 拿到入口就爬：browser navigate 建立首屏基线后，立即 crawl… → 参数选择：默认 maxPages=15, maxDepth=2；小型站点可… → 读清单的顺序 → …
- User needs to map a web applications attack surface
- SKILL.md covers RiftX Workflow, Methodology, Testing Checklist and 相关 Skills, plus 1 more section
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Recon Crawl is an agent skill from Ch1nfo/RiftX. Attack-surface crawling with the crawl tool — BFS link/form/hidden-field collection, JS-bundle API route extraction, and auth boundary mapping through the scoped browser. Use this skill when user needs to map a web application's attack surface, enumerate endpoints, discover hidden API routes, or build an endpoint inventory before vulnerability testing.
Its SKILL.md is about 720 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/js-reverse.md`).
It sits in Security, covering Threat modeling and Browser automation. The repository describes itself as: Pentest anything you want. The licence is MIT.
When your agent uses it
- User needs to map a web applications attack surface
- Enumerate endpoints
- Discover hidden API routes
- Build an endpoint inventory before vulnerability testing
Example prompts
- “/recon-crawl”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- 拿到入口就爬：browser navigate 建立首屏基线后，立即 crawl 一次性拿到结构化攻击面清单——这比手工逐页 snapshot 快一个数量级，且不会漏掉 JS 路由
- 参数选择：默认 maxPages=15, maxDepth=2；小型站点可 maxPages=30；只要单页深度信息时 maxDepth=0（只提取入口页自身的链接/表单/JS 路由）
- 读清单的顺序
- 分流：爬完把端点清单交给对应的 exploit skill（/api/* → api-testing；表单反射 → exploit-xss；下载/文件参数 → exploit-file-download）；大站可 spawn_subagent 并行处理不同端点组
- 记录：爬到的暴露面（无需认证的管理端点、泄露的调试接口）验证后 record_finding；普通端点清单留在对话里即可，不要把每个 URL 都记成 finding
What it can do on your machine
Read from SKILL.md and the folder at commit 1e3369f. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Recon Crawl loads about 718 tokens when it runs, and up to ~2k if it reads all its reference files. Until then it costs about 92 tokens; SKILL.md has 214 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from Ch1nfo/RiftX at commit 1e3369f, republished under its MIT licence (© Ch1nfo). 214 words, ~718 tokens.
Download SKILL.mdSave it as
.claude/skills/recon-crawl/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- recon-crawl
- description
- Attack-surface crawling with the crawl tool — BFS link/form/hidden-field collection, JS-bundle API route extraction, and auth boundary mapping through the scoped browser. Use this skill when user needs to map a web application's attack surface, enumerate endpoints, discover hidden API routes, or build an endpoint inventory before vulnerability testing.
Attack-Surface Crawling (crawl)
crawl 走真实浏览器访问目标，必须遵守浏览器 scope 与速率约定；页面预算用最小够用的值，不要无差别扫全站。
RiftX Workflow
- 拿到入口就爬：
browser navigate建立首屏基线后，立即crawl一次性拿到结构化攻击面清单——这比手工逐页 snapshot 快一个数量级，且不会漏掉 JS 路由 - 参数选择：默认
maxPages=15, maxDepth=2；小型站点可maxPages=30；只要单页深度信息时maxDepth=0（只提取入口页自身的链接/表单/JS 路由） - 读清单的顺序：
- JS-discovered routes——SPA 的 API 地图，模型最容易漏的就是这里的非标准端点；逐个对照后续 exploit skill 的注入面清单
- Forms（含 hidden 字段）——隐藏域是 mass assignment 与越权测试的入口（
exploit-authz） - AUTH 标记的页面——login-walled 端点用
use_identity+cookies_import带认证会话再测；匿名可达面优先测未授权访问 - Cross-host leads——crawl 不跟随跨主机链接，但记下了 host 清单：核对后可扩大 scope 或交给
recon-subdomain/recon-dir-scan
- 分流：爬完把端点清单交给对应的 exploit skill（/api/* →
api-testing；表单反射 →exploit-xss；下载/文件参数 →exploit-file-download）；大站可spawn_subagent并行处理不同端点组 - 记录：爬到的暴露面（无需认证的管理端点、泄露的调试接口）验证后
record_finding；普通端点清单留在对话里即可，不要把每个 URL 都记成 finding
Methodology
何时用 crawl vs 其他侦察
| 需求 | 工具 |
|---|---|
| 端点/表单/API 路由清单 | crawl（本 skill） |
| 隐藏目录/备份文件 | recon-dir-scan（词表爆破，互补不替代） |
| 技术栈/版本 | recon-fingerprint |
| 子域 | recon-subdomain |
标准顺序：crawl（拿地图）→ recon-fingerprint（定技术栈）→ recon-dir-scan（补爆破面）→ exploit skills。
crawl 结果的局限
- 只跟随同 host 链接；跨 host 记为线索不访问
- JS 路由提取是正则启发式：能拿到大部分字面量端点，拿不到运行时拼接的动态路由——对可疑前端代码配合
browser evaluate手工追 - 登录墙后的页面内容拿不到（只标注 AUTH）；需要认证后的攻击面，先带身份再对关键路径逐个测
Testing Checklist
- 入口页 crawl（默认参数）拿到基线清单
- JS routes 逐条分派到 exploit skills
- Forms 的 hidden 字段单独过一遍（tamper/mass assignment）
- AUTH 页面带认证身份复测
- cross-host leads 核对后决定是否扩大 scope
- 大站按端点组分派 subagent 并行
- 暴露面验证后 record_finding
Recording Results
Recon observations are working data, not findings — summarize them in the conversation. Reserve record_finding for actual exposures the crawl reveals (an unauthenticated admin endpoint, a leaked debug interface, a sensitive file in a linked path): one finding per concrete, evidence-backed conclusion, confidence set honestly, and evidence pointing at the proving tool call ({ "type": "tool", "toolCallId": "<id>", "toolName": "crawl" }). Findings persist with the session; there is no separate results database to write to.
相关 Skills
api-testing（API 面深入）、exploit-authz（越权/隐藏域）、recon-dir-scan（目录爆破互补）、recon-fingerprint（技术栈）、results-storage（findings 机制）
深度参考
references/js-reverse.md——JS 逆向配合接口挖掘：加密参数还原、隐藏/管理接口提取、硬编码密钥与演示账号发现
© Ch1nfo, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (references) in recommended-skills/recon-crawl of Ch1nfo/RiftX.
- SKILL.md
- references/js-reverse.md
Open the folder on GitHubat commit 1e3369f
Compare with similar skills
Recon Crawl next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Recon Crawl this skillCh1nfo/RiftX | 113 | — | ~718 | Automated safety check: Pass | MIT | |
| Fla Ascend Performancefla-org/flash-linear-attention | 5.8k | — | ~6.3k | Automated safety check: Pass | MIT | |
| Forensifyalexgreensh/repo-forensics | 188 | — | ~2.5k | Automated safety check: Notes | Custom licence | |
| Create Rulecartography-cncf/cartography | 4.1k | — | ~3k | Automated safety check: Pass | Apache-2.0 | |
| Commit Security Scancodexstar69/bug-hunter | 519 | — | ~629 | Automated safety check: Pass | MIT | |
| Auditing Code For Vulnerabilitiestrilwu/secskills | 157 | — | ~3.2k | Automated safety check: Pass | MIT |
Similar skills
Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
Create Rule
cartography-cncf/cartography
Author a Cartography security rule (one or more Cypher Facts plus a Pydantic Finding output model) under cartography/rules/data/rules/.
Commit Security Scan
codexstar69/bug-hunter
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.
Auditing Code For Vulnerabilities
trilwu/secskills
Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis.
Threat Mitigation Mapping
wshobson/agents
Match identified threats to preventive, detective and corrective controls across network, application, data, endpoint and process layers to plan remediation.
More from Ch1nfo/RiftX
LLM Testing
Ch1nfo/RiftX
Comprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.
Security Fuzzing
Ch1nfo/RiftX
Essential fuzzing payloads: SQL injection, command injection, special characters.
Security Patterns
Ch1nfo/RiftX
Security pattern matching for code audit and content inspection: grep strings for source auditing, malicious-string signatures, PHP magic hashes, error-message patterns.
Security Webshells
Ch1nfo/RiftX
Webshell samples for detection and analysis webshell 样本: PHP, ASP, ASPX, JSP, Python, Perl shells.
Security Usernames
Ch1nfo/RiftX
Top username lists for enumeration: common usernames, default credentials, names.
Related
Categories
Questions about Recon Crawl
What does Recon Crawl do?
Attack-surface crawling with the crawl tool — BFS link/form/hidden-field collection, JS-bundle API route extraction, and auth boundary mapping through the scoped browser. Recon Crawl is an agent skill from Ch1nfo/RiftX. Attack-surface crawling with the crawl tool — BFS link/form/hidden-field collection, JS-bundle API route extraction, and auth boundary mapping through the scoped browser.
When should I use Recon Crawl?
Recon Crawl fits situations like: user needs to map a web applications attack surface; enumerate endpoints; discover hidden API routes; build an endpoint inventory before vulnerability testing.
How do I install Recon Crawl in Claude Code?
Run `npx skills add Ch1nfo/RiftX --skill recon-crawl -a claude-code`. Or copy the skill folder (recommended-skills/recon-crawl in Ch1nfo/RiftX) into .claude/skills/recon-crawl in your project. Claude Code loads it when a task matches its description.
How do I install Recon Crawl in Codex?
Run `npx skills add Ch1nfo/RiftX --skill recon-crawl -a codex`. Or copy the skill folder (recommended-skills/recon-crawl in Ch1nfo/RiftX) into .agents/skills/recon-crawl in your project. Codex loads it when a task matches its description.
Can I use Recon Crawl in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Ch1nfo/RiftX --skill recon-crawl -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/recon-crawl, .gemini/skills/recon-crawl, .github/skills/recon-crawl and .opencode/skills/recon-crawl in your project.
What does Recon Crawl need to run?
SKILL.md names no scripts, command-line tools or credentials: Recon Crawl is instructions for the agent only.
Does Recon Crawl access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Recon Crawl safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Recon Crawl use?
Recon Crawl is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Recon Crawl use?
About 718 tokens (SKILL.md is roughly 2.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.3k tokens, read only when the agent opens those files.
What are the alternatives to Recon Crawl?
Skills that share tags, products or a category with Recon Crawl: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Forensify (alexgreensh/repo-forensics, 188 stars), Create Rule (cartography-cncf/cartography, 4.1k stars) and Commit Security Scan (codexstar69/bug-hunter, 519 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Recon Crawl?
Ch1nfo (a GitHub user) maintains it in Ch1nfo/RiftX, which has 113 GitHub stars. The repository holds 6 skills in this directory. The repository was last updated on September 21, 2026.
Source: Ch1nfo/RiftX on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.