Recon Osint

What it does

When your agent uses it

• Mapping a targets external attack surface
• Gathering OSINT — subdomain enumeration
• Attack-surface mapping (httpx/katana/JS secrets)
• Subdomain takeover

Example prompts

• “/recon-osint”

Requirements

• Python 3

What it can do on your machine

Read from SKILL.md and the folder at commit a506ad3. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 8 files in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • python3

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • public-dns.info

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Recon Osint loads about 2.2k tokens when it runs, and up to ~14k if it reads all its reference files. Until then it costs about 75 tokens; SKILL.md has 576 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~75

When it runs · the whole SKILL.md, loaded when a task matches

~2.2k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~14k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from hypnguyen1209/offensive-claude at commit a506ad3, republished under its MIT licence (© hypnguyen1209). 576 words, ~2,233 tokens.

name

recon-osint

description

Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)

metadata.type

offensive

metadata.phase

reconnaissance

metadata.tools

subfinder, amass, puredns, dnsx, httpx, katana, gau, nuclei, subzy, baddns, cloud_enum, AADInternals, trufflehog, gitleaks, theHarvester, h8mail, shodan, censys

metadata.mitre

TA0043

kill_chain.phase

recon

kill_chain.step

1

kill_chain.attck_tactics

TA0043, TA0006

kill_chain.attck_techniques

T1595, T1595.002, T1590, T1590.001, T1590.002, T1590.005, T1592, T1592.002, T1589, T1589.001, T1589.002, T1593, T1593.001, T1593.003, T1596, T1596.005, T1591…

feeds_into

vulnerability-analysis, web-pentest, network-attack, exploit-development, cloud-security, mobile-pentest, active-directory-attack, initial-access

inputs

scope_definition, target_list, root_domains, asn_list, email_list

export DOMAIN=target.com
# 0. Validate resolvers once (puredns needs a clean list)
dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt

# 1. Full discovery + probe + crawl + takeover + nuclei, JSONL out (see orchestrator)
python3 scripts/recon_orchestrator.py -d $DOMAIN -o out/ --resolvers resolvers.txt --nuclei

# 2. JS/endpoint + secret hunting over live hosts
python3 scripts/js_secret_hunter.py -l out/httpx_live.txt -o out/js/

# 3. Dangling-DNS / subdomain-takeover triage
python3 scripts/subdomain_takeover.py -l out/all_subdomains.txt -o out/takeovers.jsonl

# 4. Cloud + code recon (buckets, Azure tenant, GitHub secrets)
python3 scripts/cloud_asset_enum.py -k $DOMAIN --company target --azure-domain $DOMAIN --gh-org target

# 5. People + breach/infostealer intel
python3 scripts/breach_intel.py --domain $DOMAIN --harvest --hibp --dehashed

# 6. Triage CVEs from fingerprints → KEV/EPSS/exposure ranked
python3 scripts/cve_prioritizer.py --from-httpx out/httpx_live.txt --ip-file out/ips.txt -o out/cve_ranked.jsonl

© hypnguyen1209, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 14 other files (scripts, references) in skills/recon-osint of hypnguyen1209/offensive-claude.

• SKILL.md
• references/attack-surface-mapping.md
• references/breach-credential-intel.md
• references/cloud-saas-recon.md
• references/cve-exploit-intel.md
• references/subdomain-discovery.md
• references/subdomain-takeover.md
• scripts/breach_intel.py
• scripts/cloud_asset_enum.py
• scripts/cve_prioritizer.py
• scripts/hackerone_public_recon.py
• scripts/js_secret_hunter.py
• scripts/recon_orchestrator.py
• scripts/subdomain_takeover.py
• scripts/wordlist_ranker.py

Open the folder on GitHubat commit a506ad3