Metabigor OSINT Recon

What it does

When your agent uses it

• Mapping the network ranges behind an ASN, organization or domain
• Enumerating subdomains of a domain from certificate logs
• Finding likely origin servers behind a CDN or WAF
• Chaining several recon commands into one pipeline

Example prompts

• “List the CIDR ranges behind AS13335 with metabigor.”
• “Enumerate subdomains of example.com from certificate logs and strip the wildcard entries.”
• “Build a recon pipeline that chains net, cluster and ip for a company name.”

Requirements

• The metabigor CLI

What it can do on your machine

Read from SKILL.md and the folder at commit 5785d65. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • jq

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • twitter.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • VT_API_KEY
  • VIRUSTOTAL_API_KEY
  • INTELX_API_KEY
  • URLSCAN_API_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Metabigor OSINT Recon loads about 2.4k tokens when it runs, and up to ~3.8k if it reads all its reference files. Until then it costs about 167 tokens; SKILL.md has 789 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~167

When it runs · the whole SKILL.md, loaded when a task matches

~2.4k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~3.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from j3ssie/metabigor at commit 5785d65, republished under its MIT licence (© j3ssie). 789 words, ~2,388 tokens.

name

metabigor

description

Use when operating the metabigor CLI for OSINT recon and infrastructure mapping without API keys. Covers finding network ranges from an ASN, org, domain, or IP (net); enumerating subdomains from certificate logs (cert); enriching IPs with ports/CVEs via Shodan InternetDB (ip); searching public GitHub code for secrets and subdomains (github); clustering IPs by ASN (cluster); pivoting to related domains via crt.sh/WHOIS/analytics (related); detecting CDN/WAF vendors and isolating candidate origins (cdn); collecting archived URLs and WARC-mined endpoints (url); refreshing the offline databases (update); and chaining these commands into a recon pipeline.

license

MIT

tags

osint, recon, subdomain-enumeration, asn, network-discovery

metabigor net AS13335                  # network ranges (CIDRs) behind an ASN
metabigor cert hackerone.com           # subdomains from certificate logs
metabigor ip 1.1.1.1                   # open ports + CVEs for an IP (free, no key)
metabigor related tesla.com            # other domains the target owns
metabigor cdn --exclude -I ips.txt     # drop CDN/WAF IPs, keep candidate origins
metabigor url hackerone.com -f flat    # every archived URL, ready to pipe

metabigor cert example.com                 # as an argument
metabigor cert example.com tesla.com       # several arguments
metabigor cert -i example.com              # with -i (use when a target looks like a flag)
metabigor cert -I domains.txt              # from a file, one per line (# comments ignored)
cat domains.txt | metabigor cert           # on stdin

metabigor ip 1.1.1.0/28                 # 1.1.1.1 | 80,443 | one.one.one.one
metabigor ip 1.1.1.0/28 -f flat         # 1.1.1.1:80
metabigor ip 1.1.1.0/28 -f json | jq .  # {"ip":"1.1.1.1","ports":[80,443],...}
metabigor ip 1.1.1.0/28 -f csv -o ports.csv

  -i, --input string        Target to look up (also accepts arguments or stdin)
  -I, --input-file string   File of targets, one per line (use - for stdin)
  -o, --output string       Also write results to this file
  -f, --format string       Output format: text, json, csv, flat (default "text")
      --append              Append to the output file instead of overwriting it
  -c, --concurrency int     Number of parallel workers (default 10)
  -t, --timeout int         Request timeout in seconds (default 40)
      --retry int           Retries per failed request (default 3)
      --proxy string        Upstream proxy, e.g. http://127.0.0.1:8080
  -v, --verbose             Show step-by-step progress
  -q, --quiet               Show results and errors only
      --debug               Show HTTP traffic and internal traces (implies --verbose)
      --no-color            Disable colored log output

# ASN -> ranges -> live hosts with ports
metabigor net AS13335 -f flat | metabigor ip -f flat

# domain -> related domains -> their subdomains
metabigor related tesla.com -f flat | metabigor cert

# resolve subdomains, then split CDN from candidate origins
metabigor cert tesla.com | dnsx -silent -resp-only | metabigor cdn --exclude

# collect archived URLs and probe them
metabigor url tesla.com -f flat | httpx -silent

metabigor <command> -h     # authoritative flags for your installed version
metabigor version          # version, build date, commit
metabigor skills get --full  # print this skill and every reference

© j3ssie, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in public/skills/metabigor of j3ssie/metabigor.

• SKILL.md
• references/recipes.md
• references/url-command.md

Open the folder on GitHubat commit 5785d65