Agent skill

Sccm Recon

Perform SCCM reconnaissance and takeover prerequisite validation, including site-role mapping, provider and AdminService checks, site database separation checks, and relay-path prechecks.

Apache-2.0Auto-check: notesSecurity

Install Sccm Recon

skills CLI

$ npx skills add SpecterOps/skills --skill sccm-recon -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills sccm-recon --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ops-sccm/skills/sccm-recon .claude/skills/sccm-recon && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "sccm-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-sccm/skills/sccm-recon into .claude/skills/sccm-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sccm-recon", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/SpecterOps/skills/tree/main/plugins/ops-sccm/skills/sccm-recon

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add SpecterOps/skills --skill sccm-recon -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills sccm-recon --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/ops-sccm/skills/sccm-recon .agents/skills/sccm-recon && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "sccm-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-sccm/skills/sccm-recon into .agents/skills/sccm-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sccm-recon", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add SpecterOps/skills --skill sccm-recon -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills sccm-recon --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/ops-sccm/skills/sccm-recon .cursor/skills/sccm-recon && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "sccm-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-sccm/skills/sccm-recon into .cursor/skills/sccm-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sccm-recon", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/SpecterOps/skills.git --path plugins/ops-sccm/skills/sccm-recon

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add SpecterOps/skills --skill sccm-recon -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills sccm-recon --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/ops-sccm/skills/sccm-recon .gemini/skills/sccm-recon && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "sccm-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-sccm/skills/sccm-recon into .gemini/skills/sccm-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sccm-recon", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install SpecterOps/skills sccm-recon

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add SpecterOps/skills --skill sccm-recon -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/ops-sccm/skills/sccm-recon .github/skills/sccm-recon && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "sccm-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-sccm/skills/sccm-recon into .github/skills/sccm-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sccm-recon", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add SpecterOps/skills --skill sccm-recon -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install SpecterOps/skills sccm-recon --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/ops-sccm/skills/sccm-recon .opencode/skills/sccm-recon && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "sccm-recon" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-sccm/skills/sccm-recon into .opencode/skills/sccm-recon/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sccm-recon", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: sccm-recon
GitHub stars: 704
Token cost: ~1.8k tokens
SKILL.md length: 829 words
Files: 4 (incl. assets)
Skills in repo: 38
Repo updated: Sep 23, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Perform SCCM reconnaissance and takeover prerequisite validation, including site-role mapping, provider and AdminService checks, site database separation checks, and relay-path prechecks.

Works in 3 steps: Confirm the target or target range is in… → Prefer known SCCM hosts first before… → If using pivots or C2 egress paths, note…
Security work in your project
SKILL.md covers Direct Triggers, Input Contract, Objectives and Preconditions, plus 8 more sections
Calls apt-get and curl

What it does

Sccm Recon is an agent skill from SpecterOps/skills. Perform SCCM reconnaissance and takeover prerequisite validation, including site-role mapping, provider and AdminService checks, site database separation checks, and relay-path prechecks.

Its SKILL.md is about 1.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including assets (for example `agents/openai.yaml`).

It sits in Security. The repository describes itself as: A marketplace for LLM skills. The licence is Apache-2.0.

When your agent uses it

Security work in your project

Example prompts

“/sccm-recon”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

Confirm the target or target range is in scope.
Prefer known SCCM hosts first before expanding outward.
If using pivots or C2 egress paths, note the transport and path assumptions in evidence.

What it can do on your machine

Read from SKILL.md and the folder at commit e655f93. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- apt-get
- curl
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use curl, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Sccm Recon loads about 1.8k tokens when it runs. Until then it costs about 50 tokens; SKILL.md has 829 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~50
When it runs · the whole SKILL.md, loaded when a task matches: ~1.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

NoteRuns commands with sudoSKILL.md:86
```
sudo apt-get update
```

NoteRuns commands with sudoSKILL.md:87

sudo apt-get install -y nmap curl netcat-openbsd smbclient rpcbind

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from SpecterOps/skills at commit e655f93, republished under its Apache-2.0 licence (© SpecterOps). 829 words, ~1,762 tokens.

Download SKILL.mdSave it as .claude/skills/sccm-recon/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.

name: sccm-recon
description: Perform SCCM reconnaissance and takeover prerequisite validation, including site-role mapping, provider and AdminService checks, site database separation checks, and relay-path prechecks.
metadata.author: GhostWorks

SCCM Recon

Use this skill to identify SCCM infrastructure and validate the prerequisites needed for follow-on SCCM operations such as site takeover, provider abuse, or controlled client-execution validation.

This skill is the preferred precursor to $sccm-takeover-relay.

Direct Triggers

Use this skill when the task mentions any of the following:

SCCM recon
ConfigMgr recon
find the site server
find the SMS Provider
find the site database
validate SCCM takeover prerequisites
AdminService check
SCCM site role mapping

Input Contract

Accept input as: TARGET [MODE] [NOISE]

Mode:

plan: produce the recon plan and command set only
execute (default): run bounded checks and capture evidence

Noise:

low (default): focused validation against known or likely SCCM assets
medium: broader SCCM role discovery and enrichment
high: aggressive probing, approval required

Examples:

$sccm-recon 192.0.2.20 execute low
$sccm-recon corp.local plan
$sccm-recon smsprov01.corp.local execute medium

Objectives

Identify likely SCCM assets and roles:

site server
SMS Provider
site database host
management point
distribution point

Identify SCCM-specific services and interfaces where feasible:

mssms-related SQL context
SMS_SITE_COMPONENT_MANAGER and related role hints
AdminService
provider/WMI access points

Validate takeover prerequisites for follow-on operations:

site database is separate from the coercion target
likely relay path to MSSQL exists
candidate site-system hosts are high-value coercion targets
EPA/NTLM conditions need further verification

Preconditions

Confirm the target or target range is in scope.
Prefer known SCCM hosts first before expanding outward.
If using pivots or C2 egress paths, note the transport and path assumptions in evidence.

Tooling Setup

Before execution, confirm where the skill will run and whether the following tools are available on that host.

Preferred Linux tooling:

nmap
curl
rpcclient
smbclient
nc

Typical Kali/Debian install commands:

bash

sudo apt-get update
sudo apt-get install -y nmap curl netcat-openbsd smbclient rpcbind

Notes:

rpcclient and smbclient are typically provided by the Samba client packages on Debian/Kali systems.
If rpcclient is not present after install, verify with:

bash

which rpcclient
which smbclient

If this recon must run through a pivot or team server, record:

host running the commands
pivot method, if any
whether $proxychains-tunnel should wrap the commands

Do not begin execution until the operator path for running the recon is clear.

Execution Workflow

Build the host set.

start with operator-provided hostnames/IPs
enrich with DNS and naming clues when available, for example:
- sccm
- cm
- mecm
- sms
- mp
- dp
- cas

Run low-noise service checks.

confirm core Windows service exposure and likely SCCM surfaces:
- SMB 445
- RPC 135
- WinRM 5985/5986
- MSSQL 1433
- HTTP/HTTPS 80/443
check for AdminService paths when web services are present

Identify likely roles.

infer role from service exposure, hostname conventions, and accessible web/API surfaces
distinguish confirmed role evidence from naming-based hypotheses

Validate site database separation and relay path assumptions.

check whether the candidate site DB host differs from the candidate coercion target
check whether MSSQL is reachable on the site DB host
record any evidence that the SMS Provider is on a separate host

Gather takeover-specific prereqs for handoff.

likely coercion targets
likely MSSQL relay targets
likely SMS Provider verification target
reachable ports relevant to takeover
blockers such as closed 1433, no reachable provider, or collapsed single-host architecture

Produce a normalized handoff for $sccm-takeover-relay.
Troubleshoot relay-path assumptions when needed.

if a required relay port appears blocked, compare it against a temporary listener on another known-allowed port
if the alternate port is reachable but the required port is refused, treat that as evidence of a port-specific environment restriction
record the test commands and outcomes for both ports

Show full SKILL.md (267 more words)Show less

Command Patterns

Focused port validation

bash

nmap -Pn -p 80,135,139,443,445,1433,5985,5986 <TARGET>

HTTP header and AdminService probing

bash

curl -isk https://<TARGET>/AdminService/wmi/
curl -isk https://<TARGET>/ccm_system/request

SMB and host-role context

bash

rpcclient -N -U "" <TARGET>
smbclient -L //<TARGET> -N

SQL reachability

bash

nc -zv <TARGET> 1433

Use $ssh-ops or $proxychains-tunnel when these checks should run through operator-controlled remote or tunneled command execution.

If the operator provides external MCP tooling, verify the relevant MCP tools are available before relying on them.

OPSEC Gate

Require explicit operator confirmation before:

subnet-wide SCCM hunting across many hosts
aggressive web/content discovery
intrusive RPC/SMB enumeration beyond bounded checks
any brute force, spraying, or exploit execution

Before requesting approval, include:

exact action
objective
expected impact
assumptions/prerequisites
telemetry and detection surfaces
expected noise level

Output Requirements

For each run, include:

target(s) tested
exact commands and outputs
candidate SCCM roles per host with confidence labels:
- confirmed
- likely
- unknown
takeover-prereq assessment:
- candidate coercion target
- candidate site DB target
- candidate SMS Provider target
- relevant port reachability
- blockers and unknowns
timestamps in UTC ISO 8601
recommended next step

Handoff To `sccm-takeover-relay`

When used as a precursor, provide:

coercion_target
site_db_target
sms_provider_target
relay_path_notes
candidate_site_code
confidence
blocked_by if prerequisites are incomplete

Port Troubleshooting Guidance

When validating relay-host reachability through SOCKS, pivots, or C2 transport:

test the intended port first
if it fails, stand up a temporary listener on a different port on the same relay host
test the same path to that alternate port
interpret results:

alternate port succeeds, intended port fails:
- likely port-specific outbound or environment restriction
both fail:
- broader path, routing, firewall, or listener issue
both succeed:
- relay-path connectivity is not the blocker

Reporting Notes

Prefer high-signal evidence over broad host counts. If role certainty is weak, say so and recommend the narrowest next validation step.

Files

SKILL.md and 3 other files (assets) in plugins/ops-sccm/skills/sccm-recon of SpecterOps/skills.

SKILL.md
agents/openai.yaml
assets/icon.png
assets/icon.svg

Open the folder on GitHubat commit e655f93

Compare with similar skills

Sccm Recon next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Sccm Recon compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Sccm Recon this skillSpecterOps/skills	704	—	~1.8k	Automated safety check: Notes	Apache-2.0	16 days ago
Fla Ascend Performancefla-org/flash-linear-attention	5.8k	—	~6.3k	Automated safety check: Pass	MIT	today
Deepsec Documentation Guidevercel-labs/deepsec	8.1k	—	~956	Automated safety check: Pass	Apache-2.0	10 days ago
Skill Scannergetsentry/skills	1k	4 repos	~2.5k	Automated safety check: Warn	Apache-2.0	6 days ago
Serenity Aleabitoreddityan-labs/serenity-aleabitoreddit	481	1 repos	~3.3k	Automated safety check: Pass	None	8 days ago
Security Alert Triageelastic/agent-skills	592	1 repos	~3.5k	Automated safety check: Notes	Apache-2.0	2 days ago

Similar skills

Fla Ascend Performance
fla-org/flash-linear-attention
Guidelines for Ascend NPU kernel / Triton-Ascend backend performance work in the FLA repo.
5.8k GitHub stars~6.3k tokensUpdated today
SecurityAuto-check passed
Deepsec Documentation Guide
vercel-labs/deepsec
Official
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
8.1k GitHub stars~956 tokensUpdated 10 days ago
SecurityAuto-check passed
Skill Scanner
getsentry/skills
Official
Scan agent skills for security issues. An agent skill from getsentry/skills.
1k GitHub starsUsed in 4 repos~2.5k tokens
SecurityAuto-check: warnings
Serenity Aleabitoreddit
yan-labs/serenity-aleabitoreddit
Apply trader Serenity's (@aleabitoreddit) AI/semiconductor supply-chain analytical lens to US-stock ideas and market judgment.
481 GitHub starsUsed in 1 repo~3.3k tokens
SecurityAuto-check passed
Security Alert Triage
elastic/agent-skills
Official
Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.
592 GitHub starsUsed in 1 repo~3.5k tokens
SecurityAuto-check: notes
Shiro Attack CLI
SummerSec/ShiroAttack2
当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…
2.6k GitHub stars~945 tokensUpdated 4 mo ago
SecurityAuto-check passed

Questions about Sccm Recon

What does Sccm Recon do?

Perform SCCM reconnaissance and takeover prerequisite validation, including site-role mapping, provider and AdminService checks, site database separation checks, and relay-path prechecks. Sccm Recon is an agent skill from SpecterOps/skills. Perform SCCM reconnaissance and takeover prerequisite validation, including site-role mapping, provider and AdminService checks, site database separation checks, and relay-path prechecks.

When should I use Sccm Recon?

Sccm Recon fits situations like: security work in your project.

How do I install Sccm Recon in Claude Code?

Run `npx skills add SpecterOps/skills --skill sccm-recon -a claude-code`. Or copy the skill folder (plugins/ops-sccm/skills/sccm-recon in SpecterOps/skills) into .claude/skills/sccm-recon in your project. Claude Code loads it when a task matches its description.

How do I install Sccm Recon in Codex?

Run `npx skills add SpecterOps/skills --skill sccm-recon -a codex`. Or copy the skill folder (plugins/ops-sccm/skills/sccm-recon in SpecterOps/skills) into .agents/skills/sccm-recon in your project. Codex loads it when a task matches its description.

Can I use Sccm Recon in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add SpecterOps/skills --skill sccm-recon -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sccm-recon, .gemini/skills/sccm-recon, .github/skills/sccm-recon and .opencode/skills/sccm-recon in your project.

What does Sccm Recon need to run?

Going by SKILL.md and its folder, Sccm Recon needs the command-line tools its instructions call (apt-get and curl).

Does Sccm Recon access the network?

SKILL.md contains no URLs. Its commands use curl, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Sccm Recon safe to install?

Our automated static check of SKILL.md found notes only (runs commands with sudo), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Sccm Recon use?

Sccm Recon is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Sccm Recon use?

About 1.8k tokens (SKILL.md is roughly 7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Sccm Recon?

Skills that share tags, products or a category with Sccm Recon: Fla Ascend Performance (fla-org/flash-linear-attention, 5.8k stars), Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Skill Scanner (getsentry/skills, 1k stars) and Serenity Aleabitoreddit (yan-labs/serenity-aleabitoreddit, 481 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Sccm Recon?

SpecterOps (a GitHub organization) maintains it in SpecterOps/skills, which has 704 GitHub stars. The repository holds 38 skills in this directory. The repository was last updated on September 23, 2026.

Source: SpecterOps/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Sccm Recon

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

SCCM Recon

Direct Triggers

Input Contract

Objectives

Preconditions

Tooling Setup

Execution Workflow

Command Patterns

Focused port validation

HTTP header and AdminService probing

SMB and host-role context

SQL reachability

OPSEC Gate

Output Requirements

Handoff To sccm-takeover-relay

Port Troubleshooting Guidance

Reporting Notes

Files

Compare with similar skills

Similar skills

More from SpecterOps/skills

Related

Questions about Sccm Recon

Handoff To `sccm-takeover-relay`