Menu
Orchestrates scoped subdomain enumeration, DNS resolution, and active web probing for bug bounty targets.
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/Zyrexnn/Cybermes --skill reconThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
| name | recon |
| description | Orchestrates scoped subdomain enumeration, DNS resolution, and active web probing for bug bounty targets. |
Perform initial reconnaissance and asset mapping strictly within the authorized target scope.
subfinder to discover subdomains for the requested target:
mkdir -p /workspace/recon/<target>
subfinder -d <target> -silent -o /workspace/recon/<target>/subfinder.txt
echo "<target>" >> /workspace/recon/<target>/subfinder.txt
sort -u /workspace/recon/<target>/subfinder.txt -o /workspace/recon/<target>/in_scope.txt
dnsx to resolve A, CNAME, and AAAA records:
dnsx -l /workspace/recon/<target>/in_scope.txt -silent -o /workspace/recon/<target>/resolved.txt
httpx to probe live web servers, extract status codes, page titles, and web tech stack:
httpx -l /workspace/recon/<target>/resolved.txt -silent -title -status-code -tech-detect -json -o /workspace/recon/<target>/httpx.json
/workspace/recon/<target>/subfinder.txt - Raw discovered subdomains/workspace/recon/<target>/in_scope.txt - Validated in-scope hosts/workspace/recon/<target>/resolved.txt - Live DNS resolving hosts/workspace/recon/<target>/httpx.json - HTTP probe results with web technologiesAutonomous end-to-end security research and full-surface bug hunting engine. Executes non-stop reconnaissance, attack-surface discovery, parameter mining, multi-stage vulnerability verification, minimal-impact PoC generation, and structured reporting on authorized targets.
Generates standardized, professional Bug Bounty vulnerability reports in markdown format following HackerOne and Bugcrowd standards.
Workspace conventions for authorized security-engagement deliverables — canonical report location (/workspace/reports/<target>/), plain files not zip, follow-the-existing-format rule, report-aggregator overwrite trap, bypass-before-clear validation gate for negative claims, and Cloudflare UA pitfalls in PoC reproduction. Use at report-writing time or before declaring any control "secure".
Based on SOC occupation classification