메뉴
Security reconnaissance. USE WHEN recon, reconnaissance, bug bounty, attack surface. SkillSearch('recon') for docs.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/danielmiessler/Personal_AI_Infrastructure --skill recon명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
| name | Recon |
| description | Security reconnaissance. USE WHEN recon, reconnaissance, bug bounty, attack surface. SkillSearch('recon') for docs. |
Before executing, check for user customizations at:
~/.claude/skills/PAI/USER/SKILLCUSTOMIZATIONS/Recon/
If this directory exists, load and apply any PREFERENCES.md, configurations, or resources found there. These override default behavior. If the directory does not exist, proceed with skill defaults.
Infrastructure and Network Reconnaissance
You MUST send this notification BEFORE doing anything else when this skill is invoked.
Send voice notification:
curl -s -X POST http://localhost:8888/notify \
-H "Content-Type: application/json" \
-d '{"message": "Running the WORKFLOWNAME workflow in the Recon skill to ACTION"}' \
> /dev/null 2>&1 &
Output text notification:
Running the **WorkflowName** workflow in the **Recon** skill to ACTION...
This is not optional. Execute this curl command immediately upon skill invocation.
Technical reconnaissance of network infrastructure including domains, IP addresses, netblocks, and ASNs. Combines passive intelligence gathering with authorized active scanning to map attack surfaces and identify assets.
Core Triggers - Use this skill when user says:
OSINT → recon (Common Pattern):
recon → webassessment:
Workflow Integration:
// OSINT skill discovers company infrastructure
const domains = await osintFindCompanyDomains("Acme Corp");
// Calls recon skill to map technical details
const infraMap = await reconDomain(domains[0]);
// Recon identifies web apps
const webApps = infraMap.subdomains.filter(s => s.hasHTTP);
// Calls web assessment for testing
await webAssessment(webApps);
CRITICAL AUTHORIZATION REQUIREMENTS:
Active reconnaissance MUST have:
Default behavior is PASSIVE ONLY. Always confirm before active techniques.
PassiveRecon.md - Safe ReconnaissanceNon-intrusive intelligence gathering using public sources:
Input: Domain, IP, or netblock Output: Passive intelligence report Authorization: None required
IpRecon.md - IP Address InvestigationComprehensive IP address reconnaissance:
Input: Single IP address Output: IP reconnaissance report Authorization: Required for active scanning
DomainRecon.md - Domain InvestigationFull domain mapping and enumeration:
Input: Domain name Output: Domain reconnaissance report Authorization: Required for active subdomain probing
NetblockRecon.md - CIDR Range ScanningNetwork range reconnaissance:
Input: CIDR notation (e.g., 192.168.1.0/24) Output: Netblock scan report Authorization: Required for active scanning
AsnRecon.md - Autonomous System InvestigationASN and BGP reconnaissance:
Input: ASN number (e.g., AS15169) Output: ASN mapping report Authorization: None required (passive data)
IPInfo API (ipinfo.io)
process.env.IPINFO_API_KEYtools/ipinfo-client.tsSystem Tools (always available)
whois - Domain and IP WHOIS lookupsdig - DNS queriesnslookup - DNS resolutioncurl - HTTP requests, API callsMCP Tools (security profile required)
httpx - HTTP probing and technology detectionnaabu - Port scanning~/.claude/MCPs/swap-mcp security)Shodan (when API key added)
Censys (when API key added)
SecurityTrails (when API key added)
VirusTotal (when API key added)
Located in tools/ directory:
ipinfo-client.ts
dns-utils.ts
whois-parser.ts
cidr-utils.ts
cert-transparency.ts
report-generator.ts
# IP Reconnaissance: 1.2.3.4
## Summary
- IP: 1.2.3.4
- Organization: Example Corp
- ASN: AS12345
- Location: San Francisco, CA, US
- ISP: Example Hosting
## DNS
- Reverse DNS: server.example.com
- Additional PTR: ...
## Network Information
- CIDR: 1.2.3.0/24
- Netblock Owner: Example Corp
- Abuse Contact: abuse@example.com
## Services (Passive)
- Certificates: 3 certificates found
- Historical DNS: ...
## Services (Active - Authorized)
- Open Ports: 22, 80, 443
- Services: SSH (OpenSSH 8.2), HTTP (nginx 1.20.1), HTTPS
- Technologies: nginx, OpenSSH
## Recommendations
- Further investigation areas
- Related assets
- Security observations
# Domain Reconnaissance: example.com
## Summary
- Domain: example.com
- Registrar: Example Registrar
- Registration: 2010-01-15
- Expiry: 2026-01-15
## DNS Records
### A Records
- 1.2.3.4
- 5.6.7.8
### MX Records
- 10 mail.example.com
## Subdomains
- www.example.com (1.2.3.4)
- api.example.com (1.2.3.5)
- admin.example.com (1.2.3.6)
## Email Security
- SPF: Configured
- DMARC: Configured
- DKIM: Configured
## Technologies
- Web Server: nginx
- Framework: React
- CDN: Cloudflare
## Recommendations
- Interesting subdomains: admin.example.com, api.example.com
- Attack surface: 15 web applications identified
Reports saved to:
~/.claude/MEMORY/WORK/{current_work}/scratch/) - For iterative artifacts during investigation~/.claude/MEMORY/RESEARCH/YYYY-MM/) - For pentest engagements and formal assessmentsFor passive recon: No special MCP profile needed
For active recon: Requires security MCP profile
# Switch to security profile
~/.claude/MCPs/swap-mcp security
# Restart Claude Code to apply
# Then run active reconnaissance
Security profile includes:
CRITICAL RULES:
Authorization Types:
Never scan:
When in doubt: Ask for explicit confirmation and documented authorization.
User: "Do passive recon on example.com"
Assistant: Activating recon skill with passive-recon workflow.
Target: example.com
Mode: Passive only (no active scanning)
[Performs WHOIS, DNS, cert transparency, IPInfo]
[Generates report in scratchpad]
Report: ~/.claude/MEMORY/WORK/{current_work}/scratch/recon-example-com/
User: "Investigate IP 1.2.3.4 - I own this server"
Assistant: Activating recon skill with ip-recon workflow.
Target: 1.2.3.4
Authorization check: You confirmed this is an owned asset.
Proceeding with passive + active reconnaissance.
[Performs IPInfo, reverse DNS, WHOIS, port scan, service detection]
[Generates comprehensive report]
Report: Open ports found (22, 80, 443)
Services: SSH, HTTP, HTTPS
Technologies: nginx 1.20.1, OpenSSH 8.2
User: "Do OSINT on Acme Corp and map their infrastructure"
Assistant: Activating OSINT skill...
Found domains: acme.com, acmecorp.com, acme.io
Now calling recon for infrastructure mapping...
[Recon skill maps each domain]
[Discovers subdomains, IPs, netblocks]
[Creates comprehensive infrastructure map]
Report: Complete OSINT + Infrastructure report
15 domains, 47 subdomains, 3 netblocks identified
Automatic workflow selection based on input:
IpRecon.mdDomainRecon.mdNetblockRecon.mdAsnRecon.mdPassiveRecon.mdUser can override:
"Use passive-recon workflow on 1.2.3.4"
"Run domain-recon on example.com with active scanning"
Passive Recon Success:
Active Recon Success:
Security Skills:
~/.claude/skills/OSINT/ - Entity and people reconnaissance~/.claude/skills/Webassessment/ - Web application testingTool Documentation:
Best Practices:
Remember: Start passive, confirm authorization before going active, document everything, and be respectful of target systems.
3-pass scope oscillation that holds a question constant while shifting the scope envelope — narrow/tactical, wide/strategic, then synthesis — to surface design tensions invisible at any single zoom level. Requires two distinct inputs: the tactical target (what you're building) and strategic context (the larger system it serves). Pass 1 captures the component's own internal logic. Pass 2 reveals what the system needs it to be. Pass 3 finds where those views diverge — that delta is the output. Produces: design tensions, scope recommendations, and coherence assessments. Single workflow: Workflows/Oscillate.md. BPE-fragile — quarterly test recommended to verify smarter models don't naturally oscillate scope without prompting. Best integration point: Algorithm OBSERVE phase (before ISC) or THINK phase (before approach commitment). NOT a lens rotation (that's IterativeDepth) and NOT idea generation (that's BeCreative). NOT FOR deep incident causal chains (use RootCauseAnalysis) or assumption decomposition (use Firs
Manages a curated aphorism collection with full CRUD — content-based matching, themed search, thinker research, and database maintenance. Organizes quotes by author, theme, context, and newsletter usage history to prevent repetition. Four workflows: FindAphorism (analyze newsletter content, match themes, return 3-5 ranked recommendations with rationale), AddAphorism (parse quote + author, extract themes, validate uniqueness, update theme index), ResearchThinker (deep research on philosopher, add sourced quotes to database), SearchAphorisms (search by theme, keyword, or author). Database at ~/.claude/skills/aphorisms/Database/aphorisms.md — stores full quote text, author attribution, theme tags, context/background, source reference, and usage history per entry. Theme index supports 12+ categories: Work Ethic, Resilience, Learning, Stoicism, Risk, Wisdom, Truth-seeking, Excellence, Curiosity, Freedom, Rationality, Clarity. Supported thinkers: Hitchens, Feynman, Deutsch, Sam Harris, Spinoza, plus any requested a
Scrape social media platforms, business data, and e-commerce via Apify actors — Instagram profiles/posts/hashtags/comments, LinkedIn profiles/jobs/posts, TikTok profiles/hashtags/videos/comments, YouTube channels/search/comments, Facebook posts/groups/comments, Google Maps business search with contact/review/image extraction, Amazon products/reviews/pricing, and general-purpose multi-page web crawling with custom pageFunction extraction logic. File-based TypeScript wrappers (scrapeInstagramProfile, searchGoogleMaps, scrapeAmazonProduct, scrapeWebsite, etc.) filter and transform data in code before returning to model context, achieving 95-99% token savings over direct MCP protocol. Parallel multi-platform queries via Promise.all for social listening dashboards. Lead enrichment pipeline: Google Maps → qualified filter → optional LinkedIn enrichment. Competitive analysis across Instagram, YouTube, and TikTok simultaneously. USE WHEN scrape Instagram, scrape LinkedIn, scrape TikTok, scrape YouTube, scrape Faceboo
