attack-surface-recon — Claude Code skill: what it does, how to install
Discovers external company assets, open database ports, leaked repository tokens, and takeover risks. Best for starting security reviews or running perimeter audits.
npx skills add securityskills/skills --skill attack-surface-recon -a claude-codeWhat attack-surface-recon does
The skill discovers external infrastructure in stages. First, the agent queries certificate transparency records on crt.sh and inspects network blocks through ipinfo or bgp.he.net. Next, it maps subdomains with passive DNS archives and tests permutations like -dev or -staging. Host liveliness gets validated using httpx and wappalyzer.
Port verification focuses on exposed services. The inspection flags database ports like 3306 or 5432 alongside unprotected administrative interfaces. The workflow also spots dangling CNAME records susceptible to subdomain takeover and checks GitHub gists for hardcoded corporate credentials. Open cloud storage buckets in S3 or Azure get flagged as well.
Active network scanning requires explicit authorization before execution. When compromised accounts appear during reconnaissance, the skill mandates logging the incident without attempting authentication. The final output groups all discovered hosts into an asset list ranked by risk severity.
What it helps with
- catalog external domains and subdomains from public records
- detect exposed database ports and admin consoles
- identify leaked tokens across public code repositories
- flag dangling DNS records vulnerable to subdomain takeover
Example prompts for the agent
- Map the external attack surface for
example.comusing passive DNS sources. - Scan public GitHub repositories for leaked credentials belonging to
example-corp. - Check our IP ranges for open database ports and dangling CNAME records.
How to install attack-surface-recon
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill attack-surface-recon -a claude-code2Manually: put the files in place
~/.claude/skills/attack-surface-recon/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/attack-surface-recon/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill attack-surface-recon -a codex2Manually: put the files in place
.agents/skills/attack-surface-recon/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill attack-surface-recon -a cursor2Manually: put the files in place
.cursor/skills/attack-surface-recon/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install securityskills/skills attack-surface-recon2Manually: put the files in place
.github/skills/attack-surface-recon/SKILL.md1Skills CLI (Vercel)
npx skills add securityskills/skills --skill attack-surface-recon -a gemini-cli2Platform CLI
gemini skills install https://github.com/securityskills/skills --path recon/attack-surface-reconManually: put the files in place
.devin/skills/attack-surface-recon/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add securityskills/skills --skill attack-surface-recon -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about attack-surface-recon
How do I install attack-surface-recon in Claude Code?
Run npx skills add securityskills/skills --skill attack-surface-recon -a claude-code in your terminal. The skill file is placed in ~/.claude/skills/attack-surface-recon/SKILL.md.
What does the attack-surface-recon skill do?
It maps an organization's public perimeter by gathering host records, exposed services, and repository leaks. The process outputs a prioritized asset inventory scored by exposure risk.
Does the skill test leaked credentials automatically?
No, testing logins with recovered credentials is prohibited. The skill only records proof of the leak and adds the finding to the summary report.
