Skip to main content
affpapa.org
RU EN
skill CX Codex

recon-for-sec — Claude Code skill: what it does, install

Routes initial reconnaissance for a new application, from attack-surface mapping to the next security testing path.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add yaklang/hack-skills --skill recon-for-sec -a claude-code
Open on GitHub

What recon-for-sec does

recon-for-sec is a starting router for a new target or an unknown attack surface. It guides the agent to confirm in-scope assets and target type, then map hosts, APIs, keys and the object graph from an application.

Once the inventory exists, the skill routes work to attack-surface-mapping, api-sec, auth-sec, injection-checking or business-logic-vuln. Its map also covers exposed .git, .svn and .hg repositories, plus internal package-name reconnaissance for dependency confusion.

Confirm in-scope assets first. That is a necessary check because the later map and test route depend on it.

What it helps with

  • map an application's attack surface
  • build an inventory of hosts and APIs
  • fingerprint the target's technology
  • choose an initial security testing route
  • route an inventory to API or authentication testing

Example prompts for the agent

  • Use recon-for-sec to start reconnaissance for this new application.
  • Run recon-for-sec and map the attack surface from this URL.
  • Apply recon-for-sec to select a testing route after the API inventory is built.

How to install recon-for-sec

1Skills CLI (Vercel)

npx skills add yaklang/hack-skills --skill recon-for-sec -a claude-code

2Manually: put the files in place

~/.claude/skills/recon-for-sec/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/recon-for-sec/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about recon-for-sec

How do I install recon-for-sec in Claude Code?

Run npx skills add yaklang/hack-skills --skill recon-for-sec -a claude-code, then run npx skills add yaklang/hack-skills --skill recon-for-sec -a claude-code again. The skill file is at ~/.claude/skills/recon-for-sec/SKILL.md.

What does recon-for-sec do?

It sets the order for initial reconnaissance: confirm assets in scope, map the attack surface, then choose the next testing route.

Which skills can recon-for-sec route an inventory to?

It can route the inventory to api-sec, auth-sec, injection-checking or business-logic-vuln. It uses attack-surface-mapping for surface mapping.

Source text

SKILL.md · MIT 
---
name: recon-for-sec
description: >-
  Entry P1 category router for reconnaissance and methodology. Use when mapping
  scope, drawing an attack surface from one application, discovering assets,
  fingerprinting technology, building endpoint inventory, and choosing the
  first high-value security testing path.
---

# Recon and Methodology Router

This is the starting router for new targets and unknown attack surfaces.

## When to Use

- You just received a new target and do not yet know what to test first
- You need to begin by drawing the surface from the application, then asset discovery, fingerprinting, and test-route planning
- You want to build follow-up testing on structured methodology instead of random payload enumeration

## Skill Map

- [Attack Surface Mapping](../attack-surface-mapping/SKILL.md) — from one URL / one app, draw hosts, APIs, keys, and the object graph
- [Recon and Methodology](../recon-and-methodology/SKILL.md)
- [Insecure Source Code Management](../insecure-source-code-management/SKILL.md) — .git/.svn/.hg exposure detection
- [Dependency Confusion](../dependency-confusion/SKILL.md) — Supply chain reconnaissance for internal package names

## Recommended Flow

1. Confirm in-scope assets and target type
2. Draw the surface from the application: [attack-surface-mapping](../attack-surface-mapping/SKILL.md)
3. Route the inventory to [api-sec](../api-sec/SKILL.md), [auth-sec](../auth-sec/SKILL.md), [injection-checking](../injection-checking/SKILL.md), or [business-logic-vuln](../business-logic-vuln/SKILL.md)

© yaklang · MIT · yaklang/hack-skills

Similar skills

All skills for Security →
osint-recon briiirussell Gathers and correlates public intelligence across domains, organizations, and metadata. Helps map attack surfaces and document open-source findings. CX Codex +1 386installs conducting-external-reconnaissance-with-osint mahipal Builds a target profile from open sources: DNS, certificate logs, search, social media, repos and breach data. For the passive phase of a pentest. CX Codex +1 319installs recon-a-domain-passively UseOSINT Builds a complete asset inventory for a domain, its subdomains, and infrastructure without sending packets to the target. Helpful for third-party risk reviews and M&A diligence. CX Codex +1 1,800installs owasp-security hoodini A skill that hands your agent the OWASP Top 10 playbook: access control, injection, crypto, misconfig. Useful while writing auth or touching an API. CX Codex +1 3,000installs api-authentication secondsky A skill that helps your coding agent write API authentication: JWT, OAuth 2.0, API keys, sessions and security headers. CX Codex +1 533installs dt-sec-insights Dynatrace A skill that writes DQL queries against Dynatrace security data: vulnerabilities, runtime attacks, compliance posture and scan coverage. CX Codex +1 1,400installs

From the same set93

oauth-oidc-misconfiguration Testing playbook for OAuth 2.0 and OpenID Connect configurations. It guides security reviews of redirect URIs, state parameters, PKCE enforcement, and account binding flows. CX Codex +1 3,700installs csrf-cross-site-request-forgery A CSRF testing playbook for state-changing web flows, token checks, SameSite behavior, JSON requests, login CSRF, and OAuth state. CX Codex +1 3,700installs heap-exploitation A playbook for ptmalloc2 heap exploitation: UAF, double free, overflow, plus tcache, fastbin and unsortedbin attacks. Useful for CTF work and glibc bug triage. CX Codex +1 3,700installs business-logic-vuln Routes security testing toward business logic and state machine flaws. Focuses on race conditions, stacked discounts, quota bypasses, and workflow abuse. CX Codex +1 3,700installs ios-pentesting-tricks A playbook for iOS app testing: keychain extraction, URL scheme hijacking, Universal Links abuse and runtime hooks. CX Codex +1 3,700installs cors-cross-origin-misconfiguration Guides testing of CORS misconfigurations, origin reflection, and credentialed API access. Useful when auditing cross-origin boundaries and cache policies. CX Codex +1 3,700installs injection-checking A router skill for injection testing: pick the right workflow based on where attacker-controlled input ends up. CX Codex +1 3,700installs kubernetes-pentesting A Kubernetes pentesting playbook: API server access, RBAC enumeration, service account token abuse, etcd, the Kubelet API and pod escape. CX Codex +1 3,700installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor