How do I install the Automation Recon Pipeline skill?

Run npx skillmds@latest add noorqureshi/automation-recon-pipeline in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Automation Recon Pipeline safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Automation Recon Pipeline?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Automation Recon Pipeline free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Automation Recon Pipeline?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Automation Recon Pipeline by noorqureshi

Name: Automation Recon Pipeline
Author: NoorQureshi

Automation Recon Pipeline

Chain recon tools into a repeatable, resumable pipeline for continuous bug-bounty coverage. Load on "automate recon", "recon pipeline", monitoring many programs, or scaling subdomain→ live→scan. Signals: wildcard scope at scale, wanting scheduled/continuous discovery.

NoorQureshi Updated Sep 17, 2026

File contents

Recon automation pipeline

When it applies

You track one or more wildcard programs and want discovery to run repeatably (and on a schedule), surfacing only new assets/findings instead of re-reviewing everything.

Why it works

Recon is a directed flow: roots → subdomains → resolve → live → ports → nuclei. Wiring the ProjectDiscovery tools together (each reads/writes lines) makes it composable, and diffing against last run (anew) turns it into continuous monitoring that alerts on change.

Method

Pipeline (each stage feeds the next):

subfinder -dL roots.txt -all -silent \
  | dnsx -silent -a -resp-only \
  | httpx -silent -sc -title -tech-detect \
  | tee live.txt \
  | nuclei -silent -severity low,medium,high,critical

Diff for "only new": pipe each stage through anew subs.txt / anew live.txt so reruns emit only newly-seen lines — the basis of continuous monitoring.
Notify: pipe results to notify (Slack/Discord/Telegram) so new hosts/findings alert you.
Schedule with cron/systemd-timer/GitHub Actions; persist state files per program so runs resume.
Keep templates current: nuclei -update-templates before each run.

Gotchas

Stay in scope: feed only in-scope roots, filter out-of-scope hosts before scanning.
Respect rate limits (-rl, -c) and program automation rules — don't hammer.
De-dupe wildcard DNS (dnsx wildcard filtering) or you'll alert on noise forever.

Verify success

A rerun surfaces only newly-appeared assets/findings and notifies you — hands-off continuous coverage.

References

ProjectDiscovery pipeline docs; TomNomNom anew; nuclei templates.

---name: automation-recon-pipelinedescription: Chain recon tools into a repeatable, resumable pipeline for continuous bug-bounty coverage. Load on "automate recon", "recon pipeline", monitoring many programs, or scaling subdomain→ live→scan. Signals: wildcard scope at scale, wanting scheduled/continuous discovery.---# Recon automation pipeline## When it appliesYou track one or more wildcard programs and want discovery to run repeatably (and on aschedule), surfacing only *new* assets/findings instead of re-reviewing everything.## Why it worksRecon is a directed flow: roots → subdomains → resolve → live → ports → nuclei. Wiring theProjectDiscovery tools together (each reads/writes lines) makes it composable, and diffingagainst last run (`anew`) turns it into continuous monitoring that alerts on change.## Method1. **Pipeline (each stage feeds the next):** ``` subfinder -dL roots.txt -all -silent \ | dnsx -silent -a -resp-only \ | httpx -silent -sc -title -tech-detect \ | tee live.txt \ | nuclei -silent -severity low,medium,high,critical ```2. **Diff for "only new"**: pipe each stage through `anew subs.txt` / `anew live.txt` so reruns emit only newly-seen lines — the basis of continuous monitoring.3. **Notify**: pipe results to `notify` (Slack/Discord/Telegram) so new hosts/findings alert you.4. **Schedule** with cron/systemd-timer/GitHub Actions; persist state files per program so runs resume.5. **Keep templates current**: `nuclei -update-templates` before each run.## Gotchas- Stay in scope: feed only in-scope roots, filter out-of-scope hosts before scanning.- Respect rate limits (`-rl`, `-c`) and program automation rules — don't hammer.- De-dupe wildcard DNS (`dnsx` wildcard filtering) or you'll alert on noise forever.## Verify successA rerun surfaces only newly-appeared assets/findings and notifies you — hands-off continuous coverage.## ReferencesProjectDiscovery pipeline docs; TomNomNom `anew`; nuclei templates.

Frequently asked questions