How do I install the Recon Ng skill?

Run npx skillmds@latest add timsonner/recon-ng in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Recon Ng safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon Ng?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon Ng free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Recon Ng?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon Ng by timsonner — Agent Skill

Name: Recon Ng
Author: timsonner

File contents

Recon-ng

Purpose

Use this skill for structured, modular recon when the engagement benefits from organizing passive findings into a workspace.

Phase Fit

Primary: Discovery and Reconnaissance
Secondary: Threat Modeling and Test Planning

Use When

Need organized passive recon across public sources.
Need to correlate company, domain, contact, and infrastructure leads.
Need a repeatable recon workspace for long engagements.

Avoid When

Passive recon scope is unclear.
Results would be treated as confirmed exposure without validation.

Inputs

Approved company or domain scope
Module set aligned to the recon objective
Output handling and reporting needs

Procedure

Create a workspace for the specific approved objective.
Use only the modules relevant to the current question.
Correlate leads rather than collecting indiscriminately.
Hand confirmed candidates to direct validation tools.
Preserve the workspace and module path for later comparison.

Command Syntax

Launch syntax is simple; resource files are the most reliable way to show repeatable module execution from the command line.

# Launch the framework
recon-ng

# Launch with a named workspace
recon-ng -w contoso

# Run a resource file non-interactively
recon-ng -w contoso -r contoso-recon.rc

# Inside the recon-ng console:
workspaces create contoso
db insert domains contoso.com
marketplace install recon/domains-hosts/bing_domain_web
modules load recon/domains-hosts/bing_domain_web
options set SOURCE contoso.com
run
modules load reporting/html
options set FILENAME /tmp/contoso-recon.html
run

Evidence to Capture

Passive recon leads relevant to the approved scope
Exact module set and workspace used
What was validated versus what remained a lead

Safety Boundaries

Keep recon passive and scope bound.
Treat all output as unverified until corroborated.

---name: recon-ngdescription: Use for modular passive reconnaissance during authorized pentests. Trigger on domain and company profiling, contact and infrastructure lead generation, and correlating public-source recon with approved scope.license: MIT---# Recon-ng## PurposeUse this skill for structured, modular recon when the engagement benefits from organizing passive findings into a workspace.## Phase Fit- Primary: Discovery and Reconnaissance- Secondary: Threat Modeling and Test Planning## Use When- Need organized passive recon across public sources.- Need to correlate company, domain, contact, and infrastructure leads.- Need a repeatable recon workspace for long engagements.## Avoid When- Passive recon scope is unclear.- Results would be treated as confirmed exposure without validation.## Inputs- Approved company or domain scope- Module set aligned to the recon objective- Output handling and reporting needs## Procedure1. Create a workspace for the specific approved objective.2. Use only the modules relevant to the current question.3. Correlate leads rather than collecting indiscriminately.4. Hand confirmed candidates to direct validation tools.5. Preserve the workspace and module path for later comparison.## Command SyntaxLaunch syntax is simple; resource files are the most reliable way to show repeatable module execution from the command line.```bash# Launch the frameworkrecon-ng# Launch with a named workspacerecon-ng -w contoso# Run a resource file non-interactivelyrecon-ng -w contoso -r contoso-recon.rc# Inside the recon-ng console:workspaces create contosodb insert domains contoso.commarketplace install recon/domains-hosts/bing_domain_webmodules load recon/domains-hosts/bing_domain_weboptions set SOURCE contoso.comrunmodules load reporting/htmloptions set FILENAME /tmp/contoso-recon.htmlrun```## Evidence to Capture- Passive recon leads relevant to the approved scope- Exact module set and workspace used- What was validated versus what remained a lead## Safety Boundaries- Keep recon passive and scope bound.- Treat all output as unverified until corroborated.

Frequently asked questions

Recon Ng