How do I install the Recon skill?

Run npx skillmds@latest add zyrexnn/recon in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Recon skill do?

Orchestrates scoped subdomain enumeration, DNS resolution, and active web probing for bug bounty targets. It is listed under Coding & Dev Tools on SkillMD.

Is Recon safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

zyrexnn (@zyrexnn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon by zyrexnn — Agent Skill

Name: Recon
Author: zyrexnn

File contents

Recon Skill — Subdomain & Asset Discovery

Purpose

Perform initial reconnaissance and asset mapping strictly within the authorized target scope.

Workflow

Target Setup & Subdomain Discovery: Use subfinder to discover subdomains for the requested target:

mkdir -p /workspace/recon/<target>
subfinder -d <target> -silent -o /workspace/recon/<target>/subfinder.txt

Asset Consolidation: Include the main target and discovered subdomains:

echo "<target>" >> /workspace/recon/<target>/subfinder.txt
sort -u /workspace/recon/<target>/subfinder.txt -o /workspace/recon/<target>/in_scope.txt

DNS Resolution: Use dnsx to resolve A, CNAME, and AAAA records:

dnsx -l /workspace/recon/<target>/in_scope.txt -silent -o /workspace/recon/<target>/resolved.txt

HTTP Probing: Use httpx to probe live web servers, extract status codes, page titles, and web tech stack:

httpx -l /workspace/recon/<target>/resolved.txt -silent -title -status-code -tech-detect -json -o /workspace/recon/<target>/httpx.json

Output Artifacts

/workspace/recon/<target>/subfinder.txt - Raw discovered subdomains
/workspace/recon/<target>/in_scope.txt - Validated in-scope hosts
/workspace/recon/<target>/resolved.txt - Live DNS resolving hosts
/workspace/recon/<target>/httpx.json - HTTP probe results with web technologies

Safety Guidelines

Never scan wildcards outside the allowed domain list.
Keep rate limits conservative (default: 10 req/s).

Frequently asked questions

Recon