What problem does it solve? Security auditors and code reviewers waste hours orienting themselves in unfamiliar codebases before they can find vulnerabilities. This Skill provides a structured, five-phase methodology to map architecture, trust boundaries, entry points, and security-critical functions before deep analysis begins. ## Core Features & Use Cases - Phased Recon Methodology: Progresses from overview and technology stack detection through architecture mapping, module deep dives, function-level analysis, and detail reconnaissance. - Trust Boundary & Entry Point Mapping: Produces concrete artifacts like endpoint inventories, data flow diagrams, and call graphs for security-critical functions. - Ready-Made Resources: Includes a recon checklist, a security question bank, a context document template, advanced techniques (CodeQL, AST analysis, smart contract storage inspection), and a full FastAPI walkthrough example. - Use Case: Before auditing a DeFi protocol or web API, run the recon phases to produce a Security Context Document identifying high-risk areas like race conditions in order creation or missing webhook idempotency checks. ## Quick Start Use the code-recon skill to build a security context document for this repository, mapping its architecture, trust boundaries, and highest-risk functions.
