recon-agent

Extract API endpoints and metadata from web application JavaScript assets.

54|5|Updated May 9, 2026
One-click install
npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill recon-agent
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: recon-agent
Source: https://github.com/jinyimeng01/mastermind-bug-bounty/tree/main/agents/recon
Command: npx skills add https://github.com/jinyimeng01/mastermind-bug-bounty --skill recon-agent

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the challenge of systematically collecting and analyzing application reconnaissance data by organizing JS discovery, endpoint mapping, technology fingerprinting, and source exposure analysis into a repeatable workflow.

Core Features & Use Cases

  • JS Reconnaissance Analysis: Collects frontend assets, analyzes JavaScript bundles, extracts API endpoints, request patterns, routes, secrets, and application metadata.
  • Attack Surface Mapping: Identifies technologies, API parameters, SPA routes, leaked values, dependency risks, and potential exposure points for authorized security assessments.
  • Use Case: A security researcher conducting an authorized bug bounty assessment can use this Skill to build a structured map of a web application's frontend attack surface before deeper testing.

Quick Start

Use the recon-agent skill to analyze the target application's JavaScript assets and generate endpoint mapping, technology fingerprinting, and reconnaissance findings.

Frequently Asked Questions about recon-agent

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract API endpoints from JavaScript bundles for security reconnaissance?

To extract API endpoints from JavaScript bundles for security reconnaissance, the Skill automates the collection and analysis of frontend assets to map API endpoints, request patterns, and application metadata for authorized penetration testing.

What is the best way to map a web application's attack surface before bug bounty testing?

Mapping a web application's attack surface for bug bounty testing involves identifying technologies, SPA routes, leaked values, and exposure points, which this Skill organizes into a structured, repeatable reconnaissance workflow.

How do I identify technology fingerprints and source exposure points in a web app?

Identifying technology fingerprints and source exposure points requires analyzing frontend assets and JavaScript bundles to discover dependency risks and potential exposure points for application security reviews.

Can I use automated JavaScript analysis for authorized penetration testing?

Yes, you can use automated JavaScript analysis for authorized penetration testing to systematically collect and analyze application reconnaissance data, extracting routes, secrets, and security-relevant metadata.

Does web application reconnaissance require validation gates for completeness tracking?

Web application reconnaissance requires structured endpoint extraction and validation gates for completeness tracking to ensure systematic collection of frontend assets and API discovery data.

Why do I need to organize JS discovery and endpoint mapping into a structured workflow?

Organizing JS discovery and endpoint mapping into a structured workflow solves the challenge of systematically collecting reconnaissance data, ensuring repeatable attack surface discovery and technology identification.