recon-for-sec

Route reconnaissance workflows from scope mapping to relevant security test paths.

2|Updated May 15, 2026
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill recon-for-sec-lnwnl
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: recon-for-sec
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/recon-for-sec
Command: npx skills add https://github.com/lNwNl/Methodos --skill recon-for-sec-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you turn an unknown target into a structured, high-signal reconnaissance plan by routing you from initial scope to the most valuable next security testing path.

Core Features & Use Cases

  • Recon-first methodology routing: Guides you to start with asset discovery, fingerprinting, and endpoint inventory rather than random enumeration.
  • Structured next-step decisioning: Routes follow-up testing toward the most relevant areas such as API security, auth security, injection checking, or business-logic vulnerabilities.
  • Scope-to-discovery workflow: Focuses on confirming in-scope assets and target type before collecting findings that drive subsequent testing.

Quick Start

Use the recon-for-sec skill to confirm your target’s in-scope assets, then run asset discovery and fingerprinting to generate a prioritized first testing path.

Frequently Asked Questions about recon-for-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is attack surface mapping and how does it guide security testing?

Attack surface mapping discovers in-scope assets and fingerprints technologies to generate a structured reconnaissance plan, routing subsequent security testing toward the most relevant initial paths like API or auth security.

How do I start asset discovery and endpoint inventory for a new target?

Start asset discovery by confirming in-scope assets and target types first, then perform technology fingerprinting and endpoint inventory to collect findings that drive your initial testing path.

When should I use a reconnaissance methodology instead of random enumeration?

Use a reconnaissance methodology when mapping an unknown target to ensure structured scope confirmation, asset discovery, and fingerprinting before routing to specific tests like injection checking or business-logic vulnerabilities.

How does reconnaissance routing decide between API security and auth security testing?

Reconnaissance routing selects the next security testing path by analyzing collected findings from asset discovery and fingerprinting, directing you toward api-sec, auth-sec, injection-checking, or business-logic-vuln based on the results.

Can I use this reconnaissance workflow for business-logic vulnerability testing?

Yes, the reconnaissance workflow routes you to business-logic vulnerability testing by first establishing an endpoint inventory and technology fingerprint, ensuring your business-logic checks target confirmed in-scope assets.

What are the limitations of methodology-driven reconnaissance for security testing?

Methodology-driven reconnaissance focuses on scope mapping and initial routing rather than deep exploitation, meaning you must follow up with specialized testing paths like API or injection checking to find actual vulnerabilities.