recon-full

Orchestrate gated reconnaissance pipelines with OSINT and active probing.

Updated Jul 30, 2026
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-full-salmanabdurrahman
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: recon-full
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/recon-full
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-full-salmanabdurrahman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of fragmented reconnaissance by providing a unified, gated, and policy-compliant orchestration layer for security assessments, ensuring all discovery activities are authorized and structured.

Core Features & Use Cases

  • Modular Pipeline: Sequences passive OSINT, subdomain discovery, web surface mapping, and JS analysis into a single workflow.
  • Safety-First Execution: Enforces strict authorization, scope validation, and rate-limiting gates before any active probing occurs.
  • Use Case: Use this skill to perform a full-scale reconnaissance engagement on a target domain, ensuring that every step from initial OSINT to final asset inventory is documented, redacted, and compliant with your engagement scope.

Quick Start

Use the recon-full skill to initiate a full reconnaissance pipeline for target.com using the bug-bounty mode.

Frequently Asked Questions about recon-full

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate reconnaissance and vulnerability surface mapping for authorized pentest engagements?

You can automate reconnaissance by orchestrating a multi-phase pipeline that sequences passive OSINT, subdomain discovery, and web surface mapping. This approach ensures structured asset discovery and vulnerability surface mapping for authorized security assessments.

What is the best way to ensure scope validation and authorization compliance during security assessments?

To ensure scope validation and authorization compliance, use a gated reconnaissance pipeline that enforces strict authorization checks and rate-limiting before active probing. This approach requires authorization proof and validates scope across all discovery phases.

Can I perform red-team and bug-bounty reconnaissance using a single automated workflow?

Yes, you can perform red-team and bug-bounty reconnaissance using a unified orchestration layer. It sequences passive intelligence gathering and gated active probing into a single workflow, ensuring structured asset discovery for these engagement types.

How does a gated reconnaissance pipeline handle passive OSINT and active probing?

A gated reconnaissance pipeline handles passive OSINT and active probing by strictly sequencing intelligence gathering before any active probing occurs. Safety-first execution gates validate scope, authorization, and rate limits before initiating active web surface mapping.

Does automated reconnaissance support evidence redaction for forensic engagements?

Yes, automated reconnaissance supports evidence redaction for forensic engagements. The orchestration pipeline documents every step from initial OSINT to final asset inventory and applies evidence redaction across all reconnaissance phases to ensure compliance.

When should I not use an automated pentest recon pipeline?

You should not use an automated pentest recon pipeline when authorization proof or scope validation is unavailable. The pipeline enforces strict safety gates and policy compliance, meaning it will halt active probing if engagement scope cannot be validated.