Recon

Run the domain recon workflow, which queries certificate transparency logs via crt.sh and DNS records to discover subdomains passively. Active subdomain brute forcing is available but requires explicit authorization before execution.

Passive recon uses public sources like WHOIS, DNS, certificate transparency, and the IPInfo API without touching the target, requiring no authorization. Active recon includes port scanning and service detection, which requires documented authorization such as a pentest contract or bug bounty scope.

Use the BountyPrograms tool with the check command followed by a domain, or search by keyword. It queries a cached database aggregated from ProjectDiscovery Chaos, HackerOne, and Bugcrowd listing programs, bounty types, and in-scope domains.

Yes, active scanning tools like naabu and httpx require switching to the security MCP profile using the swap-mcp command and restarting Claude Code. Passive recon works with standard system tools like whois and dig with no extra setup.

Yes, the AnalyzeScanResultsGemini3 workflow feeds scan outputs to Gemini 3 Pro, whose 1M token context handles massive datasets. It identifies high-value targets, service version clusters, anomalies, and generates prioritized attack path and remediation reports.

Never run active scans against systems without written authorization, out-of-scope bug bounty targets, critical infrastructure, or government systems. The skill defaults to passive-only mode and requires explicit confirmation plus documented authorization before any active technique.