recon

Run subdomain enumeration, DNS resolution, live-host probing, and nmap scanning on a target.

18|3|Updated Apr 16, 2026
One-click install
npx skills add https://github.com/Kalp1774/akira --skill recon-kalp1774
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: recon
Source: https://github.com/Kalp1774/akira/tree/main/skills/recon
Command: npx skills add https://github.com/Kalp1774/akira --skill recon-kalp1774

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates the tedious, error-prone work of running multiple reconnaissance tools, aggregating outputs, and producing evidence-gated findings so downstream phases receive consistent, machine-readable intel.

Core Features & Use Cases

  • Orchestrated Recon Execution: Runs the recon toolkit against a target, including subdomain enumeration, DNS resolution, live host probing, and port scanning.
  • Evidence-Gated Summaries: Consolidates results into interesting_recon.md with a clear Status, Summary, Key Findings, and raw evidence references for anti-hallucination validation.
  • Session Integration: Updates session.json with live_hosts, open_ports, technologies, and marks the recon node as done to hand off to subsequent phases. Use this when starting phase 1 of an engagement or when the user asks to "run recon" or "start recon".

Quick Start

Run the recon skill on example.com to enumerate subdomains, detect live hosts and open ports, write interesting_recon.md, and update the engagement session.

Frequently Asked Questions about recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and nmap port scanning for a pentest target?

Automated pentest recon orchestrates subdomain enumeration, DNS resolution, live host probing, and nmap port scanning into a single workflow. It consolidates raw tool outputs into a structured markdown summary and updates session.json with discovered live hosts and open ports.

What is the best way to aggregate recon results from multiple tools into a single report?

Aggregating recon results involves consolidating subdomain, live-host, and port intelligence into an evidence-gated markdown file. The process extracts key findings and raw evidence references, then writes live_hosts, open_ports, and technologies into a machine-readable session.json file for downstream phases.

How does automated reconnaissance integrate live hosts and open ports into an engagement session?

Automated reconnaissance integrates findings by updating session.json with intel.live_hosts, intel.open_ports, and intel.technologies. It marks the recon node status as done, providing a structured handoff for downstream exploit and triage phases during phase 1 engagement workflows.

Can I use automated recon to resolve DNS and probe live hosts without manual tool configuration?

Yes, automated recon runs a toolkit to resolve DNS and probe live hosts without manual configuration for each step. It reads toolkit outputs from the target's results directory, validates findings against raw evidence, and generates an anti-hallucination summary for the engagement.

When do I need to run automated host discovery and URL intelligence collection?

Automated host discovery and URL intelligence collection is needed during phase 1 of a penetration test. Running this recon workflow is required when starting an engagement to map the attack surface, identify live hosts, and gather port data for downstream triage.

Why does my pentest recon workflow need an evidence-gated summary?

An evidence-gated summary prevents hallucination by validating extracted intelligence against raw tool outputs. It ensures downstream exploit phases receive consistent, machine-readable intel by mapping key findings directly to evidence references in the generated markdown report and session.json.