What problem does it solve?
Automates the tedious, error-prone work of running multiple reconnaissance tools, aggregating outputs, and producing evidence-gated findings so downstream phases receive consistent, machine-readable intel.
Core Features & Use Cases
- Orchestrated Recon Execution: Runs the recon toolkit against a target, including subdomain enumeration, DNS resolution, live host probing, and port scanning.
- Evidence-Gated Summaries: Consolidates results into interesting_recon.md with a clear Status, Summary, Key Findings, and raw evidence references for anti-hallucination validation.
- Session Integration: Updates session.json with live_hosts, open_ports, technologies, and marks the recon node as done to hand off to subsequent phases. Use this when starting phase 1 of an engagement or when the user asks to "run recon" or "start recon".
Quick Start
Run the recon skill on example.com to enumerate subdomains, detect live hosts and open ports, write interesting_recon.md, and update the engagement session.