What problem does it solve? Starting a bug-bounty engagement without a structured map of the target's attack surface leads to missed endpoints, out-of-scope probing, and unorganized findings. This Skill runs a directed reconnaissance pipeline that stays within program scope and produces a routed candidate surface instead of raw URL dumps. ## Core Features & Use Cases - JS-bundle-first mining: Extract hidden endpoints, routes, feature flags, and secret-shaped strings from source maps and webpack chunks before any brute enumeration. - Full enumeration pipeline: Subdomain discovery (subfinder/amass), live-host probing (httpx), JS-aware crawling (katana), historical URLs (gau/waybackurls), and parameter mining (Arjun), each with documented fallbacks. - Class-based routing: Bucket candidates with gf patterns and route each item to the matching CWE hunter (SSRF, XSS, SQLi, IDOR, path traversal, and more) as an observation, not a finding. - Use Case: At the start of an engagement against a new bug-bounty target, run this Skill to build a scoped surface map in notes/recon/surface-map.md and refresh pre_scan.yaml with unresolved candidates for the hunters. ## Quick Start Run the recon skill to map the attack surface of the current target and route the discovered endpoints to the appropriate vulnerability hunters.
