recon-roofing

Name: recon-roofing
Availability: InStock
Author: entrovyx

Automate reconnaissance and vulnerability discovery for roofing company websites.

3|1|Updated Jul 2, 2026

Search Tags:#vulnerability #wordpress #pii #pentest #recon #roofing

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-roofing-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: recon-roofing
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/recon-roofing
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill recon-roofing-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill automates the identification of security vulnerabilities specific to the roofing industry, which often relies on poorly secured WordPress sites, lead-capture forms, and insurance document portals.

Core Features & Use Cases

Sector-Specific Recon: Identifies common roofing company site patterns, including insurance claim pages and estimate request forms.
Vulnerability Discovery: Detects exposed PII in debug logs, insecure directory listings of lead submissions, and misconfigured CORS policies.
Use Case: Quickly audit a list of roofing company domains to find exposed customer data in CSV exports or insecure file upload endpoints that could lead to remote code execution.

Quick Start

Use the recon-roofing skill to perform a full security audit on the target domain provided in the current context.

Frequently Asked Questions about recon-roofing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find exposed PII in roofing company WordPress sites?▼

To find exposed PII in roofing company WordPress sites, you can automate reconnaissance targeting lead capture forms, insurance document upload portals, and exposed debug logs to identify data leaks and misconfigurations.

What is the best way to audit roofing websites for insecure file upload endpoints?▼

Auditing roofing websites for insecure file upload endpoints involves scanning estimate request forms and insurance claim pages to detect misconfigurations that could lead to remote code execution or exposed customer data.

Does this reconnaissance require specialized penetration testing software?▼

No specialized penetration testing software is required; this reconnaissance relies on standard Linux command-line utilities including curl, grep, and python3 for parsing JSON and XML responses to detect vulnerabilities.

How do I detect misconfigured CORS policies on insurance document portals?▼

Detecting misconfigured CORS policies on insurance document portals is achieved by automating sector-specific reconnaissance to identify exposure patterns in WordPress-based portals and lead submission directory listings.

Can I scan a list of domains for exposed customer data in CSV exports?▼

Yes, you can audit a list of roofing company domains to quickly find exposed customer data in CSV exports, insecure directory listings of lead submissions, and misconfigured file upload endpoints.

What limitations exist when parsing XML and JSON responses for vulnerability discovery?▼

Limitations when parsing XML and JSON responses for vulnerability discovery include relying strictly on standard Linux command-line utilities, which may require manual configuration to target specific WordPress misconfigurations accurately.