web-recon

Map target technologies, routes, and observable interfaces into typed case observations.

10|3|Updated Aug 10, 2026
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill web-recon-baiqigo
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: web-recon
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/web-recon
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill web-recon-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security assessments need a structured, repeatable way to turn raw HTTP observations of a target into normalized, deduplicated records of technologies, endpoints, and parameters that downstream analysis can consume. ## Core Features & Use Cases - Scoped Surface Mapping: Captures one bounded baseline per entry point and maps routes plus client-visible API references, verifying every request candidate stays inside the assigned scope snapshot. - Observation Normalization: Collapses duplicate technologies, endpoints, methods, parameters, redirects, and blockers into stable entity keys linked to source artifacts. - Typed Worker Results: Returns a schema-validated WorkerResult with graph relations and the smallest useful next capabilities for the orchestrating supervisor. - Use Case: A supervisor assigns the web.recon.surface capability for an authorized target; the worker baselines each entry point, maps the routes, and returns a validated result the attack-graph pipeline can consume. ## Quick Start Assign the web.recon.surface capability with an authorized target scope and ask the worker to map the target's routes and technologies into a typed WorkerResult.

Frequently Asked Questions about web-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map a web application's routes and technologies during recon?

Assign the web.recon.surface capability with a defined scope. The worker captures one bounded baseline per entry point, maps routes and client-visible API references from those artifacts, and normalizes the findings into typed observations.

What output format does web recon produce for downstream analysis?

It returns a typed WorkerResult validated against the worker-result-v1 JSON schema. The result includes graph relations, stable entity keys for endpoints and technologies, and the smallest useful next capabilities for the supervisor.

Does web recon stay within an authorized target scope?

Yes. The procedure requires that every request candidate be shown to be inside the assigned scope snapshot before proceeding. Each observation must also link back to a source artifact for traceability.

How are duplicate endpoints and technologies handled during recon?

Normalization collapses duplicate technologies, endpoints, methods, parameters, redirects, and blockers into stable entity keys. The step finishes only when duplicates have been merged, keeping the observation set consistent.

What are the limitations of passive-style web surface mapping?

It only covers observable interfaces reachable through bounded baseline captures, so hidden routes requiring authentication or deep interaction may be missed. It is a recon step, not vulnerability exploitation, and depends on accurate scope assignment.