Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Reconnaissance & OSINT · hypnguyen1209 | DecimalAI

securityby hypnguyen1209

Reconnaissance & OSINT

hypnguyen1209/recon-osint

Source hypnguyen1209/offensive-claude ↗License MIT

Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)

SkillScore82Maintained

Automatic

Security & AppSec pack

Last verified 8/21/2026

What it changes

Passed 17 of 21 test cases with the skill, and 13 of 21 without it.

Without skill64%

With skill82%

Checks it passed that the model alone missed

Uses Shodan InternetDB for passive exposure mapping.
Recommends alterx for subdomain permutation generation.
Recommends using AADInternals for Azure tenant discovery.

and 1 more in the full report

4 fixed14 passed either way4 still failing0 broke

Pass-rate lift: +18 pp
Tokens: +169%
Agent turns: 0%
Response time: +2%

Model gemini-3.6-flashMeasured 8/21/2026v118 of 22 cases passed with skill · 21 comparable

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/hypnguyen1209-recon-osint/SKILL.md https://app.decimal.ai/s/hypnguyen1209-recon-osint/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add hypnguyen1209-recon-osint, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/hypnguyen1209-recon-osint/ and pins it in .decimal/skills.lock

decimalai skills add hypnguyen1209-recon-osint

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hypnguyen1209-recon-osint/SKILL.md https://app.decimal.ai/s/hypnguyen1209-recon-osint/SKILL.md

Raw file: /s/hypnguyen1209-recon-osint/SKILL.md ↗ · machine-readable summary at /s/hypnguyen1209-recon-osint.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

See it in action

One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.

1 of 3

Prompt

I have a list of live web hosts and public IP addresses from our latest external scan of techfirm.net. I need you to analyze the tech stack fingerprints on these hosts, cross-reference them against known vulnerabilities, and prioritize the findings based on exploit availability and external risk. Return a prioritized triage table detailing the affected hosts, identified CVEs, and recommended remediation urgency.

What was checked, without and with the skill
Checked	Without skill	With skill
Incorporates EPSS scoring for vulnerability prioritization.	Missed	Passed

case-03 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted

What's inside

The instructions your model reads when the skill loads.

SKILL.md79 lines15 filesincludes scripts

Reconnaissance & OSINT

When to Activate

A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.
Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.
Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).
Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.
Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Passive subdomain enum (subfinder/amass/CT logs)	T1590.002, T1596.001	CWE-200	references/subdomain-discovery.md	scripts/recon_orchestrator.py
DNS brute / permutation / resolution (puredns/alterx/dnsx)	T1595.002, T1590.002	CWE-200	references/subdomain-discovery.md	scripts/recon_orchestrator.py
ASN → CIDR → reverse-DNS expansion	T1590.005, T1596.005	CWE-200	references/subdomain-discovery.md	scripts/recon_orchestrator.py
HTTP probing + tech fingerprint (httpx)	T1595.002, T1592.002	CWE-200	references/attack-surface-mapping.md	scripts/recon_orchestrator.py
Headless crawling + archive URLs (katana/gau)	T1595.002, T1593.003	CWE-200	references/attack-surface-mapping.md	scripts/js_secret_hunter.py
JavaScript endpoint / secret extraction	T1593.003, T1552.001	CWE-540	references/attack-surface-mapping.md	scripts/js_secret_hunter.py
Subdomain takeover (dangling CNAME/NS)	T1583.001, T1584.001	CWE-350	references/subdomain-takeover.md	scripts/subdomain_takeover.py
Deleted-S3 takeover → supply-chain pivot	T1583.001, T1195.002	CWE-350	references/subdomain-takeover.md	scripts/subdomain_takeover.py
Multi-cloud bucket/blob enum (cloud_enum)	T1580, T1596.005	CWE-732	references/cloud-saas-recon.md	scripts/cloud_asset_enum.py
Azure tenant outsider recon (AADInternals)	T1590.001, T1589	CWE-200	references/cloud-saas-recon.md	scripts/cloud_asset_enum.py
GitHub/GitLab dorking + secret scanning	T1593.003, T1213.003	CWE-540	references/cloud-saas-recon.md	scripts/cloud_asset_enum.py
Email/username harvesting (theHarvester)	T1589.002, T1591	CWE-200	references/breach-credential-intel.md	scripts/breach_intel.py
Breach + infostealer credential intel (HIBP/DeHashed)	T1589.001, T1596	CWE-522	references/breach-credential-intel.md	scripts/breach_intel.py
CVE enrichment + prioritization (NVD/EPSS/KEV)	T1592.002, T1596	CWE-1395	references/cve-exploit-intel.md	scripts/cve_prioritizer.py
Shodan InternetDB exposure → CVE mapping	T1596.005, T1595.002	CWE-200	references/cve-exploit-intel.md	scripts/cve_prioritizer.py

Quick Start

export DOMAIN=target.com
# 0. Validate resolvers once (puredns needs a clean list)
dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt

# 1. Full discovery + probe + crawl + takeover + nuclei, JSONL out (see orchestrator)
python3 scripts/recon_orchestrator.py -d $DOMAIN -o out/ --resolvers resolvers.txt --nuclei

Track record

Benchmark

17 / 21

test cases passed, vs 13 / 21 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

hypnguyen1209 / offensive-claude

skills/recon-osint/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1Bundled 14 files · scripts

More skills from the same source and nearby in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

See it in action

What's inside

Reconnaissance & OSINT

When to Activate

Technique Map

Quick Start

Track record

Benchmark

Adoption

SkillSafety

Source

Related skills