How to use the Attack Surface Recon agent skill

What the skill makes the agent do

The skill tells the agent to start an assessment with attack surface mapping rather than jumping straight to exploitation. Recon is split into two phases. The passive phase is meant to not touch the target directly: WHOIS lookups, certificate transparency searches on crt.sh, DNS comparisons across resolvers, archived URLs from the Wayback Machine, and FOFA and Shodan searches run through the browser.

The active phase then sends traffic to the targets. The source lists a pipeline using subfinder, dnsx, httpx, naabu, nmap, katana, gau, ffuf and nuclei to enumerate subdomains, confirm which hosts are alive, fingerprint technologies, find open ports and URLs, and run vulnerability templates.

• Spotting CDNs by comparing DNS answers from different resolvers
• Recognising catch-all nginx servers, which return the same response for any path
• Identifying common hosting panels and their login patterns
• Recording findings as it goes, so they are kept in the project

Install the skill (ZIP download or Claude apps)

The skill ships as a single file, SKILL.md. Download the ZIP from the item page and unzip it into one of two places. For a personal setup, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

Install the tools the skill expects

The skill does not install its tools for you. It calls command-line programs that must already be available. The source lists whois, amass, curl, dig, python3, subfinder, dnsx, httpx, naabu, nmap, katana, gau, ffuf and nuclei. It also expects SecLists wordlists at /usr/share/seclists and Nuclei templates at /root/nuclei-templates, and a browser navigation tool for crt.sh, FOFA and Shodan lookups.

The skill also refers to a second skill, component-vuln-intel, and to reference files that are not included in the SKILL.md you download. Expect some workflow steps to be incomplete without them.

How to trigger it with a natural request

The skill's description says to use it when starting recon, asset mapping, fingerprinting, or CDN/DNS bypass discovery. You do not need a special command. Describe the task in plain terms and name the authorised target and scope.

Be explicit about the engagement. A request that states the domain, that you have written permission, and what is in scope gives the agent the context it needs to choose the passive or active steps.

• "We have a signed pentest agreement for example.com. Start with attack surface recon and tell me what is exposed before any exploitation."
• "Map the subdomains and live web hosts for example.com, passive sources first."
• "I'm on a bug bounty for example.com. The scope is *.example.com only. Run recon and fingerprint the web stack."
• "Find out whether example.com sits behind a CDN and whether DNS answers differ between resolvers."

Example workflow from start to finish

A typical run begins with the passive lookups: WHOIS for the registrant, crt.sh for certificate-listed hostnames, DNS queries against 114.114.114.114, 8.8.8.8 and 1.1.1.1 to compare answers, and FOFA and Shodan searches. The results give you a candidate list of hostnames and hints about hosting.

Next the active pipeline merges subdomain sources, checks which names resolve, runs httpx for titles, status codes and technology detection, then scans ports and crawls URLs. Nuclei runs last, limited to medium, high and critical severities. The skill also says that when httpx identifies a framework or version, the agent should move to the component-vulnerability intelligence step before going deeper.

• Passive first, then active
• Save results to files such as subs.txt, alive_subs.txt, httpx_out.txt and nuclei_results.txt
• Map the attack surface before choosing where to look for weaknesses

Safety notes: scripts and network access

This skill runs scripts and uses the network. The active steps send traffic to targets, and the source notes that active scanning and fuzzing can be illegal and disruptive without authorisation. Run it only against systems you own or have written permission to test, and respect the program's scope.

Some passive steps still make network requests to third-party services such as crt.sh, FOFA, Shodan and the Wayback Machine. Passive does not mean invisible to those services. Check your engagement rules before running any command.

• Do not use it on systems you do not own or lack written permission to test
• Do not use it where policy or contract prohibits active scanning
• Review each command before the agent runs it, especially ffuf, naabu and nuclei

Tips for getting useful output

The skill assumes you already understand nmap, DNS and HTTP responses, so read the output critically rather than trusting it. Compare subdomain lists against your scope before scanning. When a host returns 502, 404 and 403 for different paths, the skill treats those codes as different signals, so keep the raw responses.

Keep the notes the agent writes. The recon record is what lets you repeat the checklist for a later engagement.

• Confirm scope before the active phase starts
• Keep raw output files so you can recheck results
• Treat CDN IPs and wildcard DNS results with care, since they can hide the real origin