passive-recon

Passive intelligence gathering without touching the target — DNS, WHOIS, subdomain enumeration, Certificate Transparency, technology fingerprinting, ASN mapping.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md

Quality

Content

77%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill body is highly actionable with copy-paste commands and a clear workflow plus validation decision gate, but it is verbose for a SKILL.md and keeps detailed command reference inline rather than pushing it to the bundled reference file. Trimming concept explanations and offloading detail to dns-techniques.md would improve conciseness and progressive disclosure.

Suggestions

Trim concept explanations Claude already knows (e.g. what CT logs are, what MX/TXT records reveal) and keep only operational 'what to look for' guidance.

Move the detailed per-tool command reference out of the body into references/dns-techniques.md, leaving the SKILL.md as an overview plus quick-reference and pointers.

Add an inline validation checkpoint inside the Section 10 workflow (e.g. verify dedup/wildcard filtering before probing) so the gate is part of the flow rather than only at its end.

Dimension	Reasoning	Score
Conciseness	The body is mostly an efficient command reference, but it includes concept explanations Claude already knows (e.g. "CT logs are a public, immutable record of all TLS certificates issued") and analysis prose that could be tightened, fitting the 'mostly efficient but includes some unnecessary explanation' anchor.	2 / 3
Actionability	It provides fully executable, copy-paste-ready commands throughout — whois, dig, subfinder, amass, httpx, and crt.sh pipelines — matching the anchor for fully executable, specific, copy-paste-ready guidance.	3 / 3
Workflow Clarity	Section 10 gives a sequenced 9-step workflow, Section 11 provides an explicit decision-gate checklist, and Section 9 offers an error-recovery table as a feedback loop, satisfying the anchor for clear sequence with validation steps and checklists.	3 / 3
Progressive Disclosure	The bundled reference and script are well-signaled and one-level-deep, but the ~300-line body itself is a detailed command reference that overlaps the bundled dns-techniques.md, so content that could be separate is inline — fitting the 'some structure but could be better organized' anchor rather than a clean overview-with-pointers.	2 / 3
	Total	10 / 12 Passed

Description

67%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, clearly naming the passive recon capabilities, but it lacks an explicit 'Use when...' trigger clause and misses several natural trigger phrases users would say. Adding a trigger clause with colloquial terms like 'passive recon' and 'footprinting' would raise completeness and trigger-term quality.

Suggestions

Append an explicit trigger clause, e.g. 'Use when performing passive recon, footprinting, or gathering DNS/WHOIS/subdomain intelligence without touching the target.'

Add natural colloquial trigger terms users say — 'passive recon', 'reconnaissance', 'footprinting' — alongside the technical capability list.

Consider mentioning the active-vs-passive boundary briefly in the description so the skill does not trigger for active scanning requests.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete capabilities — "DNS, WHOIS, subdomain enumeration, Certificate Transparency, technology fingerprinting, ASN mapping" — matching the anchor for multiple specific concrete actions rather than vague language.	3 / 3
Completeness	It clearly answers what the skill does but contains no explicit "Use when..." trigger clause, and the rubric states a missing trigger clause caps completeness at 2; it is not 1 because the 'what' is strong.	2 / 3
Trigger Term Quality	It includes natural terms users say (DNS, WHOIS, subdomain) but omits common colloquial variations such as "passive recon", "reconnaissance", or "footprinting", fitting the 'some relevant keywords but missing common variations' anchor.	2 / 3
Distinctiveness Conflict Risk	The passive infrastructure-recon niche is clearly delineated and the skill body scopes an explicit boundary against the osint skill, making conflict with other skills unlikely.	3 / 3
	Total	10 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md
Commit: e34afba

Reviewed: 11 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.