recon-scope-triage

Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the brand name, so for any target whose name is a common/dictionary word, the output is dominated by assets belonging to UNRELATED same-named companies (repos, cloud buckets, mobile apps, breach corpora, typosquats). Built from an authorized engagement where an ASM report's "Criticals" were overwhelmingly false positives and the combo/repos/mobile/bucket lists were polluted with unrelated same-named orgs. Use at the START of any engagement, immediately on receiving any ASM/recon/OSINT dataset, BEFORE testing anything.

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean, actionable, and organized around a clear validation-heavy triage workflow with concrete bash controls and a decision-criteria table. It is self-contained with good sectioning, though the calibration section adds mild verbosity.

Suggestions

Trim the 'Why this matters (calibration)' section — its collision examples restate the table above it; keep only the engagement-derived lesson to tighten conciseness toward a 5.

Add one runnable snippet for an asset class besides soft-404 (e.g., a one-liner to extract a mobile app's package reverse-DNS or check a bucket's owner metadata) to lift actionability from 4 to 5.

Consider extracting the collision-source table into a references/ file if the skill grows, to preserve progressive_disclosure at 5 as more asset classes are added.

Dimension	Reasoning	Score
Conciseness	Mostly efficient — uses a compact table and copy-paste bash without explaining basics Claude already knows; the 'Why this matters (calibration)' section is somewhat padded with repeated collision examples, keeping it just below a 5.	4 / 5
Actionability	Provides a fully executable bash soft-404 control (curl + cmp) and concrete verify-by signals (repo owner, org-email commits, package reverse-DNS, exact-domain match); not a 5 because most asset-class guidance is decision criteria rather than runnable commands, leaving minor gaps.	4 / 5
Workflow Clarity	A 5-step triage workflow with explicit validation checkpoints ('No signal → quarantine, don't test'), a junk-path control feedback loop (identical bytes → discard), and quarantine/delta-reporting feedback — matching the 5-anchor for a validation-centric skill.	5 / 5
Progressive Disclosure	Single self-contained file with well-signaled sections (When to use, collision-source table, soft-404 control, workflow, anti-patterns, related skills) and one-level cross-skill links; no bundle files exist to reference, and the calibration section could be trimmed, so it sits at 4 rather than 5.	4 / 5
	Total	17 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is third-person, specific, and explicitly states both what the skill does and when to use it with concrete trigger phrases. It carves a distinctive niche (namespace-collision ownership triage) with low conflict risk.

Dimension	Reasoning	Score
Specificity	Names the domain (ASM/recon ownership triage) and several concrete actions — 'separate the target's real assets from namespace-collision noise' across repos, cloud buckets, mobile apps, breach corpora, typosquats — with only minor coverage gaps; not a 5 because the core action ('triage/separate') is fewer distinct verbs than the 5-anchor's multiple-action list.	4 / 5
Completeness	Explicitly answers both 'what' ('Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise') and 'when' ('Use at the START of any engagement, immediately on receiving any ASM/recon/OSINT dataset, BEFORE testing anything') with concrete trigger phrases, matching the 5-anchor.	5 / 5
Trigger Term Quality	Good coverage of natural terms the intended audience would say — 'ASM report', 'recon export', 'breach combo', 'repo list', 'bucket list', 'mobile-app list', 'OSINT dataset' — with a few synonyms/extensions missing; not a 5 because some phrasing is engagement-jargon rather than the full synonym set users might utter.	4 / 5
Distinctiveness Conflict Risk	Clear niche — ownership triage of namespace collisions for dictionary-word brands — with distinct triggers (common-word brand name, implausibly high Critical count) and minimal conflict risk with other skills; matches the 5-anchor.	5 / 5
	Total	18 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/recon-scope-triage/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.