web2-recon

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a clearly sequenced, checkpointed recon workflow, but it is over-long and monolithic with redundant sections and a large inline wordlist that inflates token cost. Splitting reference material into bundle files and de-duplicating the stack-fingerprinting guidance would lift both conciseness and progressive disclosure.

Suggestions

Move the swagger/OpenAPI path wordlist into a references file (e.g. references/swagger-paths.txt) and reference it by path to cut a large inline block from the main context.

De-duplicate tech-stack fingerprinting — it appears in both "TECH STACK DETECTION" and Operator Notes "Live-host probe: how to fingerprint stack quickly"; keep one authoritative version and cross-reference.

Extract the engagement-derived Operator Notes into a references/notes.md so SKILL.md stays a lean overview pointing one level deep, improving progressive disclosure.

Dimension	Reasoning	Score
Conciseness	Mostly efficient executable commands, but the ~700-line body carries redundancy (stack fingerprinting appears in both "TECH STACK DETECTION" and Operator Notes "Live-host probe") and a large inline swagger wordlist that pads the context window.	2 / 3
Actionability	Nearly every section gives copy-paste-ready bash with concrete flags, paths, and jq/grep pipelines — e.g. "nuclei -l /tmp/live.txt -t ~/nuclei-templates/ -severity critical,high,medium" — fully executable guidance.	3 / 3
Workflow Clarity	The standard pipeline is sequenced Steps 0–6, the 30-minute protocol times each phase, and checkpoints are explicit (5-minute kill signals, go/no-go scoring table, toolchain smoke-test before reliance).	3 / 3
Progressive Disclosure	No bundle files exist and the SKILL.md is monolithic; the swagger path wordlist and the engagement-derived Operator Notes are inline content that would be clearer split into reference files, though sections are well-labeled.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and covers both what the skill does and exactly when to invoke it with natural trigger terms. It is a strong, copy-ready description with no notable weaknesses.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions with named tools — "subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring" — matching the multi-action anchor.	3 / 3
Completeness	Explicitly answers both what (the full pipeline of enumeration/discovery/crawling/fuzzing/analysis/monitoring) and when via a clear "Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping" clause.	3 / 3
Trigger Term Quality	Uses natural terms a user would say — "recon", "asset discovery", "subdomain enum", "attack surface mapping", "web2 target" — giving good coverage rather than jargon-only language.	3 / 3
Distinctiveness Conflict Risk	A clear web2-recon niche with distinct triggers and third-person voice ("Web2 recon pipeline..."); unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (698 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/web2-recon/SKILL.md
Commit: 6b9c96e

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.