web2-recon

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/web2-recon/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Highly actionable and copy-paste-ready throughout, with a clearly sequenced recon pipeline. Weaknesses are verbosity from explaining known concepts and inlining a large wordlist, missing validation checkpoints for batch ops, and a monolithic structure with no real bundle files backing the signaled references.

Suggestions

Move the ~90-line swagger-paths wordlist into a references/ file and reference it by path, trimming the inlined block to a few representative entries.

Add explicit validation checkpoints to the pipeline (e.g. verify live-hosts.txt is non-empty before URL crawling; confirm nuclei output before triage) and replace the '→' pseudocode in 'Output to Organized Directory' with actual mv/cp commands.

Trim concept-explaining prose Claude already knows (cookie-name-to-framework mapping, 'why port scanning matters') to keep the body lean, and either create the cited docs/verification/recon-hackerone-vdp.md as a bundled reference or remove the dangling reference.

Dimension	Reasoning	Score
Conciseness	The file is mostly tight executable bash, but it pads sections explaining concepts Claude already knows (tech-stack header signals, 'why port scanning matters', cookie-name-to-framework mapping) and inlines a ~90-line swagger wordlist that belongs in a reference file, so it is mostly efficient with several unnecessary sections.	3 / 5
Actionability	Nearly every section is copy-paste-ready, executable bash with concrete flags and output paths — e.g. the Step 0-6 pipeline, ffuf invocations, and the dig/curl fallbacks — covering the common recon cases fully.	5 / 5
Workflow Clarity	The pipeline is sequenced (Step 0-6, the 30-minute protocol, kill signals), but these batch/destructive recon operations lack explicit validation checkpoints, and the 'Output to Organized Directory' section is non-executable pseudocode using '→' arrows; per the batch-operation cap, missing validation holds this at 3.	3 / 5
Progressive Disclosure	It has header-based structure but is monolithic: no references/scripts/assets bundle files exist, the inlined swagger wordlist should be a separate reference, and the cited docs/verification path is not resolvable within the skill bundle, so references are present but not clearly backed by real files.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete pipeline stages and tools and pairs them with an explicit 'Use when...' trigger clause. Minor weakness is trigger-term coverage lacking synonyms or extension variants, but what/when and distinctiveness are fully satisfied.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions with their tools across the full pipeline — 'subdomain enumeration (subfinder, Chaos API, assetfinder)', 'live host discovery (dnsx, httpx)', 'URL crawling (katana, waybackurls, gau)', 'directory fuzzing (ffuf)', 'JS analysis (LinkFinder, SecretFinder)', 'continuous monitoring' — giving comprehensive coverage of what the skill does.	5 / 5
Completeness	Explicitly answers both: the 'what' (the enumerated pipeline phases) and the 'when' via a concrete 'Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping' clause.	5 / 5
Trigger Term Quality	Includes natural trigger phrases users would say — 'recon', 'asset discovery', 'subdomain enum', 'attack surface mapping' — but omits common synonyms and file-extension variants, so a few natural terms are missing rather than comprehensively covered.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (web2 recon pipeline) with distinct, specific triggers ('attack surface mapping', 'subdomain enum') that are unlikely to fire for unrelated skills, keeping conflict risk minimal.	5 / 5
	Total	19 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
skill_md_line_count	SKILL.md is long (698 lines); consider splitting into references/ and linking	Warning
relative_links	Relative link issues: 1 missing	Warning

	Total	14 / 16 Passed

Repository: elementalsouls/Claude-BugHunter
Path: skills/web2-recon/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.