Defines penetration test scope and performs authorized reconnaissance using passive and active methods. Use when planning a test engagement, collecting target intelligence, building asset inventories, or preparing recon findings.
91
87%
Does it follow best practices?
Impact
96%
1.15xAverage score across 3 eval scenarios
Advisory
Suggest reviewing before use
Rules of engagement and scope definition
Scope Summary section
62%
100%
In-scope assets listed
100%
100%
Out-of-scope assets listed
100%
100%
Test window documented
100%
100%
Constraints section present
100%
100%
Prohibited actions listed
100%
100%
Asset Inventory section
50%
100%
Asset inventory fields
75%
100%
Recon Findings section
0%
100%
Handoff to Scanning section
12%
100%
Scope referenced in findings
22%
100%
Rate limits captured
100%
100%
Passive intelligence gathering and asset inventory
Passive sources enumerated
100%
100%
Subdomains addressed
100%
100%
ASN or IP range lookup
100%
100%
Mail records addressed
100%
100%
Technology stack indicators
100%
100%
Asset Inventory section
100%
100%
Evidence field per asset
100%
100%
Confidence tagging
60%
100%
Passive before active ordering
100%
100%
Timestamped or reproducible evidence
100%
100%
Asset deduplication or owner mapping
62%
100%
No unapproved targets
100%
100%
Recon findings, threat hypotheses, and handoff artifacts
Recon Findings section
100%
100%
Finding sub-fields
100%
100%
Handoff to Scanning section
100%
100%
Prioritized targets
100%
100%
Recommended scan strategy
100%
100%
Threat hypotheses or attack paths
100%
100%
Business impact ordering
100%
100%
Timestamped findings
25%
37%
Command log file
100%
100%
Targets in command log
100%
100%
Timestamps in command log
14%
14%
Out-of-scope assets flagged
100%
100%
Scope constraints referenced
100%
100%
a8ff73a
Table of Contents
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.