CtrlK
BlogDocsLog inGet started
Tessl Logo

web2-recon

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

72

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced recon skill with concrete executable commands and useful go/no-go validation gates. Its main weakness is monolithic structure: at ~620 lines with no bundle files, large sections that belong in separate reference documents are inlined rather than progressively disclosed.

Suggestions

Split the long SOURCE DISCLOSURE & EXTRACTION and CONTINUOUS MONITORING sections into reference files (e.g. references/source-disclosure.md, references/monitoring.md) and keep SKILL.md as an overview with one-level-deep links to improve progressive disclosure.

Add an explicit validation/feedback loop between pipeline stages (e.g. 'if /tmp/live.txt is empty, re-check DNS resolution before crawling') to turn the linear pipeline into a validate-then-proceed workflow.

Tighten the strategic prose in the SOURCE DISCLOSURE section (severity ladders and HackerOne narrative) to reduce token load without losing the operational guidance.

DimensionReasoningScore

Conciseness

Dense, operational content where most tokens earn their place (tool flags, specific paths, grep patterns); the strategic prose (severity ladders, 'why this matters' blockquotes) is domain-specific rather than basic concepts Claude already knows, though a few prose sections could be tightened.

4 / 5

Actionability

Copy-paste ready bash commands throughout with specific flags, wordlist paths, and jq/grep pipelines covering the common recon cases — e.g. the Step 0-6 pipeline, ffuf invocations, and the disclosure triage loop are fully executable.

5 / 5

Workflow Clarity

Clear sequencing via the Step 0-6 STANDARD RECON PIPELINE and the 30-MINUTE RECON PROTOCOL, with go/no-go checkpoints (5-minute kill signals, target scoring table, echo-count feedback); minor gap is the lack of explicit error-recovery feedback loops between pipeline stages.

4 / 5

Progressive Disclosure

Well-organized with clear section headers and inline cross-references to the sibling 'web2-vuln-classes' skill, but no bundle files exist and the 620-line body inlines substantial content (JS ANALYSIS, SOURCE DISCLOSURE, CONTINUOUS MONITORING) that could be split into one-level-deep reference files.

3 / 5

Total

16

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that names concrete capabilities with tooling and pairs them with explicit 'Use when' trigger guidance covering natural synonyms. It is comprehensive, concise, and clearly niche-scoped with low conflict risk.

DimensionReasoningScore

Specificity

Lists multiple concrete action areas with named tools — 'subdomain enumeration (subfinder, Chaos API, assetfinder)', 'live host discovery (dnsx, httpx)', 'URL crawling (katana, waybackurls, gau)', 'directory fuzzing (ffuf)', 'JS analysis (LinkFinder, SecretFinder)', 'continuous monitoring' — giving comprehensive coverage of the pipeline.

5 / 5

Completeness

Explicitly answers both what (the enumerated recon stages) and when ('Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Natural trigger phrases a pentester would actually say are present: 'starting recon', 'asset discovery', 'subdomain enum', 'attack surface mapping', plus the domain term 'web2 recon' — comprehensive coverage with synonyms for the niche.

5 / 5

Distinctiveness Conflict Risk

The 'web2 recon pipeline' niche with recon-specific triggers is clearly distinct from other skills; the 'web2' qualifier and asset-discovery framing minimize overlap with unrelated skills.

5 / 5

Total

20

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

skill_md_line_count

SKILL.md is long (627 lines); consider splitting into references/ and linking

Warning

relative_links

Relative link issues: 1 missing

Warning

Total

14

/

16

Passed

Repository
shuvonsec/claude-bug-bounty
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.