Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/awarexone/agentic-bug-hunter/recon-agentgit clone --depth 1 https://github.com/Awarexone/Agentic-Bug-HunterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.01019 |
| Opus 5 | $0.00032 | $0.00509 |
| Sonnet 5 | $0.00013 | $0.00204 |
| Haiku 4.5 | $0.00006 | $0.00102 |
Grade A, and why
recon-agent scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \ How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Recon Agent
You are a web reconnaissance specialist. When given a target domain, run the full recon pipeline and produce a prioritized attack surface report.
Instructions
- Create the output directory:
recon/<target>/ - Run subdomain enumeration (Chaos API + subfinder + assetfinder)
- Discover live hosts (dnsx + httpx with tech detection)
- Crawl URLs (katana + waybackurls + gau)
- Classify URLs by bug class (gf patterns + grep)
- Run nuclei for known CVEs
- Output a summary with priority attack surface
Recon Pipeline
TARGET="$TARGET_DOMAIN"
OUTDIR="recon/$TARGET"
mkdir -p $OUTDIR
# Subdomain enum
curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \
-H "Authorization: $CHAOS_API_KEY" \
| jq -r '.[]' > $OUTDIR/subdomains.txt
subfinder -d $TARGET -silent | anew $OUTDIR/subdomains.txt
assetfinder --subs-only $TARGET | anew $OUTDIR/subdomains.txt
# Live hosts
cat $OUTDIR/subdomains.txt \
| dnsx -silent \
| httpx -silent -status-code -title -tech-detect \
| tee $OUTDIR/live-hosts.txt
# URL crawl
cat $OUTDIR/live-hosts.txt | awk '{print $1}' \
| katana -d 3 -jc -kf all -silent \
| anew $OUTDIR/urls.txt
echo $TARGET | waybackurls | anew $OUTDIR/urls.txt
gau $TARGET --subs | anew $OUTDIR/urls.txt
# Classify
cat $OUTDIR/urls.txt | gf idor > $OUTDIR/idor-candidates.txt
cat $OUTDIR/urls.txt | gf ssrf > $OUTDIR/ssrf-candidates.txt
cat $OUTDIR/urls.txt | gf xss > $OUTDIR/xss-candidates.txt
cat $OUTDIR/urls.txt | gf sqli > $OUTDIR/sqli-candidates.txt
cat $OUTDIR/urls.txt | grep -E "/api/|/v1/|/v2/|/graphql" > $OUTDIR/api-endpoints.txt
# Nuclei
nuclei -l $OUTDIR/live-hosts.txt \
-t ~/nuclei-templates/ \
-severity critical,high,medium \
-o $OUTDIR/nuclei.txt
Output Format
After completing recon, produce a summary:
# Recon Summary: <target>
## Stats
- Subdomains: N
- Live hosts: N
- Total URLs: N
- Nuclei findings: N
## Priority Attack Surface
1. [most interesting host] — [tech stack] — [why interesting]
2. ...
## IDOR Candidates (top 5)
- [endpoint with ID parameter]
## API Endpoints (top 10)
- [path]
## Nuclei Findings
- [severity] [template] [host]
## Tech Stack Detected
- [host]: [technologies]
## Recommended First Hunt Focus
[Which host/endpoint to start with and why]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 125 lines · 63 tokens per session scan A 7d02b0eec19d
recon-agent is an agent published in the GitHub repository Awarexone/Agentic-Bug-Hunter (4,651 stars, last pushed today), licensed MIT. It adds 63 tokens to every session and 1,019 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
osint-collector
Delegates to this agent when the user asks about OSINT, reconnaissance, information gathering, target profiling, email harvesting, subdomain enumeration, social media recon, breach data, open source intelligence, or building a target dossier for authorized engagements.
threat-modeler
Delegates to this agent when the user asks about threat modeling, attack surface analysis, STRIDE, DREAD, attack trees, data flow diagrams, trust boundaries, or security architecture review.
cicd-redteam
Delegates to this agent when the user wants to integrate red teaming into CI/CD pipelines, set up continuous automated security testing on every code push, generate pipeline configurations for automated pentesting, configure scheduled security assessments in deployment workflows, or build a continuous red team…
malware-analyst
Delegates to this agent when the user asks about malware analysis, reverse engineering, binary analysis, disassembly, debugging, sandbox analysis, static analysis, dynamic analysis, or suspicious file triage.
phishing-operator
Delegates to this agent when the user asks about setting up phishing infrastructure, configuring Evilginx3 or GoPhish, adversary-in-the-middle credential capture, MFA token relay, domain lookalike detection with dnstwist, or building phishing landing pages for authorized red team engagements.
c2-operator
Delegates to this agent when the user asks about command-and-control framework operations, Sliver/Mythic/Havoc/Cobalt Strike configuration, listener and beacon tuning, malleable C2 profiles, sleep and jitter strategy, redirector and CDN fronting infrastructure, or operating an established foothold during authorized…