recon-skills AGENTS.md

Skill Library Contributor Guide

This repository contains portable offensive-security playbooks. It does not configure or document the runtime that consumes them.

These skills are for authorized security testing only. Only test targets you own or have explicit written permission to test.

Scope

Add or maintain skills for:

• external asset discovery and OSINT;
• web, API, cloud, identity, and infrastructure testing;
• platform-specific vulnerability validation;
• attack-path analysis;
• evidence handling, triage, and reporting.

Do not add:

• agent framework configuration;
• model or provider selection;
• chat, dashboard, cron, or scheduler instructions;
• private container, host, SSH, or network topology;
• deployment-specific workarounds;
• target-specific evidence or credentials;
• unrelated productivity or creative automation.

Docker, SSH, controllers, workers, and similar terms are valid when they are the subject of a security technique. They are not valid as assumptions about where this repository is running.

Repository Layout

Directory	Ownership
auth/	Authentication protocols and SSO
chains/	Evidence-backed attack paths
infra/	Infrastructure exploitation and validation
meta/	Cross-skill workflows and engagement methodology
recon/	Discovery and focused enumeration
redteam/	Vulnerability-class, platform, and reporting skills

Place supporting material next to its skill:

category/skill-name/
|-- SKILL.md
|-- references/
|-- scripts/
`-- templates/

Skill Contract

Every new or substantially revised SKILL.md must follow STYLE.md and include:

1. When to Use
2. Prerequisites
3. How to Run
4. Procedure
5. Pitfalls
6. Verification

Frontmatter must provide a unique kebab-case name, a concise description, semantic version, license, supported platforms, category, tags, and valid related-skill names.

Commands must be runnable, bounded, and explicit about side effects. Include timeouts and conservative concurrency. Distinguish discovery from validation, and require operator confirmation before any state-changing request.