Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add blisspixel/recon --skill recongit clone --depth 1 https://github.com/blisspixel/reconWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/blisspixel/recon/recon)<a href="https://agentmods.dev/skills/blisspixel/recon/recon"><img src="https://agentmods.dev/badge/skills/blisspixel/recon/recon/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/blisspixel/recon/recon"><img src="https://agentmods.dev/badge/skills/blisspixel/recon/recon.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 143 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 358 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.06041 |
| Opus 5.5 | $0.00050 | $0.02416 |
| Sonnet 5.5 | $0.00025 | $0.01208 |
| Haiku 4.5 | $0.00012 | $0.00604 |
Grade A, and why
recon scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 362 lines — stays where its author put it; the contents beside it link to each section on GitHub.
recon
Public-metadata domain intelligence. Given an apex domain, recon returns hedged observations about that queried public namespace and its evidence-linked service and identity indicators. It uses public DNS, certificate transparency, and unauthenticated identity-discovery endpoints without credentials or API keys. Default collection performs no active scanning or port probing: authoritative DNS may observe resolver traffic, and MTA-STS is the only default target-owned HTTP/application request. Google CSE and BIMI certificate requests are explicit opt-in direct probes.
When this is the right tool
Reach for recon when the user wants to understand a domain's public-facing configuration:
- "Is
delta.invalidon Microsoft 365? What's their tenant ID?" - "Score the email security on
gamma.invalid." - "What SaaS vendors does
beta.invalidappear to use?" - "Find related domains for
alpha.invalid." - "Compare the posture of
a.invalidandb.invalid."
Do not reach for recon when the user wants:
- Active scanning, port scans, or credentialed inventory.
- Vulnerability assessment or exploit checks.
- Company financials, news, hiring signals, or firmographic data.
- Generic target-owned application crawling. The only direct target interactions are the standards-compliant
mta-sts.{domain}request on the default path and the documented CSE / BIMI certificate probes when explicitly enabled.
If the user wants a verdict like "is this company secure," recon is not that tool. It surfaces observations; the user supplies the judgment.
Before first invocation
First inspect the available tools for the connected recon server. Client tool
namespaces vary; identify recon by its server identity and the exposed tool
names and descriptions, not a required prefix. Already-connected MCP tools are
sufficient: use them without requiring a shell or running recon --version.
Do not register a second server or install another runtime to use that connection.
Only for the CLI fallback, confirm recon is installed before the first command: if no shell is available, report that limitation instead of attempting a tool that the client does not expose.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed 4223faec7bbc
- yesterday Changed · +1 lines 8617db8fe4ee
- 8d ago Changed 36db4afe7307
- 9d ago Changed 6dff19ba26da
- 10d ago Changed 8928ab035b08
- 11d ago Changed 3a4a6caa8867
- 12d ago Changed d5a3b386bfc8
- 18d ago Changed 8ded08eb98e8
- 20d ago Changed · +1 lines dcb9d3703697
- 1mo ago First seen · 360 lines · 124 tokens per session scan A 812b00e7c5dd
recon is a skill published in the GitHub repository blisspixel/recon (5 stars, last pushed today), licensed Apache-2.0. It adds 124 tokens to every session and 6,041 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-secret-hunting
Find leaked API keys, tokens, and credentials in public GitHub repositories.
google-dorks-catalog
High-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated.
metabigor
Use when operating the metabigor CLI for OSINT recon and infrastructure mapping without API keys. Covers finding network ranges from an ASN, org, domain, or IP (net); enumerating subdomains from certificate logs (cert); enriching IPs with ports/CVEs via Shodan InternetDB (ip); searching public GitHub code for secrets…
conducting-external-reconnaissance-with-osint
Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media…
osint-methodology
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset types, severity rubric (CRITICAL/HIGH/MEDIUM/LOW/INFO)…
offensive-osint
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF…