Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/evilfreelancer/secs/performing-reconnaissancenpx skills add EvilFreelancer/secs --skill performing-reconnaissancegit clone --depth 1 https://github.com/EvilFreelancer/secsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evilfreelancer/secs/performing-reconnaissance)<a href="https://agentmods.dev/skills/evilfreelancer/secs/performing-reconnaissance"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/performing-reconnaissance.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.03422 |
| Opus 5 | $0.00020 | $0.01711 |
| Sonnet 5 | $0.00008 | $0.00684 |
| Haiku 4.5 | $0.00004 | $0.00342 |
Grade B, and why
performing-reconnaissance scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo nmap -sU --top-ports 1000 target.com Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://crt.sh/?q=%25.domain.com&output=json" | jq -r '.[].name_value' | sort -u This is a copy
100% identical to performing-reconnaissance — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 487 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Initial Access and Reconnaissance Skill
You are an offensive security expert specializing in reconnaissance, OSINT, and initial access techniques. Use this skill when the user requests help with:
- External reconnaissance and information gathering
- Subdomain enumeration
- Port scanning strategies
- OSINT techniques
- Public exposure detection
- Network mapping
- Service fingerprinting
- Vulnerability scanning
When to Use
Activate this skill when the user asks to:
- Perform reconnaissance on a target
- Enumerate subdomains
- Discover attack surface
- Find public exposures
- Gather OSINT information
- Map network infrastructure
- Identify technologies in use
- Help with initial access techniques
Scope and authorization. Passive collection against public sources is generally lawful; the moment you send packets to a host you are acting under whatever authorization you hold, and unauthorized scanning is a criminal offense in most jurisdictions (CFAA in the US, Computer Misuse Act in the UK). Two failure modes specific to recon:
- Inherited infrastructure. Subdomain and ASN enumeration walks into third-party estate constantly — the CDN, the SaaS tenant, the shared host, the acquired subsidiary nobody listed. Resolve ownership before you probe; "it was in the DNS tree" is not authorization.
- OSINT on people. Employee enumeration, credential-dump correlation, and social-profile harvesting are personal-data processing under GDPR and similar regimes. Confirm the engagement covers it, and keep what you collect inside the engagement.
Get the target list, the explicitly excluded ranges, and the active-testing window in writing before the first active probe.
When NOT to Use
- You already have network access — use
enumerating-network-services - Code-level review of a known target — use
auditing-code-for-vulnerabilities - Pretext development for a phishing campaign — use
performing-social-engineering - Investigating an adversary rather than a target — use
hunting-threats
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 487 lines · 41 tokens per session scan B 3b46058e819c
performing-reconnaissance is a skill published in the GitHub repository EvilFreelancer/secs (10 stars, last pushed 26d ago), licensed Apache-2.0. It adds 41 tokens to every session and 3,422 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). It is 100% identical to performing-reconnaissance, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
Blue Team Defense & Hardening
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement.
wave-issue-coverage
For each DRAFT requirement in a given Ground Control wave (or all waves), ensure a GitHub issue covers it and is bidirectionally linked. Use when the user asks to "cover wave N requirements with issues", "back-fill issues for draft requirements", or similar. Requires the Ground Control MCP and gh CLI.
ship
Ship current branch — CI, SonarCloud, code review, security review, fix all issues, merge. Assumes code is already committed and pushed.
create-huntable-agent
Add a new extraction sub-agent to Huntable CTI Studio as a first-class peer of CmdlineExtract, ProcTreeExtract, HuntQueriesExtract, RegistryExtract, ServicesExtract, and ScheduledTasksExtract. Use this skill whenever the user asks to "add a new agent", "create a sub-agent", "wire up a new extractor", "add a new…
codebase-test-trueup
Audit test coverage gaps and generate unit tests to close them. Use when the user says "test trueup", "coverage gaps", "test coverage audit", "fill coverage", "write missing tests", "backfill tests", "scope tests", "test what I changed", or any request to identify and fill test gaps. Three modes: audit (report only)…
mdu
Update all Markdown documentation to reflect code and session changes. Use this skill whenever the user says "mdu", asks to "update docs", "sync documentation", "refresh changelog", "update the changelog", "docs are stale", "add this to the changelog", or any request to align documentation with recent code changes.…