What is Reconnaissance & OSINT Automation?

A security-assessment aid for discovering internet-facing systems and collecting publicly available information about an approved target.

It helps with subdomain discovery, DNS and certificate-record analysis, technology identification, port and service checks, and organizing public intelligence about a domain, organization, or person.

It reduces the manual work of mapping a domain or organization’s exposed systems and technologies. It is intended only for targets covered by written authorization.

Reconnaissance & OSINT Automation — Skill for Claude Code by Masriyan

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 01-recon-osint

Clone the repo

git clone --depth 1 https://github.com/Masriyan/Claude-Code-CyberSecurity-Skill

Made for: Claude Code.

Or install cybersecurity, the plugin that ships this one along with the rest of its 20 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/masriyan/claude-code-cybersecurity-skill/01-recon-osint/github.svg)](https://agentmods.dev/skills/masriyan/claude-code-cybersecurity-skill/01-recon-osint)

Your own site

<a href="https://agentmods.dev/skills/masriyan/claude-code-cybersecurity-skill/01-recon-osint"><img src="https://agentmods.dev/badge/skills/masriyan/claude-code-cybersecurity-skill/01-recon-osint/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/masriyan/claude-code-cybersecurity-skill/01-recon-osint"><img src="https://agentmods.dev/badge/skills/masriyan/claude-code-cybersecurity-skill/01-recon-osint.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 33 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,952 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 3 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Privilege Escalation · line 66
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
high YARA Match · line 112
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Fix: Remove offensive tool references and exploit code. Legitimate agent skills should not contain penetration testing tools, exploit frameworks, or reconnaissance utilities.
medium Tool Misuse · line 286
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00033	$0.02952
Opus 5	$0.00016	$0.01476
Sonnet 5	$0.00007	$0.00590
Haiku 4.5	$0.00003	$0.00295

Measured yesterday against content hash 6be50d69bedc, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

Reconnaissance & OSINT Automation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

The scan reads SKILL.md. This mod also ships 3 executable files (scripts/dns_recon.py, scripts/subdomain_enum.py, scripts/tech_fingerprint.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/01-recon-osint/SKILL.md · 297 lines

How it starts

The opening of the file, as written. The whole thing — 297 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Reconnaissance & OSINT Automation

Purpose

Enable Claude to conduct comprehensive reconnaissance and open-source intelligence gathering during authorized security assessments. Claude performs passive and active recon using its native analysis capabilities and orchestrates the included scripts for automation at scale.

Authorization Required: Always confirm written authorization for the target scope before proceeding. Unauthorized reconnaissance is illegal in most jurisdictions.

Activation Triggers

This skill activates when the user asks about:

Subdomain enumeration or discovery
DNS reconnaissance, zone transfers, or DNS record analysis
OSINT gathering on a domain, organization, or person
Technology fingerprinting or stack identification
Port scanning, service detection, or banner grabbing
Google dorking or advanced search query generation
WHOIS, certificate transparency, or Shodan queries
Attack surface mapping or perimeter discovery

Prerequisites

pip install requests dnspython python-whois beautifulsoup4 shodan

Optional enhanced capabilities:

nmap — Active port scanning
amass — Advanced subdomain enumeration
theHarvester — Email and domain harvesting
Shodan API key — Internet-wide device search
Censys API key — Certificate and host search

Core Capabilities

1. Passive Reconnaissance (No Direct Target Contact)

When the user asks for passive recon or OSINT:

WHOIS Analysis — Query domain registration records for registrant, registrar, nameservers, and dates. Flag privacy-protected registrations and registrar patterns.
Certificate Transparency Logs — Search crt.sh for all certificates issued to the domain and subdomains. Extract SANs (Subject Alternative Names) to discover hidden subdomains.
DNS Records (Passive) — Enumerate A, AAAA, MX, NS, TXT, SOA, SRV, and CNAME records using public resolvers. Analyze SPF, DKIM, and DMARC for email security posture.
Search Engine Dorking — Generate targeted dork queries to discover exposed files, login portals, and configuration leaks:
- site:target.com filetype:pdf — Exposed documents
- site:target.com inurl:admin — Admin panels
- site:target.com ext:env OR ext:config — Config files
- "@target.com" site:linkedin.com — Employee enumeration
- "target.com" site:pastebin.com — Credential leaks
Shodan/Censys Queries — Search for internet-exposed services, open ports, banners, and vulnerabilities associated with the target's IP ranges.
Git/Code Repository Search — Search GitHub/GitLab for leaked credentials, API keys, and internal information:
- org:targetorg api_key
- filename:.env target.com
- "target.com" password

Read the full file on GitHub · 297 lines

Files

What ships with it

8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday Changed 6be50d69bedc
10d ago First seen · 297 lines · 33 tokens per session scan A a11153a4f988

Subscribe to this mod's changes

Reconnaissance & OSINT Automation is a skill published in the GitHub repository Masriyan/Claude-Code-CyberSecurity-Skill (408 stars, last pushed 2d ago), licensed MIT. It adds 33 tokens to every session and 2,952 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Research Security claude-skills claudecode cybersecurity dns enumeration fingerprinting osint reconnaissance subdomain

subdomain-enum

Enumerate subdomains for a target domain using passive and active reconnaissance techniques. Use when starting reconnaissance on a new target, when you need to discover the attack surface, when expanding scope from a root domain, or when the user provides a domain to investigate.

zebbern/termstack · 56 tokens

conducting-external-reconnaissance-with-osint

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media…

26zl/cybersec-toolkit · 96 tokens

dns-recon

Perform comprehensive DNS reconnaissance including record enumeration, zone transfers, and reverse lookups. Use when gathering DNS information about a target, when checking for zone transfers, when mapping DNS infrastructure, or when the user asks about DNS records.

zebbern/termstack · 49 tokens

imaging-data-commons

Query and download public cancer imaging data from NCI Imaging Data Commons. Invoke for any question about IDC collections, cancer imaging datasets, DICOM data access, radiology (CT, MR, PET) or pathology AI training sets, metadata queries, visualization, or license checks — even when the user doesn't explicitly…

K-Dense-AI/scientific-agent-skills · 75 tokens

lab-hardware-cad

Design custom laboratory hardware as parametric build123d models and export fabrication-ready STEP, STL, and DXF files - microfluidic chips and molds, optomechanical mounts and breadboard adapters, cuvette and microplate holders, tube racks, animal-behavior rigs, and 3D-printed instrument fixtures. Use when a research…

K-Dense-AI/scientific-agent-skills · 106 tokens

pkpd-modeling

Pharmacokinetic and pharmacodynamic modelling and simulation - non-compartmental analysis, compartmental and population PK, PK/PD and exposure-response, TMDD, PBPK orientation, bioequivalence, allometric scaling and first-in-human dose, drug interaction prediction, and Bayesian therapeutic drug monitoring. Use when…

K-Dense-AI/scientific-agent-skills · 273 tokens

Reconnaissance & OSINT Automation

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

Reconnaissance & OSINT Automation

Purpose

Activation Triggers

Prerequisites

Core Capabilities

1. Passive Reconnaissance (No Direct Target Contact)

What ships with it

What this file has done since we first saw it

Other skills, from other repositories

subdomain-enum

conducting-external-reconnaissance-with-osint

dns-recon

imaging-data-commons

lab-hardware-cad

pkpd-modeling