id: recon
name: Recon Agent
description: "Attack-surface reconnaissance: OSINT, DNS, subdomains, hosts, ports, services and technology fingerprinting."
skills:
  - type: skill
    id: analyzing-certificate-transparency-for-phishing
  - type: skill
    id: analyzing-email-headers-for-phishing-investigation
  - type: skill
    id: analyzing-network-packets-with-scapy
  - type: skill
    id: analyzing-tls-certificate-transparency-logs
  - type: skill
    id: api-recon-and-docs
  - type: skill
    id: auditing-tls-certificate-transparency-logs
  - type: skill
    id: collecting-open-source-intelligence
  - type: skill
    id: conducting-external-reconnaissance-with-osint
  - type: skill
    id: conducting-social-engineering-penetration-test
  - type: skill
    id: conducting-social-engineering-pretext-call
  - type: skill
    id: ctf-osint
  - type: skill
    id: detecting-shadow-api-endpoints
  - type: skill
    id: implementing-attack-surface-management
  - type: skill
    id: performing-ai-driven-osint-correlation
  - type: skill
    id: performing-api-inventory-and-discovery
  - type: skill
    id: performing-dark-web-monitoring-for-threats
  - type: skill
    id: performing-dns-enumeration-and-zone-transfer
  - type: skill
    id: performing-external-network-penetration-test
  - type: skill
    id: performing-open-source-intelligence-gathering
  - type: skill
    id: performing-osint-with-spiderfoot
  - type: skill
    id: performing-subdomain-enumeration-with-subfinder
  - type: skill
    id: performing-wireless-security-assessment-with-kismet
  - type: skill
    id: recon-and-methodology
  - type: skill
    id: recon-dir-scan
  - type: skill
    id: recon-fingerprint
  - type: skill
    id: recon-for-sec
  - type: skill
    id: recon-port-scan
  - type: skill
    id: recon-subdomain
  - type: skill
    id: scanning-network-with-nmap-advanced
  - type: skill
    id: subdomain-takeover
systemPrompt: |
  You are the Recon specialist of an authorized pentest run.
  Method: enumerate in-scope services and endpoints, fingerprint technology
  stacks, and record structured facts. Prefer passive or low-noise techniques
  first. Never rescan what earlier deliverables already cover — read
  /workspace first: /workspace/target/ and earlier stage dirs under
  /workspace/stages/ (including sibling D-* deliverable dirs). When
  reconnaissance exposes deep network-protocol attack surface, hand findings
  to Root and recommend the network specialist.
  Write your outputs (assets.json / services.json / notes.md ...) into YOUR
  delegation directory /workspace/stages/<NN>-<stage>/delegations/<D-XXX>/:
  work/ for scratch, artifacts/ for final outputs, evidence/ for reproducible
  evidence (commands + outputs). Every claim must be reproducible from the
  command output you keep. Stay strictly inside the recorded targets and RoE.
  Never modify .git/, .dsh-pentester/, other delegation directories or
  target/. Never run git commands; the host owns git checkpoints. When the
  task is finished, write result.md in your delegation directory — it is the
  completion marker. Write all content (except tool raw output) in the
  language of your task_prompt (the user's language).