← All skills
passive-recon
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By BitterSecurity/Decepticon (GitHub) · coding · 6,581 stars · scanned at commit bdb1016
Passive intelligence gathering without touching the target — DNS, WHOIS, subdomain enumeration, Certificate Transparency, technology fingerprinting, ASN mapping.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 17 places.
Show 14 more
- packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 46
whois -h whois.cymru.com " -v <IP_ADDRESS>" - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 67
dig example.com ANY +noall +answer - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 85
dig example.com NS +short - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 105
subfinder -d example.com -silent - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 120
amass enum -passive -d example.com -o amass_subs.txt - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 133
for sub in $(cat /usr/share/wordlists/subdomains.txt); do - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 148
curl -s "https://crt.sh/?q=%25.example.com&output=json" | \ - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 163
curl -sI https://example.com - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 175
httpx -l subdomains.txt -sc -cl -ct -title -tech-detect -o httpx_results.txt - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 190
curl -s https://example.com | grep -Ei '(wp-content|drupal|joomla|next|react|angular|vue)' - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 198
subfinder -d <TARGET> -silent | httpx -silent -sc -title -tech-detect | tee live_<TARGET>.txt - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 214
cat all_subs_<TARGET>.txt | \ - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 224
curl -s "https://api.securitytrails.com/v1/domain/<TARGET>/subdomains" \ - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 274
WILDCARD_IP=$(dig +short nonexistent-random-string.<TARGET>)
Sends data to these websites: crt.sh, example.com, api.securitytrails.com, www.virustotal.com, api.bgpview.io
This is disclosed by the author in the skill's SKILL.md or README.
Found in 14 places.
Show 11 more
- packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 163
curl -sI https://example.com - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 181
httpx -l subdomains.txt -sc -title -tech-detect -json -o httpx.json - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 190
curl -s https://example.com | grep -Ei '(wp-content|drupal|joomla|next|react|angular|vue)' - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 202
curl -s "https://crt.sh/?q=%25.<TARGET>&output=json" | \ - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 224
curl -s "https://api.securitytrails.com/v1/domain/<TARGET>/subdomains" \ - packages/decepticon/decepticon/skills/standard/recon/passive-recon/SKILL.md, line 228
curl -s "https://www.virustotal.com/api/v3/domains/<TARGET>/resolutions?limit=40" \ - packages/decepticon/decepticon/skills/standard/recon/passive-recon/references/dns-techniques.md, line 52
curl -s "https://crt.sh/?q=%25.<TARGET>&output=json" | jq -r '.[].name_value' | sort -u - packages/decepticon/decepticon/skills/standard/recon/passive-recon/references/dns-techniques.md, line 55
curl -s "https://crt.sh/?q=%25.<TARGET>&output=json" | jq -r 'select(.not_after > now) | .name_value' | sort -u - packages/decepticon/decepticon/skills/standard/recon/passive-recon/references/dns-techniques.md, line 58
curl -s "https://crt.sh/?o=<ORG_NAME>&output=json" | jq -r '.[].common_name' | sort -u - packages/decepticon/decepticon/skills/standard/recon/passive-recon/references/dns-techniques.md, line 81
curl -s "https://api.bgpview.io/asn/<NUMBER>/prefixes" | jq '.data.ipv4_prefixes[].prefix' - packages/decepticon/decepticon/skills/standard/recon/passive-recon/references/dns-techniques.md, line 84
curl -s "https://api.bgpview.io/search?query_term=<ORG>" | jq '.data.asns[]'
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'passive-recon' ] || [ -L ~/.agents/skills/'passive-recon' ]; then echo 'A skill folder named passive-recon already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BitterSecurity/Decepticon' "$d" && git -C "$d" checkout --quiet 'bdb1016c93ed687f61ac57481da298c25a47c8f5' -- 'packages/decepticon/decepticon/skills/standard/recon/passive-recon' && mkdir -p ~/.agents/skills && cp -R "$d"/'packages/decepticon/decepticon/skills/standard/recon/passive-recon' ~/.agents/skills/'passive-recon' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'passive-recon' ~/.claude/skills/'passive-recon' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BitterSecurity/Decepticon shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BitterSecurity/Decepticon/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | bdb1016 | 92 |
| 2026-11-08 | df87955 | 92 |