← All skills
web-recon
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By BitterSecurity/Decepticon (GitHub) · coding · 6,581 stars · scanned at commit bdb1016
Web application enumeration hub — directory/file fuzzing, vhost discovery, API enumeration, CMS scanning, WAF detection, auth surface mapping, cookie audit.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 21 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/recon/web-recon/api-enumeration/SKILL.md, line 57
ffuf -u "https://<target>/page?FUZZ=test" -w /usr/share/wordlists/params.txt -mc 200 -fs <default_size> - packages/decepticon/decepticon/skills/standard/recon/web-recon/auth-mapping/SKILL.md, line 20
for path in login signin auth authenticate oauth/authorize \ - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 20
wpscan --url https://<target> --enumerate vp,vt,u,be --api-token <WP_API_TOKEN> - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 32
curl -s "https://<target>/administrator/manifests/files/joomla.xml" | grep -oP '<version>\K[^<]+' - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 38
curl -s "https://<target>/CHANGELOG.txt" | head -5 - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 21
ffuf -u https://<target>/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,302,403 - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 40
for path in .env .git/config .htaccess robots.txt sitemap.xml \ - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 53
ffuf -u https://<target_ip>/ -H "Host: FUZZ.<target>" \ - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 74
curl -sk "https://<TARGET>/" -o /tmp/baseline.html - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 101
curl -s https://<target> | grep -oP 'src="[^"]*\.js"' | cut -d'"' -f2 | while read js; do - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 114
curl -sI "https://<target>/main.js" | grep -i sourcemap - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 20
subfinder -d <TARGET> -all -silent -o subs.txt - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 37
while read sub; do - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 78
curl -sk -H 'Host: app.<TARGET>' "https://app.<TARGET>/" -o body.html -w '%{http_code}\n' - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 91
cname=$(dig +short CNAME "app.<TARGET>" | head -n1) - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 99
subjack -w subs.txt -t 50 -timeout 30 -ssl -c ~/go/pkg/mod/github.com/haccer/subjack/fingerprints.json -v -o subjack.out - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 119
cat > index.html <<EOF
and 1 more places
Sends data to these websites: crt.sh, app., $s
This is disclosed by the author in the skill's SKILL.md or README.
Found in 22 places.
Show 17 more
- packages/decepticon/decepticon/skills/standard/recon/web-recon/auth-mapping/SKILL.md, line 22
code=$(curl -s -o /dev/null -w "%{http_code}" "https://<target>/$path") - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 23
curl -s "https://<target>/wp-json/wp/v2/users" | python3 -m json.tool - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 24
curl -s "https://<target>/xmlrpc.php" -d '<methodCall><methodName>system.listMethods</methodName></methodCall>' - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 25
curl -s "https://<target>/?author=1" -I | grep Location - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 32
curl -s "https://<target>/administrator/manifests/files/joomla.xml" | grep -oP '<version>\K[^<]+' - packages/decepticon/decepticon/skills/standard/recon/web-recon/cms-scanning/SKILL.md, line 38
curl -s "https://<target>/CHANGELOG.txt" | head -5 - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 44
code=$(curl -s -o /dev/null -w "%{http_code}" "https://<target>/$path") - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 74
curl -sk "https://<TARGET>/" -o /tmp/baseline.html - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 80
CODE=$(curl -sk -o /tmp/probe.html -w "%{http_code}" "$URL") - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 101
curl -s https://<target> | grep -oP 'src="[^"]*\.js"' | cut -d'"' -f2 | while read js; do - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 104
curl -s "$js" | grep -oP '["'"'"'](/[a-zA-Z0-9_/\-\.]+)["'"'"']' | sort -u - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 108
curl -s "https://<target>/main.js" | grep -oiE '(api[_-]?key|secret|token|password|auth)["\s]*[:=]["\s]*[a-zA-Z0-9+/=_\-]{8,}' - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 114
curl -sI "https://<target>/main.js" | grep -i sourcemap - packages/decepticon/decepticon/skills/standard/recon/web-recon/discovery/SKILL.md, line 115
curl -s "https://<target>/main.js.map" | head -c 100 - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 24
curl -s "https://crt.sh/?q=%25.<TARGET>&output=json" | jq -r '.[].name_value' | tr '\n' '\n' | sort -u >> subs.txt - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 78
curl -sk -H 'Host: app.<TARGET>' "https://app.<TARGET>/" -o body.html -w '%{http_code}\n' - packages/decepticon/decepticon/skills/standard/recon/web-recon/subdomain-takeover/SKILL.md, line 109
echo "=== $s ==="; curl -sk -m 10 "https://$s/" | head -c 400; echo
and 2 more places
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'web-recon' ] || [ -L ~/.agents/skills/'web-recon' ]; then echo 'A skill folder named web-recon already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/BitterSecurity/Decepticon' "$d" && git -C "$d" checkout --quiet 'bdb1016c93ed687f61ac57481da298c25a47c8f5' -- 'packages/decepticon/decepticon/skills/standard/recon/web-recon' && mkdir -p ~/.agents/skills && cp -R "$d"/'packages/decepticon/decepticon/skills/standard/recon/web-recon' ~/.agents/skills/'web-recon' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'web-recon' ~/.claude/skills/'web-recon' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for BitterSecurity/Decepticon shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/BitterSecurity/Decepticon/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | bdb1016 | 92 |
| 2026-11-08 | df87955 | 92 |