web2-recon

67 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By elementalsouls/Claude-BugHunter (GitHub) · security · 5,515 stars · scanned at commit d5dcc53

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 19 places.

skills/web2-recon/SKILL.md, line 17export CHAOS_API_KEY="your-key-here"
skills/web2-recon/SKILL.md, line 59TARGET="target.com"
skills/web2-recon/SKILL.md, line 102TARGET="target.com"

Show 16 more

skills/web2-recon/SKILL.md, line 121cat /tmp/urls.txt | grep -E "[?&](id|user|file|path|url|redirect|next|src|token|key|api_key)=" | tee /tmp/interesting-params.txt
skills/web2-recon/SKILL.md, line 140cat /tmp/urls.txt | gf xss | tee /tmp/xss-candidates.txt
skills/web2-recon/SKILL.md, line 157source ~/tools/SecretFinder/.venv/bin/activate
skills/web2-recon/SKILL.md, line 174source ~/tools/LinkFinder/.venv/bin/activate
skills/web2-recon/SKILL.md, line 193ffuf -u "https://target.com/FUZZ" \
skills/web2-recon/SKILL.md, line 254curl -sI https://target.com | grep -iE "server|x-powered-by|x-aspnet|x-runtime|x-generator"
skills/web2-recon/SKILL.md, line 295TARGET="target.com"
skills/web2-recon/SKILL.md, line 318REPO="TargetOrg/target-app"
skills/web2-recon/SKILL.md, line 342cat /tmp/live.txt | awk '{print $1}' | naabu -port 80,443,8080,8443,3000,4000,5000,8000,8888,9000,9090,9200,6379 -silent | tee /tmp/open-ports.txt
skills/web2-recon/SKILL.md, line 353pip install trufflehog3 2>/dev/null || true
skills/web2-recon/SKILL.md, line 372TARGET_ORG="TargetOrgName" # Check their GitHub org
skills/web2-recon/SKILL.md, line 435dnsx -version # if SIGSEGV: use the dig fallback below
skills/web2-recon/SKILL.md, line 443while read s; do
skills/web2-recon/SKILL.md, line 455while read s; do
skills/web2-recon/SKILL.md, line 577ffuf -w swagger-paths.txt -u "https://FUZZ.target.com" -mc 200,302 -fs 0 -t 50 -o swagger-hits.json
skills/web2-recon/SKILL.md, line 633for url in $(cat live-hosts.txt); do

Changes files outside its own folder

The author does not mention this.

Found in 3 places.

skills/web2-recon/SKILL.md, line 19echo 'export CHAOS_API_KEY="your-key-here"' >> ~/.zshrc
skills/web2-recon/SKILL.md, line 25mkdir -p ~/.config/subfinder
skills/web2-recon/SKILL.md, line 26cat > ~/.config/subfinder/config.yaml << 'EOF'

Sends data to these websites: crt.sh, dns.projectdiscovery.io, target.com, api.github.com, $target

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 11 places.

skills/web2-recon/SKILL.md, line 62curl -s "https://crt.sh/?q=%.${TARGET}&output=json" \
skills/web2-recon/SKILL.md, line 69curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \
skills/web2-recon/SKILL.md, line 254curl -sI https://target.com | grep -iE "server|x-powered-by|x-aspnet|x-runtime|x-generator"

Show 8 more

skills/web2-recon/SKILL.md, line 299curl -s "https://dns.projectdiscovery.io/dns/$TARGET/subdomains" \
skills/web2-recon/SKILL.md, line 321CURRENT=$(curl -s "https://api.github.com/repos/$REPO/commits?per_page=1" | jq -r '.[0].sha')
skills/web2-recon/SKILL.md, line 328curl -s "https://api.github.com/repos/$REPO/commits/$CURRENT" \
skills/web2-recon/SKILL.md, line 364wget -q -r -l 1 -A "*.js" -P /tmp/js-files/ "https://$TARGET" 2>/dev/null
skills/web2-recon/SKILL.md, line 456resp=$(curl -s -L -m 5 -o /tmp/body \
skills/web2-recon/SKILL.md, line 634curl -s "$url" | grep -oE 'src="[^"]+\.js"' | sed 's/src="//;s/"//'
skills/web2-recon/SKILL.md, line 639curl -s "$j" | grep -oE '[a-z0-9.-]+\.(io|app|one|dev|test|cloud|ai|co)' | sort -u
skills/web2-recon/SKILL.md, line 663`curl -sI <host>` headers are 80% of the fingerprint:

Downloads and installs other software

The author does not mention this.

Found in 2 places.

skills/web2-recon/SKILL.md, line 353pip install trufflehog3 2>/dev/null || true
skills/web2-recon/SKILL.md, line 432The projectdiscovery Go binaries (`dnsx`, `httpx`, `naabu`) occasionally `SIGSEGV` on macOS arm64 due to a cgo / system-resolver interaction. The crash signatur

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'web2-recon' ] || [ -L ~/.agents/skills/'web2-recon' ]; then echo 'A skill folder named web2-recon already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/elementalsouls/Claude-BugHunter' "$d" && git -C "$d" checkout --quiet 'd5dcc5347675ed431488e0a0e46749e4918aa194' -- 'skills/web2-recon' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/web2-recon' ~/.agents/skills/'web2-recon' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'web2-recon' ~/.claude/skills/'web2-recon' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for elementalsouls/Claude-BugHunter shows the score of its lowest-scoring skill.

SkillTrust badge for elementalsouls/Claude-BugHunter

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/elementalsouls/Claude-BugHunter.svg)](https://zalavijaysinh.github.io/skilltrust/repos/elementalsouls/Claude-BugHunter/)

Score history

Date	Version	Score
2026-11-10	`d5dcc53`	67
2026-11-08	`42a3ab1`	67
2026-11-06	`3e71af0`	47