codexskills.dev

Recon and OSINT skill for Codex

Turn a target into a scoped inventory. This skill runs authorized reconnaissance passive-first, then active within scope: subdomains from certificate transparency and passive DNS, live-host probing, tech fingerprinting and content discovery. It deduplicates and scope-filters the noise into a clean asset inventory with priority leads, and flags exposed admin panels, stale versions and leaked keys without using them.

  • Security
  • $recon-osint
  • 112 lines
  • 2 files
  • ~1,250 tokens
  • MIT
  • Updated

Install

curl -fsSL codexskills.dev/install.sh \  | sh -s -- recon-osint

Installs to ~/.agents/skills/recon-osint/ for every project on this machine.

Download recon-osint.zip

104-line POSIX script. No sudo, no telemetry. Read install.sh

Use it in Codex

Start a prompt with $recon-osint, or pick it from /skills. You can also just describe the task: Codex reads the description below and loads the playbook when your request matches.

What Codex reads before loading it

Maps the attack surface of an authorized target through passive and active reconnaissance — subdomains, DNS, certificates, exposed services, technologies, leaked credentials and public documents — and produces a deduplicated, scoped asset inventory. Use when starting an authorized assessment or bug-bounty engagement and you need to know what is exposed. Not for profiling people or organizations you are not authorized to assess.

Use it when

  • Starting an authorized assessment or bug-bounty engagement
  • You need to know what of a target is actually exposed
  • You want a scoped, deduplicated asset inventory to test from

Use something else when

How to check the result

Every listed asset resolves and falls inside the authorized scope; out-of-scope discoveries are recorded separately and not probed.

The mistake it prevents

Treating any reachable host you discover as in scope, or authenticating with leaked credentials instead of just reporting them for rotation.

~/.agents/skills/recon-osint/SKILL.md

--- name: recon-osint description: Maps the attack surface of an authorized target through passive and active reconnaissance — subdomains, DNS, certificates, exposed services,… license: MIT ---

Good recon turns “the target” into a concrete, deduplicated inventory of in-scope assets, each with enough context to decide what to test next. Passive before active. Stay inside scope — an asset you find is not in scope unless the authorization says so.

Gate 0 — authorization and scope

Confirm in writing: the authorized target, exactly which domains/IPs/orgs are in scope, what is explicitly out of scope, whether active probing is allowed (vs passive only), and rate limits. For bug bounty, read the program’s scope page and honor it literally. If scope is unclear, stop and ask. Do not compile information about private individuals. Many tools below need network access and installs; Codex’s sandbox may require approval — note it.

Passive recon (no packets to the target)

Start here; it is quiet and often the most productive.

GoalSource / tool
SubdomainsCertificate transparency (crt.sh), passive DNS, subfinder, amass enum -passive
DNS recordsdig/host for A/AAAA/MX/TXT/NS/CNAME; SPF/DMARC in TXT
Historical dataWayback/waybackurls, archived JS and endpoints
Tech fingerprintResponse headers, whatweb, public BuiltWith-style data
Leaked secretsPublic code search for the org’s domains/keys; breach-exposure checks for in-scope accounts only
Org footprintASN/IP ranges (whois, BGP data), public cloud buckets named after the org
# Subdomain discovery (passive)
subfinder -d example.com -silent | sort -u > subs.txt
# Certificate transparency as a cross-check
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u >> subs.txt
sort -u subs.txt -o subs.txt

Active recon (within scope, if allowed)

Only if the RoE permits active probing of the target.

  • Resolve and liveness: resolve subdomains, then probe which answer HTTP(S) (httpx -l subs.txt -silent -status-code -title -tech-detect).
  • Port/service exposure: hand off to nmap-scanning for the ranges you confirmed in scope.
  • Content discovery: crawl live hosts, collect endpoints and parameters from JS, and (if allowed) directory brute-force with a reasonable wordlist and rate.
  • Screenshots: capture home pages of live hosts to triage quickly (gowitness/aquatone).

Keep active traffic within the agreed rate; recon should not read as an attack.

Deduplicate and scope-filter

Raw recon is noisy. Before handing off:

  1. Resolve everything and drop hosts that do not resolve or are parked.
  2. Remove anything outside the authorized scope — explicitly, with a note.
  3. Collapse duplicates (same IP/app behind many names) and group by application.
  4. Tag each asset: environment (prod/staging/dev), tech stack, auth-gated vs open, interesting (admin panels, APIs, upload forms, old versions).

Content and code recon

Live hosts hide most of their surface in JavaScript and archived URLs. Pull it out:

  • Collect endpoints and parameters from the app’s JS bundles and from waybackurls / gau; grep the JS for API paths, internal hostnames, cloud URLs and accidentally-shipped keys.
  • Search public code (the org’s own repos and public mentions of its domains) for config, internal URLs and credentials — report any secret for rotation; never use it.
  • Fingerprint API versions and frameworks from response headers and error bodies; an old /api/v1 beside a current /api/v2 is a common weak point.

Keep every discovery tagged with how you found it (passive source vs active probe) so the inventory is auditable and you can prove you stayed within the allowed mode.

What to flag immediately

  • Exposed admin/debug interfaces, dashboards, or /.git, /.env, backup files.
  • Staging/dev hosts reachable from the internet.
  • Forgotten old versions (api-v1, legacy.) likely to lag on patches.
  • Public cloud storage (S3/GCS/Azure) that lists or serves the org’s data.
  • Leaked keys/tokens in public code or archives (report, recommend rotation; never use them).

Output contract

## Recon — <target> (<date>)
Authorization: <ref>. Scope: <in/out>. Mode: <passive | passive+active>.

### Asset inventory
| Host | IP | Env | Stack | Notable |
|------|----|-----|-------|---------|
| app.example.com | 203.0.113.10 | prod | nginx/Next.js | login, API |
| staging.example.com | 203.0.113.44 | staging | exposed, no auth | admin panel |

### Priority leads
- <host/path> — <why it's interesting> — <next step / which skill>

### Out of scope (found, not tested)
- <asset> — <reason>

Hard rules

  • Passive first; go active only if the RoE allows and within rate limits.
  • An asset being reachable does not make it in scope. Test only what authorization covers.
  • Never authenticate with, or act on, leaked credentials you discover — report them.
  • Do not aggregate personal data about individuals; recon is about systems and surface.

What the zip contains

SKILL.md plus the interface file below. Nothing runs on install.

agents/openai.yamlgenerated from this page

Gives the Codex app a display name, a one-line description and a starter prompt for this skill.

interface:
  display_name: "Recon and OSINT"
  short_description: "Turn a target into a scoped inventory"
  default_prompt: "$recon-osint Map the attack surface for this authorized bug-bounty scope"

About this skill

Written and maintained by the Codex Skills editors to the same editorial standard as every skill here: a selective description, a real workflow, known pitfalls and a way to verify the work. First published , last updated . MIT licensed. Something wrong or out of date? Tell us.

Related skills

All 45 Security skills
esc