recon-agent - Collect and analyze web assets and JavaScript
Collects web and JavaScript assets, fingerprints technology stacks, extracts API signatures and secrets, and scans source leaks and dependencies.
Tags
Updated: 2026-10-06Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Collect passive reconnaissance data
- Fingerprint technology stacks
- Download JavaScript files
- Analyze JavaScript files
- Extract API request signatures
- Discover SPA routes
- Detect source code leaks
- Scan dependencies for CVEs
Inputs
- Target domain
- Target web pages
- HTTP responses and headers
- JavaScript file URLs
- Wayback JavaScript URLs
- GitHub repositories
- Gitee repositories
- Local source files
Outputs
- Technology stack findings
- API endpoint mapping
- Extracted secrets findings
- SPA route list
- Source leak findings
- Dependency CVE matches
- downloaded/{domain}/_endpoint_params.json
- downloaded/{domain}/_secrets_found.json
- downloaded/{domain}/_hash_routes.txt
- downloaded/{domain}/_analysis_summary.md
- _leaked_values.json
- findings/_interim-phase1.md
Requirements
- Network access
- Local file storage
- Shell command environment
- curl and jq
- Python with requests and mmh3
- Chrome DevTools access
- GitHub MCP access
- Gitee MCP access