Traction scoreGitHub stars can be faked, so popularity alone can be misleading. Traction Score looks for broader signs of recent attention, adoption, and active maintenance.
This collection provides detailed technical procedures for identifying and exploiting vulnerabilities across authentication systems, containerized infrastructure, and complex attack chains. It assists security researchers in moving from initial discovery to high-impact findings through validated techniques.
The repository organizes specific workflows for tasks such as escaping Docker containers to host root, attacking SAML SSO implementations, and synthesizing multiple verified findings into cohesive attack paths.
WHO IT'S FOR
Bug bounty hunters
chaining verified findings into high-impact attack paths
Compatible AgentsThe repository documents support for these agents. The skills may also work with other agents that can load SKILL.md files, but they may need some setup or small changes.
Follow the documented setup, then try a first task.
Setup
Clone the complete Recon Skills pack
Installs: Complete Recon Skills repository bundle for manual use or loading as task context by an automation system.
Before you start
Git
Standard Linux tooling, including find, sort, and rg
A writable location for the checkout and output directory
Platform: Commands assume standard Linux tooling unless an individual skill states otherwise.
In a terminal, run this from the directory that should contain the new recon-skills checkout. The command enters the checkout and lists/searches its skill files.
Installs: The offensive-osint skill and its secret-scan helper script only. · Claude Code
Before you start
A local Claude Code installation
A cloned recon-skills checkout
The documented ~/.claude/skills/offensive-osint/ and scripts/ destination directories must already exist
Standard Linux cp tooling
Platform: Standard Linux tooling assumed.
Run from: recon-skills/redteam/offensive-osint
In a terminal, change to the repository's redteam/offensive-osint directory, then copy the skill and its helper script into the documented local Claude Code skill destination.
Installs: The osint-methodology skill only. · Claude Code
Before you start
A local Claude Code installation
A cloned recon-skills checkout
The documented ~/.claude/skills/osint-methodology/ destination directory must already exist
Standard Linux cp tooling
Platform: Standard Linux tooling assumed.
Run from: recon-skills/redteam/osint-methodology
In a terminal, change to the repository's redteam/osint-methodology directory, then copy the skill into the documented local Claude Code skill destination.
Candidate finding details, including setup, exact HTTP request, observed result, demonstrated impact, time, and cost
The authorized program's accepted-impact and out-of-scope rules
Using the triage-validation skill, assess one candidate security finding using the finding details and the program's accepted-impact and out-of-scope rules. Apply the documented questions in order, stop at the first failed gate, and explain whether this individual finding should proceed to reporting. Do not perform new testing or submit anything.
One evidence artifact or its text contents; [ARTIFACT_PATH] is a placeholder for its local path
Context identifying test-account data versus other users' data
Using the evidence-hygiene skill, review the supplied screenshot, HAR excerpt, raw HTTP exchange, or terminal transcript and produce a redaction checklist. Identify session cookies, authorization tokens, and unnecessary real-user PII to mask, while distinguishing triager-useful metadata that should remain visible. Do not modify or publish the artifact. If using [ARTIFACT_PATH], replace it with the local path to the artifact being reviewed.
Using the report-writing skill, draft only a precise report title and a short impact-first summary for one already validated finding. Use the exact bug class, endpoint or feature, attacker role, victim scope, and demonstrated result; clearly separate anything not proved. Do not submit or publish the draft.
Claude