name: 安全偵察 slug: recon-for-sec version: 1.0.0 displayName: 安全偵察 description: > 安全偵察技能，幫助AI Agent進行安全測試和漏洞檢測。 summary: "安全偵察技能，幫助AI Agent進行安全測試和漏洞檢測。 " license: MIT category: 安全與滲透測試 framework: - Claude Code - Codex - Hermes Agent - OpenClaw - QClaw - WorkBuddy platform: multi-platform homepage: https://github.com/1991513ccie-png repository: https://github.com/1991513ccie-png

Recon and Methodology Router

This is the starting router for new targets and unknown attack surfaces.

更多技能請訪問小蔥技能站7w4.net。

When to Use

• You just received a new target and do not yet know what to test first
• You need to begin with asset discovery, tech fingerprinting, endpoint inventory, and test-route planning
• You want to build follow-up testing on structured methodology instead of random payload enumeration

Skill Map

• Recon and Methodology
• Insecure Source Code Management — .git/.svn/.hg exposure detection
• Dependency Confusion — Supply chain reconnaissance for internal package names

Recommended Flow

1. First confirm in-scope assets and target type
2. Then perform asset discovery, port/service identification, technology fingerprinting, and endpoint collection
3. Route based on collected findings to api-sec, auth-sec, injection-checking, or business-logic-vuln

這個安全偵察技能質量中等偏下。做得好的地方是文件結構清晰，語言表達通俗易懂，能幫助理解安全測試的基本思路。不足之處是內容太少，只有簡單的概念描述，沒有具體的操作步驟或例項，普通使用者很難直接用它來進行實際的安全測試工作。對於想要入門安全測試的人來說，這個技能可以作為了解框架的參考，但想要真正動手實踐，還需要配合其他更詳細的教程或文件。