What problem does it solve? During authorized penetration tests, reconnaissance often stalls: testers either wait idly for long scans (subdomain enumeration, port scanning, deep crawling) or get stuck on a single entry point while other live assets go untested. This Skill structures recon so short tasks run synchronously on the main thread while long-running expansion and deep-dive work is delegated to sub-agents, keeping continuous output of new entry points, leads, and conclusions. ## Core Features & Use Cases - Sync/Async Task Splitting: Immediate HTTP probing, baseline recording, and first-shot testing happen on the main line; subdomain discovery, port scanning, deep crawling, directory guessing, and history/repo mining are dispatched to sub-agents. - Asset Inventory & Todo Proliferation: Every asset is tracked with status (alive / dead / duplicate / pending / deep-diving), and sub-agent results are immediately converted into new todos rather than stored as passive logs. - Semantic-Guided First Shots: Parameters are mapped to test surfaces by meaning—IDs to authorization checks, URLs to server-side requests, filenames to file reads, templates to rendering probes—with baseline comparison required. - Use Case: Given a corporate domain as an authorized target, the Skill probes web entry points immediately, dispatches subdomain and certificate-SAN expansion to sub-agents, treats 401/403 login walls as live sites, and keeps expanding the test queue as new hosts, keys, and hidden routes flow back. ## Quick Start Perform attack surface reconnaissance on the authorized target example.com, probing live entry points now and delegating subdomain and port expansion to sub-agents.
