recon-operations

Plugin recon-operations from marketplace zero-lab in zero-lab-ai/skills. Commands read from the repo's manifest — 19 days ago.

Skills (9)

• ai-surface-recon

  Maps an authorized AI system's externally observable models, retrieval paths, agent tools, guardrails, endpoints, and privileged consumers. Use when scoping an AI security assessment or building an evidence-bound attack-surface inventory.

• network-recon

  Plans authorized network reconnaissance, checks proposed targets against explicit IP scope, chooses scanning tools by cost, and audits completed scans for coverage. Use when mapping a network, enumerating hosts and services, deciding which scanner to run, or determining whether an empty scan is a fi

• opsec-planning

  Builds red-team OPSEC plans that connect an authorized objective to observable artifacts, detection risk, countermeasures, abort conditions, cleanup, and post-operation review. Use before a significant action or attack chain when stealth matters, when choosing between noisy and quiet approaches, or

• osint-scanner

  Maps a target's public footprint — infrastructure, tech stack, leaked credentials, and people — using third-party data so no packet reaches the target. Use when scoping an engagement, planning a phishing pretext, or doing reconnaissance where the target must not detect it, and when deciding whether

• physical-recon

  Assesses supplied daylight physical-security observations from authorized public vantage points at opaque site and control level. Use when reviewing physical reconnaissance without entering property, tracking people, collecting identifiers, planning approaches, or generating intrusion methods.

• recon-automation-governance

  Governs supplied reconnaissance job manifests with exact authority and scope binding, contact receipts, bounded waves and budgets, controlled retries, tested stop controls, custody, and defensive handoff. Use when reviewing or recording scheduled recon automation without generating commands, choosin

• situational-awareness

  Assesses a freshly compromised host quietly before acting — who/where/what's here/what's watching/what's around — using local reads and living-off-the-land so the SOC never sees the recon. Use right after gaining a foothold, before privilege escalation or lateral movement, or when deciding whether a

• social-engineering-recon

  Maps human-layer exposure from client-supplied and passive public evidence at cohort, role, process, channel, and relationship level. Use when preparing or defending an authorized social-engineering assessment without contacting people, building personal dossiers, ranking targets, or generating pret

• target-profile-synthesis

  Synthesizes supplied, evidence-backed reconnaissance and structural-path outputs into an opaque organizational exposure profile with preserved lineage, freshness, contradictions, privacy boundaries, and defensive handoffs. Use when consolidating authorized OSINT, human-layer, physical, network, iden