skill
company-recon-skill
Claude Code skill for SaaS technology reconnaissance — discovers every website embedding a target company's technology using OSINT techniques
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/zoharbabin/company-recon-skill itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
README
synced Oct 17, 2026company-recon-skill
SaaS technology reconnaissance skill for Claude Code — discovers every website embedding a target company's technology using OSINT techniques.
Quick Install
git clone https://github.com/zoharbabin/company-recon-skill.git ~/.claude/skills/saas-recon
Or symlink from wherever you cloned it:
git clone https://github.com/zoharbabin/company-recon-skill.git ~/projects/company-recon-skill
ln -s ~/projects/company-recon-skill ~/.claude/skills/saas-recon
Usage
In Claude Code:
/saas-recon Acme Corp
/saas-recon widgetcloud.io
The skill accepts a company name or domain as its argument.
What It Does
A 9-phase OSINT pipeline that maps a SaaS company's entire technology footprint:
| Phase | Description |
|---|---|
| 1. Company Profiling | Identifies subsidiaries, domains, products, and corporate structure |
| 2. Certificate Transparency | Queries CT logs (crt.sh) for all SSL certificates, revealing client-branded subdomains |
| 3. Infrastructure Mapping | DNS resolution, CNAME chain analysis, cloud provider identification |
| 4. Archive Mining | Wayback Machine, Common Crawl, and gau URL collection for historical artifacts |
| 5. Code Search | GitHub code search for embed scripts, CDN references, custom elements, and tracker database entries |
| 6. Live Embed Detection | Playwright browser automation to verify embeds on candidate sites |
| 7. Web & News Search | Google dorks, press mentions, partner pages, job listings, conference appearances |
| 8. Analytics Correlation | Shared Google Analytics / GTM / HubSpot / Facebook Pixel IDs across domains |
| 9. Business Intelligence | Investor filings, SEC/SEDAR, technology directories, patent searches |
Each finding is assigned a confidence tier (CONFIRMED / STRONG / MODERATE / WEAK) based on evidence rules.
Architecture
company-recon-skill/
├── SKILL.md # Main skill prompt (1,089 lines)
├── references/
│ ├── api-endpoints.md # API & CLI tool endpoint reference
│ ├── classification-rules.md # Subdomain & client classification rules
│ ├── html-styles.md # CSS styles for HTML report output
│ ├── report-template.md # Markdown report template
│ └── search-patterns.md # Google dorks, crt.sh, GitHub search templates
├── README.md
├── LICENSE
└── .gitignore
Tool Requirements
The skill adapts to available tools — it works with just curl, dig, and jq, but coverage improves significantly with additional tools.
Required
| Tool | Purpose |
|---|---|
curl | API calls (crt.sh, Wayback Machine, Common Crawl) |
dig | DNS resolution and CNAME chain analysis |
jq | JSON parsing of API responses |
Recommended
| Tool | Purpose | Install |
|---|---|---|
gau | Bulk URL collection from Wayback + Common Crawl + OTX + URLScan | go install github.com/lc/gau/v2/cmd/gau@latest |
subfinder | Passive subdomain discovery (40+ sources) | brew install subfinder |
dnsx | Bulk DNS resolution with CNAME tracking | brew install dnsx |
httpx | Batch URL probing with tech detection (ProjectDiscovery) | go install github.com/projectdiscovery/httpx/cmd/httpx@latest |
nuclei | Template-based embed scanning | brew install nuclei |
katana | JS-rendering site crawler | brew install katana |
shodan | Server, cert, and HTTP content search | pip3 install shodan |
pandoc | Markdown-to-HTML report rendering | brew install pandoc |
MCP Server Support
These MCP servers enhance reconnaissance coverage when configured in Claude Code:
| MCP Server | Enhancement |
|---|---|
google-researcher-mcp | Web search, news search, page scraping |
playwright | Browser automation for live embed verification |
github | Code search across all public repositories |
browser-tools | DevTools-level page inspection |
fetch | Web content fetching |
Output Structure
All output goes to _recon/{target-slug}/ under the current working directory:
_recon/{target-slug}/
├── profile.json # Structured company profile
├── findings/ # Per-phase findings
│ ├── 01-company-profile.md
│ ├── 02-certificates.md
│ ├── 03-infrastructure.md
│ ├── 04-archives.md
│ ├── 05-code-search.md
│ ├── 06-embeds.md
│ ├── 07-web-mentions.md
│ ├── 08-analytics.md
│ └── 09-business-intel.md
├── report.md # Final consolidated report
└── report.html # HTML version (if pandoc available)
Confidence Tiers
| Tier | Required Evidence |
|---|---|
| CONFIRMED | Live embed verified, OR 2+ independent source types, OR active production + UAT subdomain pair |
| STRONG | CT certificate + DNS CNAME confirmation, OR named in investor filing, OR found in decompiled mobile app |
| MODERATE | Single CT certificate with client-branded production subdomain, OR single CDN archive, OR single GitHub code reference |
| WEAK | Demo subdomain only, OR expired cert only, OR single press mention / job listing |
Extending the Skill
Adding Search Patterns
Edit references/search-patterns.md to add new Google dork templates, crt.sh queries, or GitHub search patterns. All patterns use {PLACEHOLDER} syntax.
Adding Classification Rules
Edit references/classification-rules.md to add new subdomain classification patterns or industry categories.
Adding Phases
Add new phase sections to SKILL.md following the existing pattern (phase header, instructions, tool usage, findings output).
Contributing
- Fork the repository
- Create a feature branch (
git checkout -b feature/new-phase) - Make your changes
- Test with a real target using
/saas-recon - Open a pull request
Please ensure all examples use fictitious company names only.