# Recon Scope Triage

Triage ASM/recon output for ownership before testing, separate the target's real...

- Repository: https://github.com/Zyrexnn/Cybermes (987 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Zyrexnn/Cybermes --skill recon-scope-triage -g -a claude-code -y`
Codex: `npx skills add Zyrexnn/Cybermes --skill recon-scope-triage -g -a codex -y`
Cursor: `npx skills add Zyrexnn/Cybermes --skill recon-scope-triage -g -a cursor -y`
Gemini CLI: `npx skills add Zyrexnn/Cybermes --skill recon-scope-triage -g -a gemini-cli -y`

## Description

Triage ASM/recon output for ownership before testing, separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the brand name, so for any target whose name is a common/dictionary word, the output is dominated by assets belonging to UNRELATED same-named companies (repos, cloud buckets, mobile apps, breach corpora, typosquats). Built from an authorized engagement where an ASM report's "Criticals" were overwhelmingly false positives and the combo/repos/mobile/bucket lists were polluted with unrelated same-named orgs. Use at the START of any engagement, immediately on receiving any ASM/recon/OSINT dataset, BEFORE testing anything.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## When to use this skill

Trigger when:
- The target brand is a common/dictionary word or shared term (e.g. `apex`, `summit`, `vertex`, `nova`, `core`, `orbit`, `pulse`, `unity`…)
- You receive an ASM report, recon export, breach combo, repo list, bucket list, or mobile-app list to act on
- A "Critical" count looks implausibly high (hundreds) for the org's size
- Any asset's ownership is asserted by the tool but not *proven*

The two failure modes this skill prevents:
1. **Wasting the engagement** testing/triaging assets that aren't the target's.
2. **Attacking an innocent third party** that merely shares the name, out of scope, and real harm.

**Rule: ownership is guilty-until-proven. An asset is the target's only when a concrete ownership signal ties it to the target, never because a scanner's keyword matched.**

---

## The collision sources (where keyword-matching lies)

The rest: https://github.com/Zyrexnn/Cybermes/blob/HEAD/knowledge/Claude-BugHunter/skills/recon-scope-triage/SKILL.md