recon-a-domain-passively SKILL.md skillA
recon-a-domain-passively from tonydzi/second-brain-starter-kit is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add tonydzi/second-brain-starter-kit/recon-a-domain-passively@git:20261020.402f6b7Pins git:20261020.402f6b7 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- tonydzi/second-brain-starter-kit
- Path
skills/recon-a-domain-passively/SKILL.md- Versions recorded
- 4
- Latest version
- git:20261020.402f6b7, committed Oct 20, 2026
- First version recorded
- Sep 24, 2026
- Size
- 14,373 bytes
- Repository stars
- 14
- License
- MIT
- End-to-end passive reconnaissance for a domain, website or IP — builds an asset inventory covering registration, DNS, subdomains, infrastructure, tech stack, history and ownership without sending a single packet to the target. Use when asked to research or profile a domain or website, map what an organisation runs, or investigate a suspicious site without alerting its operator.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Recon a domain passively Turn one domain into a defensible map of an organization's internet-facing estate plus the owner behind it. The techniques live in other skills; what this workflow contributes is the **order**, the **inventory**, and the **stopping rule**. Two failure modes to avoid from the start: enumerating for hours and producing 400 hostnames with no attribution, dates or priority, which is not a map; and drifting active without noticing, because one probe "just to check if it's up" ends the passive claim. Decide the passive boundary before step 2, not during it. ## Ordering logic Each stage feeds the next, and the sequence is cheapest-and-quietest first: | Order | Stage | Why here | |---|---|---| | 1 | Registration and DNS | Defines the perimeter. Without the apex set and the registrant you do not know what is in scope | | 2 | Name expansion | Archival sources only. Costs nothing, touches nothing, produces the candidate list everything else consumes | | 3 | Resolution and inventory | Converts names to addresses, which is what infrastructure lookups take as input | | 4 | Infrastructure and services | Needs stage 3's addresses. Third-party scan data only | …
Read the whole file at its exact version.
How to install
mdr add tonydzi/second-brain-starter-kit/recon-a-domain-passively@sha256:ffc6d48f85093b72The line at the top of this page pins the label git:20261020.402f6b7, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_brkyv6o7tbetojkd)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 4 versions of this file, between Sep 24, 2026 and Oct 20, 2026, about one every 9 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261020.402f6b7 latest | 2026-10-20 | 402f6b7 | 14,373 B | A | view · diff |
| git:20261007.cd6c208 | 2026-10-07 | cd6c208 | 14,379 B | A | view · diff |
| git:20261003.a2d662f | 2026-10-03 | a2d662f | 14,380 B | A | view · diff |
| git:20260924.2784cb2 | 2026-09-24 | 2784cb2 | 13,265 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (14373 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
tonydzi/second-brain-starter-kit · 14 stars · license MIT · pushed 2026-11-06 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_brkyv6o7tbetojkd GET https://markdownregistry.com/api/v1/resolve?ref=tonydzi/second-brain-starter-kit/recon-a-domain-passively GET https://markdownregistry.com/api/v1/blob/ffc6d48f85093b729171b8eca2f0d59c1b71808fc74b594ccfa83c64a52fdfa4
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.