recon-osint

SUSPICIOUS/HIGH-RISK but not confirmed malware. The skill is internally consistent with its stated offensive reconnaissance purpose, yet that purpose itself grants an AI agent high-risk offensive security capability and routes target data through many third-party services. Main concerns are offensive use, broad external data flows, and unpinned tool/runtime dependencies rather than covert credential theft or hidden payloads.

The fragment is an overt cloud and source-code reconnaissance tool, not apparent malware. It performs active probing and can scan GitHub content for verified secrets when explicitly requested. The main security warnings are authorization/privacy implications, plaintext secret output, and exposure of --gh-token through the process command line. No destructive or covert exfiltration behavior is present in this file.

This is a dual-use cloud and source-code reconnaissance guide with actionable commands for enumerating third-party assets and locating exposed secrets. It is not itself an embedded malware payload and contains no hardcoded secrets or obfuscated executable logic, but unauthorized use could enable privacy violations, credential exposure, and follow-on compromise. Use only with explicit authorization and avoid retrieving or validating discovered credentials beyond the approved scope.

The fragment is primarily offensive credential-intelligence and password-spraying guidance, not an embedded malware implementation. It creates significant privacy and account-compromise risk by harvesting identities, querying breach and infostealer corpora, pivoting recovered passwords, and generating spray candidates. The defensive monitoring content does not offset the actionable credential-abuse instructions. No obfuscation or direct malware behavior is present in the supplied text.

This is dual-use subdomain-takeover detection and validation guidance, not malware. It contains potentially dangerous operational instructions, particularly resource-claiming and content-serving steps, but frames them for authorized testing and includes safety limitations. The main security concern is misuse of the documented takeover workflow or accidental impact on live downstream applications.

The fragment is a dual-use reconnaissance and secret-detection playbook, not executable malware by itself. Its credential harvesting patterns and explicit stealth guidance create substantial security concern if distributed with tooling intended to scan systems without authorization. No direct exfiltration or destructive behavior is shown in this fragment.