{
  "slug": "recon-review",
  "name": "Recon review and normalization",
  "category": "Research",
  "summary": "Normalize saved recon into a provenance-preserving local inventory, then use it to expose coverage gaps without expanding authorization.",
  "scope": "Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.",
  "inputs": [
    "Saved URL lists, JSONL, CSV, or HAR files",
    "Tool and collection timestamps",
    "Recorded scope and rules"
  ],
  "review": [
    {
      "title": "Import rather than paste",
      "body": "When a local Hunt Workbench is available, call import_recon for each saved artifact. Preserve its source, timestamp, and observed technology fingerprints; repeated imports should remain idempotent."
    },
    {
      "title": "Review normalized inventory",
      "body": "Use search_hunt_records to find assets, routes, technologies, and prior activity. Keep observed hosts distinct from authorized targets."
    },
    {
      "title": "Record coverage honestly",
      "body": "Use record_check for what was reviewed and its state. Keep not_tested, partial, blocked, failed, deferred, and out_of_scope distinct so gaps remain visible."
    }
  ],
  "outputs": [
    "Deduplicated asset inventory with provenance",
    "Technology and route observations",
    "Coverage record with explicit gaps"
  ],
  "pitfalls": [
    "Discarding source or timestamp during normalization",
    "Treating a discovered asset as in scope",
    "Calling a partial crawl complete coverage"
  ],
  "mcp": {
    "hosted": [
      "get_research_context",
      "search_research",
      "get_research_record"
    ],
    "workbench": [
      "import_recon",
      "search_hunt_records",
      "record_check"
    ]
  },
  "references": {
    "resources": [
      {
        "id": "owasp-secure-code-review-methodology",
        "title": "OWASP Secure Code Review: baseline and change-focused review",
        "url": "https://vulns.co/research/resources/owasp-secure-code-review-methodology/"
      },
      {
        "id": "owasp-security-logging-evidence-quality",
        "title": "OWASP Logging: trustworthy and minimal application evidence",
        "url": "https://vulns.co/research/resources/owasp-security-logging-evidence-quality/"
      }
    ],
    "diagrams": [
      {
        "id": "server-request-destination-policy",
        "title": "Layer server-request destination controls",
        "url": "https://vulns.co/research/diagrams/server-request-destination-policy/"
      }
    ],
    "reports": [
      {
        "id": "shopify-exchange-request-isolation-2019",
        "title": "Shopify Exchange screenshot service crossed internal boundaries",
        "url": "https://vulns.co/research/reports/shopify-exchange-request-isolation-2019/"
      }
    ]
  },
  "provenance": {
    "publisher": "vulns.co / GK Data",
    "guide_updated": "2026-10-12",
    "library_as_of": "2026-10-04",
    "library_commit": "d5550c7891119cf1379e235721541c947850a3b3"
  },
  "url": "https://vulns.co/skills/recon-review/",
  "markdown_url": "https://vulns.co/skills/recon-review/SKILL.md"
}