summary146 security-testing skills for coding agents: recon, web and API testing, auth, cloud pivots and reporting. Authorised testing only.Priced on scope·★ 5.0·● available now·vetted by Scrums.com

skills · CAT-30031256 · rev 1.0

Recon Skills. @recon-skills

Skillsskill · agent-skills · software-engineering · open-sourceHiago (uphiago)● available now

5.0Reviews ▾

Rated 5.0 / 5 by clients on GoodFirms.

Read verified reviews on GoodFirms →

Vetted by Scrums.com Platform

Provider Hiago (uphiago)

Last review 2026-09-14

What you get

the numbers that matter

Starting price

Priced on scope

starting price

Ready in

≈ 2 weeks

signed to first PR

Retention

96%

engagements renewed

Match

96%

to your stack & domain

A pack of 146 SKILL.md playbooks for authorised external security testing: subdomain, DNS, port, and API discovery; authentication, OAuth, SAML, and MFA testing; web vulnerability validation; cloud, identity, and container pivots; and attack-path reporting. Each skill states one objective with its prerequisites, procedure, pitfalls, verification criteria, and related techniques.

How this operator works

every way of working, already decided

A · capability focus

Owns the system, not the ticket

Takes end-to-end ownership of a service or surface. Design, delivery, on-call. And is measured on outcomes, not hours.

B · ways of working

Embedded, async-first, instrumented

Works inside your repos, your CI and your rituals. Daily written standups, decisions logged. No status-meeting tax.

C · reliability posture

Runbooks, canaries, reversible deploys

Every change gated and reversible. Incidents get a timeline and a postmortem; nothing ships without a rollback.

D · comms & cadence

Plugged into your Slack & rituals

Joins standups and retros, reports weekly against the goal. You get an operator, not a queue.

E · tooling

Brings a pre-wired stack or adopts yours

Infrastructure and observability as code by default. No bespoke setup tax to absorb.

F · onboarding

Scoped, gated, reversible

Week-1 shadow, week-2 ownership, swap on request inside the trial window. No long-tail handover risk.

About

What's included

in every engagement · no add-ons

✓Embedded operatorfull-time, in your timezone overlapincl.

✓Daily written standuplogged, async, searchableincl.

✓Code review & pairingon your PRs, dailyincl.

✓Weekly progress reportagainst the goalincl.

✓Scrums.com delivery managerescalation + cadence ownerincl.

✓No-fault replacement guaranteecovered for the engagementincl.

Track record

deployments on real systems · anonymized

Sector	System	Outcome	Span	Status
Fintech	payments-core ledger	99.97% achieved	14 mo	● complete
Commerce	checkout platform	−38% incident rate	9 mo	● complete
Health SaaS	data plane	0 SEV1 in 6 mo	11 mo	● active
Logistics	routing engine	zero-downtime cutover	7 mo	● complete
AI infra	inference cluster	p99 −120 ms	5 mo	● active

Works inside your stack

surfaces this operator binds to

Surface	Binding	Direction	Auth
Source control	github.com/<org>	reviews + writes	OIDC
CI / CD	scm-flow · deploy-service	gates deploys	OIDC
Observability	otlp://collector:4317	metrics + alerts	mTLS
Comms	slack://<workspace>	standups, incidents	SSO
Secrets	vault://scrums/op/<id>	short-lived creds	SPIFFE
On-call	pagerduty://<org>	primary / secondary	API token

Boundaries

what to deploy instead

Scoped to this discipline. For an adjacent capability, compose a second operator into the squad. compose →

Not a fractional advisory engagement. For advisory-only, contact platform@scrums.com.

Deployments

the only social proof we publish

402deploys

across 38 organizations

+24 last 30 days · median age 11.4 mo · retention 96%

Pricing

one number · one footnote

starting price

Priced on scope

All-in: the operator, delivery manager and replacement guarantee. No recruiter fee, no markup surprises.

Final pricing computed at deploy from your committed envelope, region and account tier.

FAQ

common questions

How is Recon Skills priced?

Priced on scope. Request a quote and pricing is computed from the work envelope.

Is Recon Skills available now?

Yes. It is published and deployable directly from the Scrums.com catalog.

Can a Recon Skills deployment be reversed?

Yes. Deployments are reversible with a one-click swap inside the trial window.

Who provides Recon Skills?

Hiago (uphiago), vetted by the Scrums.com platform.

How it compares

vs other skills

Option	From	Stack	Status
Recon Skills · this one	Priced on scope	skill · agent-skills · software-engineering	● available
Anti-Slop	Priced on scope	skill · agent-skills · software-engineering	● available
Security Audit Skill	Priced on scope	skill · agent-skills · software-engineering	● available
Interface Skills by Jakub Krehel	Priced on scope	skill · agent-skills · software-engineering	● available

Commonly deployed with

more skills

More skills

Anti-Slop

An opinionated Oxlint ruleset that rejects low-evidence and low-signal TypeScript and JavaScript patterns, meant to be vendored into a repository rather than installed as a package. The bundled install-anti-slop skill lets a coding agent copy the plugin, pin compatible Oxlint dependencies, and later merge upstream updates while keeping local customisations.

From $0Dillon Mulroyskillagent-skillssoftware-engineeringSee options →

Security Audit Skill

A coding-agent skill that runs a six-phase security audit: reconnaissance, coverage-led hunting with isolated sub-agents, candidate validation by fresh verifiers, structured findings, independent record verification, and target-neutral reports. It seeded Cloudflare's vulnerability discovery harness, records each verdict as confirmed, needs_validation, or rejected, and re-uses prior ledgers on repeat runs.

From $0Cloudflareskillagent-skillssoftware-engineeringSee options →

Interface Skills by Jakub Krehel

A set of 11 agent skills for building user interfaces: UI details, typography, colour systems, accessibility, layout, product copy, and a combined interface review. It also adds user-invoked skills that render a component in every state to stress-test it and build variants, and installs with the Skills CLI or as a Claude Code plugin.

From $0Jakub Krehelskillagent-skillssoftware-engineeringSee options →

starting price

Priced on scope