zoharbabin

Company Recon Skill — AI skill for Claude Code

AI community

Claude Code skill for SaaS technology reconnaissance — discovers every website embedding a target company's technology using OSINT techniques.

How to install Company Recon Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open zoharbabin/company-recon-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Company Recon Skill does

Claude Code skill for SaaS technology reconnaissance — discovers every website embedding a target company's technology using OSINT techniques.

Alternatives in AI

Surface — Show ranked attack surface for a target from its recon manifest + hunt memory 3.8k ★
Main — Open-source SaaS framework (React + Firebase + Stripe) with built-in Claude Code AI skills 550 ★
Lastsaas — SaaS boilerplate/starter-kit in Go+React with Stripe integration, multi-tenant support, comprehensive features 161 ★

README

company-recon-skill

[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) [![Claude Code](https://img.shields.io/badge/Claude%20Code-Skill-blueviolet)](https://docs.anthropic.com/en/docs/claude-code)

**SaaS technology reconnaissance skill for Claude Code** — discovers every website embedding a target company's technology using OSINT techniques.

Quick Install

git clone https://github.com/zoharbabin/company-recon-skill.git ~/.claude/skills/saas-recon

Or symlink from wherever you cloned it:

git clone https://github.com/zoharbabin/company-recon-skill.git ~/projects/company-recon-skill
ln -s ~/projects/company-recon-skill ~/.claude/skills/saas-recon

Usage

In Claude Code:

/saas-recon Acme Corp
/saas-recon widgetcloud.io

The skill accepts a company name or domain as its argument.

What It Does

A 9-phase OSINT pipeline that maps a SaaS company's entire technology footprint:

Phase	Description
1. Company Profiling	Identifies subsidiaries, domains, products, and corporate structure
2. Certificate Transparency	Queries CT logs (crt.sh) for all SSL certificates, revealing client-branded subdomains
3. Infrastructure Mapping	DNS resolution, CNAME chain analysis, cloud provider identification
4. Archive Mining	Wayback Machine, Common Crawl, and gau URL collection for historical artifacts
5. Code Search	GitHub code search for embed scripts, CDN references, custom elements, and tracker database entries
6. Live Embed Detection	Playwright browser automation to verify embeds on candidate sites
7. Web & News Search	Google dorks, press mentions, partner pages, job listings, conference appearances
8. Analytics Correlation	Shared Google Analytics / GTM / HubSpot / Facebook Pixel IDs across domains
9. Business Intelligence	Investor filings, SEC/SEDAR, technology directories, patent searches