techstack-identification

Name: techstack-identification
Author: transilienceai

86installs74forks

How to install techstack-identification?

transilienceai/communitytools/techstack-identification

$npx -y skills add transilienceai/communitytools --skill techstack-identification

Installs into the current project.

Summary

OSINT-based technology stack identification. Routes to 6 domain sub-skills (frontend, backend, infra, security, osint, correlation) to discover a target's stack from publicly available signals.

Files · 1

View on GitHub

SKILL.md

1	# Tech Stack Identification
2
3	Passive OSINT reconnaissance to identify a target's technology stack. No credentials, no active scanning — only publicly available signals.
4
5	## Quick Start
6
7	```
8	1. Provide company name (+ optional domain hint)
9	2. Run infra first (asset inventory) → frontend / backend / security / osint in parallel
10	3. Pass all signals into correlation → final report (JSON + Markdown)
11	```
12
13	## Domain Sub-Skills
14
15	\| Sub-skill \| Identifies \| Read \|
16	\|-----------\|-----------\|------\|
17	\| frontend \| JS frameworks, meta-frameworks, CSS libraries, build tools, CMS via DOM/HTML/JS \| [frontend/SKILL.md](frontend/SKILL.md) \|
18	\| backend \| Web servers, runtimes, languages, frameworks, DB, APIs, CMS \| [backend/SKILL.md](backend/SKILL.md) \|
19	\| infra \| Cloud, CDN/WAF, DNS, TLS/CT, DevOps, asset discovery (domains/subdomains/IPs) \| [infra/SKILL.md](infra/SKILL.md) \|
20	\| security \| Security headers, CSP, email auth, security.txt, third-party SaaS \| [security/SKILL.md](security/SKILL.md) \|
21	\| osint \| Public repos (GitHub/GitLab), job postings/ATS, Wayback Machine \| [osint/SKILL.md](osint/SKILL.md) \|
22	\| correlation \| Cross-validation, confidence scoring, conflict resolution \| [correlation/SKILL.md](correlation/SKILL.md) \|
23
24	## Routing by Objective
25
26	\| Objective \| Mount \|
27	\|-----------\|-------\|
28	\| Full stack discovery \| infra → (frontend, backend, security, osint) → correlation \|
29	\| CDN/WAF identification only \| infra \|
30	\| API surface mapping \| backend \|
31	\| Supply-chain / SaaS exposure \| security + osint \|
32	\| CVE matching by version \| backend + frontend (then correlation) \|
33	\| Migration / historical context \| osint (web archive) + correlation \|
34	\| CMS fingerprint \| frontend (HTML generators) + backend (CMS paths/cookies) \|
35	\| Asset inventory only \| infra (domain discovery, subdomain enum, IP attribution, CT) \|
36
37	## Confidence Levels
38
39	- High: 3+ independent sources OR explicit identifier (header/meta/global) + supporting evidence + version known
40	- Medium: Single strong source OR multiple indirect signals (URL patterns, cookies, DOM attrs, job postings)
41	- Low: Speculative — single weak signal, conflicting data, or archive-only evidence
42
43	Computed in `correlation/`. Target distribution: 50-70% High, 20-35% Medium, <15% Low.
44
45	## Final Report Schema
46
47	```json
48	{ "report_id": "uuid", "company": "string", "primary_domain": "string",
49	"discovered_assets": {"domains", "subdomains", "ip_addresses", "certificates", "api_portals"},
50	"technologies": {
51	"frontend": [{"name", "version?", "confidence", "evidence": []}],
52	"backend": [...], "infrastructure": [...], "security": [...],
53	"devops": [...], "third_party": [...] },
54	"confidence_summary": {"high_confidence", "medium_confidence", "low_confidence", "overall_score"} }
55	```
56
57	## Rate Limits
58
59	crt.sh 10/min · GitHub (unauth) 60/h · HTTP 30/min/domain · DNS 30/min · Wayback CDX 15/min · WHOIS 5/min.
60
61	## Ethics
62
63	Passive only. No active scanning, credentialed access, zone transfers, or brute force. Public sources only. Log every external request for audit.

People who liked this also viewed

6 picks

Type

techstack-identification

86installs74forks

View on GitHub

How to install techstack-identification?

transilienceai/communitytools/techstack-identification

$npx -y skills add transilienceai/communitytools --skill techstack-identification

Installs into the current project.

Summary

OSINT-based technology stack identification. Routes to 6 domain sub-skills (frontend, backend, infra, security, osint, correlation) to discover a target's stack from publicly available signals.

Files · 1

View on GitHub

SKILL.md

1	# Tech Stack Identification
2
3	Passive OSINT reconnaissance to identify a target's technology stack. No credentials, no active scanning — only publicly available signals.
4
5	## Quick Start
6
7	```
8	1. Provide company name (+ optional domain hint)
9	2. Run infra first (asset inventory) → frontend / backend / security / osint in parallel
10	3. Pass all signals into correlation → final report (JSON + Markdown)
11	```
12
13	## Domain Sub-Skills
14
15	\| Sub-skill \| Identifies \| Read \|
16	\|-----------\|-----------\|------\|
17	\| frontend \| JS frameworks, meta-frameworks, CSS libraries, build tools, CMS via DOM/HTML/JS \| [frontend/SKILL.md](frontend/SKILL.md) \|
18	\| backend \| Web servers, runtimes, languages, frameworks, DB, APIs, CMS \| [backend/SKILL.md](backend/SKILL.md) \|
19	\| infra \| Cloud, CDN/WAF, DNS, TLS/CT, DevOps, asset discovery (domains/subdomains/IPs) \| [infra/SKILL.md](infra/SKILL.md) \|
20	\| security \| Security headers, CSP, email auth, security.txt, third-party SaaS \| [security/SKILL.md](security/SKILL.md) \|
21	\| osint \| Public repos (GitHub/GitLab), job postings/ATS, Wayback Machine \| [osint/SKILL.md](osint/SKILL.md) \|
22	\| correlation \| Cross-validation, confidence scoring, conflict resolution \| [correlation/SKILL.md](correlation/SKILL.md) \|
23
24	## Routing by Objective
25
26	\| Objective \| Mount \|
27	\|-----------\|-------\|
28	\| Full stack discovery \| infra → (frontend, backend, security, osint) → correlation \|
29	\| CDN/WAF identification only \| infra \|
30	\| API surface mapping \| backend \|
31	\| Supply-chain / SaaS exposure \| security + osint \|
32	\| CVE matching by version \| backend + frontend (then correlation) \|
33	\| Migration / historical context \| osint (web archive) + correlation \|
34	\| CMS fingerprint \| frontend (HTML generators) + backend (CMS paths/cookies) \|
35	\| Asset inventory only \| infra (domain discovery, subdomain enum, IP attribution, CT) \|
36
37	## Confidence Levels
38
39	- High: 3+ independent sources OR explicit identifier (header/meta/global) + supporting evidence + version known
40	- Medium: Single strong source OR multiple indirect signals (URL patterns, cookies, DOM attrs, job postings)
41	- Low: Speculative — single weak signal, conflicting data, or archive-only evidence
42
43	Computed in `correlation/`. Target distribution: 50-70% High, 20-35% Medium, <15% Low.
44
45	## Final Report Schema
46
47	```json
48	{ "report_id": "uuid", "company": "string", "primary_domain": "string",
49	"discovered_assets": {"domains", "subdomains", "ip_addresses", "certificates", "api_portals"},
50	"technologies": {
51	"frontend": [{"name", "version?", "confidence", "evidence": []}],
52	"backend": [...], "infrastructure": [...], "security": [...],
53	"devops": [...], "third_party": [...] },
54	"confidence_summary": {"high_confidence", "medium_confidence", "low_confidence", "overall_score"} }
55	```
56
57	## Rate Limits
58
59	crt.sh 10/min · GitHub (unauth) 60/h · HTTP 30/min/domain · DNS 30/min · Wayback CDX 15/min · WHOIS 5/min.
60
61	## Ethics
62
63	Passive only. No active scanning, credentialed access, zone transfers, or brute force. Public sources only. Log every external request for audit.

People who liked this also viewed

6 picks

Type