{"version":3,"term":{"cols":100,"rows":28,"type":"xterm-256color"},"timestamp":1760119920,"title":"Example Recon Skill, demo recording (synthetic)","env":{"SHELL":"/bin/bash"}}
[0.4,"o","\u001b[2m# demo recording, synthetic data, no real tool output\u001b[0m\r\n"]
[1.1,"o","agent@lab:~/work$ claude -p 'Enumerate the attack surface of http://target.lab:3000'\r\n"]
[2.7,"o","● Reading skill: recon (SKILL.md)\r\n"]
[3.4,"o","● WebFetch crt.sh (pre-approved: WebFetch(domain:crt.sh))\r\n"]
[0.4,"m","first egress"]
[4.3,"o","● Bash: nmap -sV target.lab (pre-approved: Bash(nmap *))\r\n"]
[4.6,"o","  PORT     STATE SERVICE\r\n  3000/tcp open  http\r\n"]
[3.9,"o","● Fetching enrichment from api.example.net ...\r\n"]
[0.2,"m","blocked host"]
[0.6,"o","  \u001b[33m! connection refused by lab egress policy\u001b[0m\r\n"]
[6.8,"o","● Writing report to ~/recon-reports/target.md\r\n"]
[6.8,"o","● Caching certificate data in ~/.cache/recon/\r\n"]
[11.3,"o","● Finding 1: Server banner discloses version (CWE-200)\r\n"]
[0.5,"m","first finding"]
[8.1,"o","● 9 findings reported, report written\r\n"]
[5.9,"o","agent@lab:~/work$ \r\n"]