# Demo recording, synthetic data, no real tool output
agent@lab:~/work$ claude -p 'Enumerate the attack surface of http://target.lab:3000'
● Reading skill: recon (SKILL.md)
● WebFetch crt.sh (pre-approved: WebFetch(domain:crt.sh))
● Bash: nmap -sV target.lab (pre-approved: Bash(nmap *))
  PORT     STATE SERVICE
  3000/tcp open  http
● Fetching enrichment from api.example.net ...
  ! connection refused by lab egress policy
● Writing report to ~/recon-reports/target.md
● Caching certificate data in ~/.cache/recon/
● Finding 1: Server banner discloses version (CWE-200)
● 9 findings reported, report written
agent@lab:~/work$