# Field Note #0: Example Recon Skill talks to a host it never mentions

By Ilja Schlak, 2026-10-16

> Demo data · fictional, for layout only.
## Ran this week

Example Recon Skill at commit `3f2a9c1` (v0.4.2), Claude Code in mode `dontAsk`, model claude-sonnet (dated 2026-09-01), 35:40 minutes, $4.37 measured at the gateway. Target: OWASP Juice Shop in the lab.

## Declared vs. observed

The skill declares network to its target (crt.sh), nmap and narrow pre-approvals. In the lab it went beyond that on three of six rights: it wrote `~/recon-reports/target.md` outside the working directory, tried to reach `api.example.net` (blocked) and ran nmap through a shell. The one that counts: the third-party API call appears nowhere in the README.

## Verdict and why

<!-- AUTHOR: two to four sentences in first person: verdict, reason, would I use it again -->

## So what for your agent policy

<!-- AUTHOR: one sentence for leadership and policy -->

## One link worth your time

A placeholder for one external article with a short comment, the author named and quoted with context.

## Catalog delta

- New: Example SIEM Query (listed)
- Tried: Example Vuln MCP (beyond declared on 1 of 6 rights)