docs(skills): remove references to tools not installed in the sandbox

[devin-ai-integration]

Summary

Several skills and the agent system prompt recommended external CLIs that are not installed in the sandbox image (containers/Dockerfile). This can send the agent down a dead end invoking a missing binary. This PR audits every skill + prompt and replaces the unavailable tools with installed equivalents (or, where there's no equivalent, reworks the technique around what ships in the image).

Sandbox-installed recon/brute tooling is: subfinder, httpx, naabu, katana, nuclei, ffuf, nmap, sqlmap, wapiti, curl/jq/dig/whois/openssl — but not amass, tlsx, dnsx, asnmap, mapcidr, uncover, cero, hydra, cewl, patator, or msfconsole.

Changes

• skills/reconnaissance/asset_discovery.md: previously claimed "the projectdiscovery suite (already available in the sandbox)" and built the whole methodology on tlsx/dnsx/asnmap/mapcidr/uncover (+amass/cero) — none installed. Rewritten around installed tools:
  • tlsx / active SAN harvest → httpx -tls-grab (or openssl s_client)
  • dnsx → dig / nslookup
  • asnmap/mapcidr → whois (e.g. whois -h whois.cymru.com)
  • uncover → direct crt.sh via curl+jq, Censys/Shodan
• skills/vulnerabilities/subdomain_takeover.md: pipeline example resolve (dnsx) → resolve (dig).
• skills/vulnerabilities/weak_password_detection.md: dropped hydra ("Primary Tool"), patator, and cewl; web logins now use ffuf, services use nmap NSE *-brute scripts. Replaced dead absolute paths /usr/share/wordlists/rockyou.txt and /usr/share/seclists/... (nothing ships by default) with guidance to download into /home/pentester/tools/wordlists at runtime.
• agents/prompts/system_prompt.jinja: interactive-process example msfconsole → sqlmap.

Left intentionally unchanged

• skills/technologies/active_directory.md references bloodhound/impacket/netexec/kerbrute/hashcat/john/smbclient/responder/certipy, but the skill already ships an explicit pipx/go/apt install block for them, so they are installed-on-demand by design.
• skills/* mentions of burp are conceptual comparisons ("humans often use Burp… prefer manual curl") and a nuclei -input-mode burp flag — never claimed as installed.

No code paths change; docs/prompt only.

Link to Devin session: https://app.devin.ai/sessions/9deb20122d4a4fdcb02b69c744ff0656
Requested by: @0xallam

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR revises agent guidance to use tools available in the sandbox.

• Replaces unavailable asset-discovery utilities with httpx, dig, whois, OpenSSL, and direct API queries.
• Updates the subdomain-takeover pipeline to use subfinder and dig.
• Reworks password testing around ffuf, Nmap NSE scripts, runtime-downloaded wordlists, and custom scripts.
• Uses sqlmap instead of msfconsole in the terminal-session example.

Confidence Score: 4/5

The PR should not merge until the asset-discovery pipeline stops claiming that dig can preserve and directly participate in an end-to-end JSON chain.

The revised skill can direct agents to pass incompatible JSONL and DNS text formats between Subfinder, dig, and httpx, causing the reconnaissance stage to fail or lose discovered assets.

Files Needing Attention: strix/skills/reconnaissance/asset_discovery.md

Important Files Changed

Filename	Overview
strix/agents/prompts/system_prompt.jinja	Replaces the unavailable msfconsole process example with installed sqlmap without changing prompt structure.
strix/skills/reconnaissance/asset_discovery.md	Rewrites discovery around installed tools, but incorrectly presents dig as a stage in an end-to-end JSON pipeline.
strix/skills/vulnerabilities/subdomain_takeover.md	Replaces unavailable enumeration and resolution tools in the conceptual takeover workflow.
strix/skills/vulnerabilities/weak_password_detection.md	Replaces unavailable brute-force utilities and nonexistent bundled wordlists with installed tools and runtime acquisition guidance.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
strix/skills/reconnaissance/asset_discovery.md:146
**Broken JSON discovery pipeline**

When an agent follows this pipeline while retaining JSON output, `dig` neither consumes Subfinder JSONL nor emits JSONL for the following stage, causing DNS resolution or downstream parsing to fail and discovered hosts to be omitted.

_{Reviews (1): Last reviewed commit: "docs(skills): remove references to tools..." | Re-trigger Greptile}

[greptile-apps]

Broken JSON discovery pipeline

When an agent follows this pipeline while retaining JSON output, dig neither consumes Subfinder JSONL nor emits JSONL for the following stage, causing DNS resolution or downstream parsing to fail and discovered hosts to be omitted.

Knowledge Base Used: Skills Library

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/skills/reconnaissance/asset_discovery.md
Line: 146

Comment:
**Broken JSON discovery pipeline**

When an agent follows this pipeline while retaining JSON output, `dig` neither consumes Subfinder JSONL nor emits JSONL for the following stage, causing DNS resolution or downstream parsing to fail and discovered hosts to be omitted.

**Knowledge Base Used:** [Skills Library](https://app.greptile.com/strix-org-3/-/custom-context/knowledge-base/usestrix/strix/-/docs/skills-library.md)

How can I resolve this? If you propose a fix, please make it concise.