The default action — no recon keyword needed. Runs the full OSINT pipeline against an authorized target: infers its email/username schema, correlates scattered signals into confidence-scored identities (exact → fuzzy → perceptual avatar-hash), enriches them, maps in-scope authentication surfaces, and returns a ranked "most-likely way in". Accepts several targets at once, and - to read them from stdin. The scope is auto-discovered; it refuses to run without one.

Scaffolds a scope.json engagement file, pre-filling the allow-list with the target and its subdomains and setting a one-year window. Edit authorized_by before you run — the scope is your declaration of authorization. -g writes it globally to ~/.config/skirmisher/scope.json so skirmisher <target> then works from any directory; -o FILE chooses the path; --force overwrites an existing one.

The explicit form of skirmisher <target> — runs the five stages (Profile → Correlate → Enrich → Surface → Rank). Add -O for live surface discovery (DNS + TLS on in-scope hosts), -P for passive crt.sh subdomain discovery, and -e FILE for credential-reuse enrichment. -j / --dot change the output format.

Validates a scope file — it must be well-formed, name an authorized_by, carry a non-empty allow-list, and not be expired — then prints what's authorized (allow / deny). With -H <host> it tests a single host against the scope and prints ALLOW or DENY with the reason, so you can confirm a target is in scope before touching it. The file is auto-discovered if omitted.

Lists every available module with its short alias and a one-line description, and whether it is read-only [aux] or [invasive]. Use the alias with run/check — e.g. probe, expose, headers, fp, tls, ssh.

Lists the recon collectors and their tier: offline (always run — schema inference, fixtures), network (-O: live surface discovery), or passive (-P: crt.sh). Shows which are gated behind an opt-in flag.

Runs a module against a host. The positional target sets RHOST; set other options with -o KEY=VAL (repeatable, e.g. -o RPORT=8443 -o SSL=false). The runner authorizes every target through the scope guard before the module executes, so an out-of-scope host is refused before a single packet is sent — and the decision is audited. Each meaningful result is recorded as a finding (to <scope>.findings.jsonl) for skirmisher report; --no-findings skips that.

Runs a module's non-invasive check only — the quick "is it there / is it exposed?" probe without the full action (e.g. which ports are open, whether the host serves HTTP). Same scope-gating, options, and findings behaviour as run.

Builds a Markdown penetration-test report from the findings recorded during the engagement: an executive summary with a severity tally, the scope, every finding by severity with its evidence and timestamp, a methodology section derived from the audit trail, and an appendix. -o FILE writes it to a file (otherwise stdout); -s points at the scope for engagement metadata; findings are auto-discovered alongside the scope.

Prints a shell-completion script for the sk and skirmisher commands so subcommands and module aliases tab-complete. Source it from your shell rc — e.g. skirmisher completions zsh > ~/.config/skirmisher/completion.zsh, then source it (after compinit on zsh).

Prints the full manual to the terminal — the same reference as the installed man sk page (synopsis, commands, options, pipes, exit status, and the authorization statement).

Prints the installed version. skirmisher --version works too.