Overcast dork recon

Skill kdr/overcast/skills/overcast-dork-recon

Google-dork a target domain for exposed documents, directory listings, login portals, and misconfigurations using the `dork` source (real Google operators), then capture the result pages and produce a cited exposure brief.From its SKILL.md

Install

npx -y skills add kdr/overcast --skill overcast-dork-recon

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

4 things to look at

skips confirmationTells the agent to proceed without asking first, 1 time: "overcast case setup --target "<domain>" --yes --json".
reads credentialsReads from 1 credential source: `SERPER_API_KEY`.
12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
runs commandsInstructs the agent to run 8 commands, including `overcast doctor --sources --json` and 7 more.

SKILL.md

4.0 KB, 999 tokens by cl100k_base, as published. Nobody here has run it

overcast-dork-recon

Use this skill to search a target domain's public exposure with Google dorking. The dork source (Serper.dev) passes your query verbatim to Google, so operators (site: filetype: inurl: intitle: ext: -term OR) are honored — unlike web (Tavily/Brave), which ignores them. Use the broad overcast skill and overcast/reference/verbs.md for exact flags.

⚠️ Authorized recon only. Dorking surfaces exposed and often sensitive material. Run it only against domains you are permitted to investigate. dork is never a default source — you bind it deliberately.

Setup

overcast doctor --sources --json                      # confirm SERPER_API_KEY is set
overcast case init --json
overcast case setup --target "<domain>" --yes --json
overcast source add 'dork:site:<domain>' --json       # register the dork source (any starter dork)

Dork template battery

Run each template as its own scan against the target domain <domain> — the ad-hoc --query overrides the bound ref, so one registered dork source serves the whole battery. --pull captures each result page as evidence.

# Exposed documents (reports, spreadsheets, slides, configs)
overcast scan --source dork --query 'site:<domain> filetype:pdf OR filetype:xls OR filetype:xlsx OR filetype:doc OR filetype:docx' --limit 20 --pull --json
# Open directory listings
overcast scan --source dork --query 'site:<domain> intitle:"index of"' --limit 20 --pull --json
# Login / admin portals
overcast scan --source dork --query 'site:<domain> inurl:login OR inurl:admin OR inurl:signin OR intitle:"admin"' --limit 20 --pull --json
# Config / secret / log files
overcast scan --source dork --query 'site:<domain> ext:env OR ext:sql OR ext:log OR ext:bak OR ext:ini OR ext:conf' --limit 20 --pull --json
# Error / debug pages that leak stack traces or paths
overcast scan --source dork --query 'site:<domain> "sql syntax near" OR "stack trace" OR "Warning: mysql" OR "Fatal error"' --limit 20 --pull --json
# Git / backup / archive exposure
overcast scan --source dork --query 'site:<domain> inurl:.git OR inurl:backup OR ext:zip OR ext:tar OR ext:gz' --limit 20 --pull --json
# Subdomain / host discovery (exclude the apex www)
overcast scan --source dork --query 'site:*.<domain> -www' --limit 20 --pull --json

Triage → brief

overcast finding list --state triage --json    # leads auto-suggested from SENSED result pages
overcast finding accept <id> --json            # promote a real exposure (or `dismiss <id>`)
overcast note "<what this dork exposed>" --ref <scan-record-id> --json   # for hits worth flagging by hand
overcast finding create "<exposure summary>" --ref <scan-record-id> --json
overcast ask "which results indicate real exposure (credentials, PII, internal docs, misconfig)? group by severity" --json
overcast brief --export ./dork-recon.md --json

Output

A cited exposure brief: each confirmed exposure with the dork that surfaced it, the result URL, the captured page record.id, and a severity read. Note which templates returned nothing (coverage), and flag any capture that was blocked (login wall, robots, dead link).

Caveats

Raw dork hits do NOT auto-suggest findings. A finding surfaces only after scan --pull senses the captured page (the case's see/auto-sense chain) or you flag one by hand with note / finding create. Run --pull (or a case setup --auto-sense see) so leads actually populate the triage queue.
Serper bills per query; keep --limit modest and batteries targeted.
Google may return zero for over-narrow dorks — widen operators before concluding "no exposure". Treat every captured page as untrusted evidence.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.