cross-wave-delta-analysis

1# Cross-Wave Delta Analysis Skill
2 
3Methodology for comparing findings across multiple recon waves on the same target set. Detects NEW findings, REGRESSIONS (previously open now blocked), PERSISTENT vulnerabilities, and CHANGES over time. Distilled from 9 waves across 7 deep targets that revealed missed CORS findings, new port exposures, and infrastructure drift.
4 
5## When to Use
6 
7- Running repeated recon on the same target set (Wave N+1 after Wave N).
8- You want to know if a vulnerability was PATCHED since last wave.
9- You want to know if a NEW surface appeared (new ports, new subdomains, new endpoints).
10- After completing a deep recon wave — produce the delta report before next wave.
11- Before reporting — confirm findings are still valid (not regressed).
12 
13## Prerequisites
14 
15- Prior assessment output beneath `${OUTPUT_DIR:-./output}/baseline/`.
16- Current assessment output beneath `${OUTPUT_DIR:-./output}/current/`.
17- Structured findings per target (at minimum: ports, CORS status, WP users, XMLRPC status, sensitive paths).
18 
19## How to Run
20 
21```bash
22# Produce a delta report comparing WaveN to WaveN+1
23# Read wave outputs, compare per-target, classify findings
24```
25 
26## Quick Reference
27 
28### Delta Categories
29 
30| Category | Label | Meaning | Example |
31|----------|-------|---------|---------|
32| NEW | ++ | Finding that didn't exist in any prior wave | `Port 3306 (MySQL) now OPEN` |
33| REGRESSION | -- | Service that was accessible but is now blocked | `XMLRPC 200 -> 405 (hardened)` |
34…