attack-surface-mapping

1# Attack Surface Mapping
2 
3Given **one target** and **one application**, draw the surface from what that application already exposes. Then stop. Testing lives in other skills.
4 
5This skill is the fast path. Success is a portrait plus a host/API inventory plus a key table plus response-class labels plus an object graph. A probe count is not success.
6 
7Field patterns for where the rest of the surface actually lives: [SURFACE_PATTERNS.md](./SURFACE_PATTERNS.md).
8 
9## When
10 
11- A new URL, a new app, or "I only see a login page"
12- Need to know **what** to test before loading injection / auth / upload skills
13- The agent is about to brute directories, spray quotes, or expand to unrelated hosts
14 
15Do **not** use this skill to expand an organization-wide host universe. Map the current application cluster. Finish it. Then, if scope allows, take the next cluster.
16 
17Authorization and destruction bounds: [hack](../hack/SKILL.md) start gate. Stay in scope.
18 
19## What must exist (not a file tree)
20 
21Before any vulnerability skill, these facts must be retrievable. Persist them in whatever the local workspace already uses for notes and evidence — an existing task folder, a proxy project, session notes, a ticket. Do not invent a new directory layout when one is already in play.
22 
23| Fact | Keep |
24|---|---|
25| Portrait | 3–5 sentences, not an essay |
26| Hosts | Business hosts, gateways, API domains this app already named |
27| Endpoints | Method, path, params, auth required? |
28…