# Attack Surface

> Maps every entry point, component, and trust boundary of a target before testing begins prevents missed coverage and prioritizes the highest-value attack paths. Trigger when the user provides a target and wants to know where to start, says "map the attack surface", "what should I test", or "where do I begin", or is starting any engagement after scope-grill is complete.

- **Type:** Skill
- **Install:** `agentstack add skill-rifteo-skills-attack-surface`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Rifteo](https://agentstack.voostack.com/s/rifteo)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Rifteo](https://github.com/Rifteo)
- **Source:** https://github.com/Rifteo/skills/tree/main/attack-surface

## Install

```sh
agentstack add skill-rifteo-skills-attack-surface
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Attack Surface Mapper

Before testing individual vulnerabilities, map the full attack surface. Untested components are unfound vulnerabilities. This skill produces a structured map that drives testing coverage.

## Process

### Phase 1 — Enumerate Entry Points

Systematically identify every place an attacker could interact with the target:

- **Web** — domains, subdomains, ports 80/443, login pages, API endpoints, file upload, search, export
- **APIs** — REST, GraphQL, SOAP, WebSocket, mobile API backends
- **Auth flows** — login, registration, password reset, OAuth/SSO, MFA bypass paths
- **Network** — open ports, admin interfaces (SSH, RDP, Telnet), VPNs, exposed management panels
- **Cloud** — S3 buckets, blob storage, exposed functions/lambdas, public AMIs, metadata endpoints
- **Third-party integrations** — webhooks, OAuth providers, embedded iframes, CDN-served content
- **Client-side** — JavaScript source, local storage, service workers, postMessage handlers

### Phase 2 — Identify Trust Boundaries

Mark where the system transitions between trust levels:
- Unauthenticated → authenticated
- User role → admin role
- External network → internal network
- Client-controlled input → server-side processing

### Phase 3 — Tech Stack Fingerprint

For each component, note:
- Language / framework
- Version (if visible)
- Authentication mechanism
- Known CVEs for the version (run `check-exploit` skill on identified versions)

### Phase 4 — Prioritize

Rank attack paths by value. See `references/priority-matrix.md`.

## Output Format

Produce a **Surface Map** table:

| Component | Type | Auth Required | Tech Stack | Priority | Notes |
|---|---|---|---|---|---|
| `/api/v2/users` | REST API | Bearer token | Node.js/Express | High | Returns PII |
| `admin.target.com` | Web app | Basic auth | Apache/PHP | Critical | Exposed to internet |

Follow with a **Recommended Testing Order** — ordered list of highest-value targets first.

## Rules

- Do not start testing until Phase 1 is complete — partial maps lead to missed coverage
- If the scope is large, timebox Phase 1 and note what was not mapped
- Reference `check-exploit` for every identified technology version

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Rifteo](https://github.com/Rifteo)
- **Source:** [Rifteo/skills](https://github.com/Rifteo/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-rifteo-skills-attack-surface
- Seller: https://agentstack.voostack.com/s/rifteo
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.