attack-surface

Identifies and inventories external data entry points, classifying them by authentication, input types, validation, risk factors, and exposure for integration with Sentinel's scanning pipeline and risk scoring system.

3|Updated Apr 13, 2026

Search Tags:#endpoints #mapping #attack-surface #security-analysis #entry-points #risk-scoring

Ready to run

npx skills add https://github.com/0x1337c0d3/claude-security --skill attack-surface-0x1337c0d3

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: attack-surface
Source: https://github.com/0x1337c0d3/claude-security/tree/main/skills/sentinel/skills/attack-surface
Command: npx skills add https://github.com/0x1337c0d3/claude-security --skill attack-surface-0x1337c0d3

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Map the application attack surface by discovering and inventorying every entry point where external data enters, enabling focused security scanning and hardening.

Core Features & Use Cases

Detect frameworks and identify routes, endpoints, and entry points.
Produce a ranked catalog of routes, APIs, input handlers, and external interfaces by exposure level.
Serve as a pre-scan step before running /sentinel to surface unauthenticated or shadow endpoints.

Quick Start

Run /sentinel:attack-surface to generate a full surface map before scanning with Sentinel.

Frequently Asked Questions about attack-surface

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map my application's attack surface to find hidden API endpoints?▼

To map an application attack surface, you detect frameworks and extract routes to inventory every external data entry point. This classifies each API endpoint by authentication, input types, and exposure for prioritized security analysis.

What is an attack surface inventory and when do I need it for security analysis?▼

An attack surface inventory is a machine-readable catalog of all external data entry points, APIs, and input handlers ranked by exposure. You need it before running security scans to surface unauthenticated or shadow endpoints.

How do I identify unauthenticated or shadow endpoints before a security scan?▼

You identify shadow endpoints by running an attack surface mapping step that automatically detects frameworks and extracts routes. This produces a ranked catalog of entry points by exposure level prior to scanning.

Can I integrate attack surface mapping results with a risk scoring system?▼

Yes, attack surface mapping generates a machine-readable inventory of entry points classified by validation and rate limiting. This output is designed for integration with scanning pipelines and risk scoring systems.

What's the best way to classify API routes by exposure level for security hardening?▼

The best way to classify API routes is to map the attack surface by extracting endpoints and evaluating authentication, input types, validation, and rate limiting. This produces a ranked catalog for security hardening.

Do I need to run attack surface mapping before scanning my application for vulnerabilities?▼

Yes, running attack surface mapping serves as a pre-scan step to inventory external entry points and classify their exposure. This prioritizes targets and surfaces shadow endpoints before running a full vulnerability scan.