perseus:scan

Map target architecture, entry points, and security patterns into a Target Knowledge Graph.

66|14|Updated Feb 8, 2026
One-click install
npx skills add https://github.com/kaivyy/perseus --skill perseus-scan
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: perseus:scan
Source: https://github.com/kaivyy/perseus/tree/main/skills/perseus/scan
Command: npx skills add https://github.com/kaivyy/perseus --skill perseus-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Maps target architecture, entry points, and security patterns to build a Target Knowledge Graph for informed risk assessment and planning.

Core Features & Use Cases

  • Phase 1 Discovery: Architecture Scanner, Entry Point Mapper, Security Pattern Hunter.
  • Phase 2 Surface Mapping: XSS/Injection Sink Hunter, SSRF Tracer, Data Security Auditor.
  • Deliverables: Target Knowledge Graph and a synthesis deliverable for Phase 3 reporting.

Quick Start

Run /start to perform a full automated assessment or run /scan to begin Phase 1 reconnaissance.

Frequently Asked Questions about perseus:scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map application architecture and identify security vulnerabilities during reconnaissance?

To map application architecture and identify vulnerabilities, you perform reconnaissance to discover entry points and security patterns, building a Target Knowledge Graph. This covers web applications, APIs, and microservices to reveal the attack surface for risk assessment.

What is attack surface mapping and how does it work for microservices?

Attack surface mapping discovers and catalogs entry points and security patterns across microservices. It works by coordinating Phase 1 discovery and Phase 2 mapping tasks, tracing XSS and SSRF sinks to produce a structured Target Knowledge Graph for vulnerability research.

How do I perform a full automated security assessment and map entry points?

You can perform a full automated security assessment by running an aggregated start command that executes both Phase 1 reconnaissance and Phase 2 mapping sequentially. This builds the complete Target Knowledge Graph, mapping entry points and security patterns efficiently.

Can I use this reconnaissance approach for both web applications and APIs?

Yes, this reconnaissance approach supports both web applications and APIs. The architecture scanning and entry point mapping tasks are designed to apply to web applications, APIs, and microservices, ensuring comprehensive attack surface coverage across different target types.

What is the best way to document entry points and injection sinks for vulnerability reporting?

The best way to document entry points and injection sinks for vulnerability reporting is generating a Target Knowledge Graph. This synthesis deliverable structures Phase 1 and Phase 2 findings, providing a comprehensive foundation for Phase 3 reporting.

When should I begin Phase 1 reconnaissance versus Phase 2 surface mapping?

You should begin Phase 1 reconnaissance for initial architecture discovery and entry point mapping, then proceed to Phase 2 surface mapping. Phase 2 focuses on hunting specific injection sinks, tracing SSRF, and auditing data security based on Phase 1 foundations.