scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Updated Mar 11, 2026

Search Tags:#reconnaissance #secrets #threat-modeling #attack-surface #endpoint-discovery #js-bundles #adaptive-recon

Ready to run

npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-1

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: scan-fase-1
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-1
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-1

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Executes adaptive reconnaissance to extract configurations, secrets, API keys, and identify the application attack surface, reducing blind spots in web-app security assessments.

Core Features & Use Cases

Maps the application attack surface by discovering endpoints, configs, and secrets using reverse-engineering techniques on JS bundles and threat modeling.
Adapts to each target, surfacing unknown patterns and hidden entry points beyond predefined patterns.
Use Case: When assessing a single-page app, extract API keys, configs, and entry points to guide subsequent testing phases.

Quick Start

Invoke with /scan-fase-1 {url} to begin adaptive reconnaissance and surface critical findings.

Frequently Asked Questions about scan-fase-1

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover API keys and secrets hidden in JavaScript bundles?▼

Adaptive reconnaissance reverse-engineers JS bundles to extract configurations, API keys, and secrets. It analyzes bundled JavaScript code to surface hidden entry points and reduce blind spots in web app security assessments.

What is the best way to map the attack surface of a single-page web application?▼

Mapping the attack surface of a single-page app involves using threat modeling to identify endpoints and configurations. This approach applies reverse-engineering techniques to JS bundles to produce a structured map of application entry points.

How do I perform threat modeling to identify unknown entry points in web apps?▼

Threat modeling for entry point discovery uses adaptive reconnaissance to surface unknown patterns. By analyzing target web applications and their JavaScript bundles, it generates structured results detailing discovered endpoints and attack-surface exposure.

Can I use this reconnaissance tool to extract configurations from any web application?▼

This reconnaissance specifically adapts to JS-bundled web apps to extract configurations. It applies threat modeling to map assets and entry points, producing structured results that guide subsequent security testing phases effectively.

What are the limitations of adaptive reconnaissance for endpoint discovery?▼

Adaptive reconnaissance for endpoint discovery is limited to analyzing JS-bundled apps and their configurations. It relies on reverse-engineering techniques to map the attack surface, meaning non-JS targets may not yield structured endpoint results.