skills.rest
ricardoo022
ricardoo022COMMUNITY
Explore all skills by this author →
GitHub

scan-fase-2

Extract REST, GraphQL, and error-based schema signals into a structured YAML data model.

Updated Mar 11, 2026
Search Tags:#security#backend#schema#rest#graphql#discovery#error-mining
One-click install
npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-2
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: scan-fase-2
Source: https://github.com/ricardoo022/PentestAI-with-claude-code/tree/main/.claude/skills/scan-fase-2
Command: npx skills add https://github.com/ricardoo022/PentestAI-with-claude-code --skill scan-fase-2

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Adaptive Schema Discovery maps the complete data model of an application by extracting schema from REST, GraphQL, and error messages, including hidden tables and shadow endpoints.

Core Features & Use Cases

  • REST/GraphQL schema extraction, error-based hints, and JS bundle analysis to reveal tables, fields, and relationships.
  • Identify hidden/internal tables and shadow APIs; map relationships; infer field types and constraints.
  • Use case: When auditing a web app, run FASE 2 to produce a structured schema report that drives subsequent testing.

Quick Start

Run /scan-fase-2 {url} after completing FASE 0 and FASE 1 to generate the schema discovery results.

Frequently Asked Questions about scan-fase-2

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden database tables and fields from REST and GraphQL APIs?▼

Schema discovery extracts schema signals from REST endpoints, GraphQL queries, and application error messages to reveal hidden tables, fields, and relationships. This approach maps the complete application data model, including shadow APIs and internal structures.

How does error mining help map an application data model?▼

Error mining analyzes application error messages to infer database tables, field types, and constraints. By extracting these error-based schema signals alongside REST and GraphQL data, it reveals hidden structures that standard API queries might not expose.

Can I extract a GraphQL schema without knowing the backend type beforehand?▼

No, extracting GraphQL and REST schema signals requires prior backend identification and configuration analysis. You must complete initial discovery phases to determine backend type and extract configs before running adaptive schema discovery.

What is the best way to map shadow APIs and internal endpoints during a web app audit?▼

Mapping shadow APIs involves analyzing JS bundles and extracting REST and GraphQL schema signals to identify hidden endpoints. This reveals undocumented internal tables and API structures, producing a structured schema report for subsequent testing.

What format do schema discovery results use to document relationships and vulnerabilities?▼

Schema discovery outputs a structured FASE_2_RESULTS YAML file. This file documents the extracted tables, inferred relationships, field constraints, and any potential vulnerabilities identified during the REST, GraphQL, and error-based analysis.

Related Skills

Explore More Software Engineering Skills→
glowingkittyglowingkitty
43

openmates:add-app-skill

Scaffolds and registers an OpenMates app skill with Python skeleton, app.yml config, and multilingual discovery metadata.

Community
Intermediate
zzw4257zzw4257

Metasploit Framework

Execute penetration testing and vulnerability assessment with the Metasploit Framework.

Community
Advanced
yaklangyaklang
1.6k

api-recon-and-docs

Enumerate API endpoints, schemas, versions, and hidden documentation from OpenAPI/Swagger artifacts.

Official
Intermediate
AstorYHAstorYH
15

graphql-introspection

Query a GraphQL endpoint to discover its schema and available operations.

Community
Basic