mindmap

Agent Skills › H-mmer/pentest-agents › mindmap

mindmap

GitHub

根据目标生成文本攻击面思维导图，展示技术栈、漏洞类别与端点关系。通过读取脑数据和侦察数据，按信任边界分组标记风险等级，识别盲点并建议优先测试的高危未测端点。

.claude/skills/mindmap/SKILL.md H-mmer/pentest-agents

Trigger Scenarios

用户输入/mindmap命令需要分析目标攻击面结构

Install

npx skills add H-mmer/pentest-agents --skill mindmap -g -y

More Options

Non-standard path

npx skills add https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/mindmap -g -y

Use without installing

npx skills use H-mmer/pentest-agents@mindmap

指定 Agent (Claude Code)

npx skills add H-mmer/pentest-agents --skill mindmap -a claude-code -g -y

安装 repo 全部 skill

npx skills add H-mmer/pentest-agents --all -g -y

预览 repo 内 skill

npx skills add H-mmer/pentest-agents --list

SKILL.md

Frontmatter

{
    "name": "mindmap",
    "description": "Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: \/mindmap <target>",
    "disable-model-invocation": false
}

Generate attack surface mindmap for: $ARGUMENTS

Process

Read brain data: uv run python3 $CLAUDE_PROJECT_DIR/tools/brain.py brief $ARGUMENTS
Read recon data from recon/ directory
Read intel data: uv run python3 $CLAUDE_PROJECT_DIR/tools/intel_engine.py suggest <tech-stack>
Generate a tree-format mindmap:

target.com
├── Tech Stack
│   ├── Next.js 14 → SSRF (Server Actions), Open Redirect
│   ├── GraphQL → Introspection, IDOR via node(), Mutation Auth
│   └── PostgreSQL → SQL Injection
├── Auth
│   ├── Okta SSO → SAML bypass, OAuth redirect_uri
│   └── JWT → Secret brute-force, Algorithm confusion
├── API Surface
│   ├── /api/v2/users/{id}/* → IDOR (P1)
│   │   ├── /orders — TESTED: exhausted
│   │   ├── /export — UNTESTED
│   │   └── /settings — UNTESTED
│   ├── /api/v2/payments/* → Race conditions, price manipulation (P1)
│   └── /graphql → Auth bypass on mutations (P1)
├── File Handling
│   └── /upload → Extension bypass, SVG XSS (P2)
└── Findings
    ├── [CONFIRMED] IDOR on /api/v2/users/{id}/orders
    └── [EXHAUSTED] XSS on /search — CloudFront blocks all payloads

Mark each endpoint as TESTED, UNTESTED, CONFIRMED, or EXHAUSTED from brain data
Suggest: "Start with UNTESTED P1 endpoints. Run /hunt $ARGUMENTS --vuln-class "

Top-Tier Mindmap Standard

The mindmap should expose attack decisions at a glance.

Group by trust boundary first: unauth, user, tenant, admin, integration, internal, CI/CD, AI/tool.
Mark every node with one of: P1, P2, Kill, Confirmed, Partial, Exhausted, Chain.
Draw capability edges, not just URL hierarchy: export reads data, webhook sends server-side request, template renders attacker input, OAuth callback grants token.
Surface blind spots explicitly: "no second-account test", "no browser verification", "no sibling replay", "no chain attempt".
End with the top three routes where one more test could change severity or reportability.