surface

Agent Skills › H-mmer/pentest-agents › surface

surface

GitHub

用于对目标进行攻击面排名。通过调用recon-ranker代理，结合侦察数据和脑数据，依据漏洞利用经济学将资产分为P1/P2/Kill等级，并建议后续渗透测试步骤。

.claude/skills/surface/SKILL.md H-mmer/pentest-agents

Trigger Scenarios

用户请求分析目标的攻击面输入包含/surface命令及目标域名

Install

npx skills add H-mmer/pentest-agents --skill surface -g -y

More Options

Non-standard path

npx skills add https://github.com/H-mmer/pentest-agents/tree/main/.claude/skills/surface -g -y

Use without installing

npx skills use H-mmer/pentest-agents@surface

指定 Agent (Claude Code)

npx skills add H-mmer/pentest-agents --skill surface -a claude-code -g -y

安装 repo 全部 skill

npx skills add H-mmer/pentest-agents --all -g -y

预览 repo 内 skill

npx skills add H-mmer/pentest-agents --list

SKILL.md

Frontmatter

{
    "name": "surface",
    "description": "Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: \/surface target.com",
    "disable-model-invocation": false
}

Rank attack surface for: $ARGUMENTS

Verify recon data exists in recon/ directory. If not, suggest /recon first.
Read brain data for this target.
Launch recon-ranker agent: "Rank the attack surface for $ARGUMENTS. Read recon/ for discovery data and brain for tested endpoints. Output P1/P2/Kill ranking."
Show the ranking to the user.
Suggest: /hunt $ARGUMENTS to start testing P1 targets.

Top-Tier Surface Ranking

Rank by exploit economics.

P1 requires at least two of:

crown-jewel function: auth, billing, admin, tenant data, integrations, uploads, exports, webhooks, AI/tool execution
weak boundary: cross-tenant IDs, mixed roles, public/private transition, OAuth callback, parser boundary, file ingestion
novelty: new asset, changed JS, low hacktivity coverage, unusual vendor or beta endpoint
proof path: two-account test, clear callback, readable response, browser-verifiable sink, local PoC

Kill or P3 assets that are static marketing pages, hardened vendor panels with no program-owned data, or endpoints already exhausted with strong evidence. Every P1 must include the best first vuln class and first request to try.