/analysis-and-reporting

name: analysis-and-reporting
description: "Endpoint interest scoring, mobile app ownership confidence, attack-path hint patterns, a severity decision matrix, sector severity overrides, and sidecar coordination."
when_to_use: "Use when scoring endpoint interest, deciding finding severity or applying the severity decision matrix, generating attack-path hints, assessing mobile-app ownership, prioritizing vulnerabilities (CVE/EPSS scoring), applying sector-specific overrides (healthcare DICOM, finance SWIFT, ICS/SCADA), preserving evidence, or coordinating sidecar output across modules for reporting."

Analysis & Reporting

> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only.

---

BEHAVIORAL CONTRACT

**When triggered:** Endpoint scoring, finding severity classification, attack-path hint generation, mobile app ownership assessment, vulnerability prioritization, sector-specific recon analysis, AI-assisted OSINT analysis, evidence preservation, or tooling/automation setup is needed.

**Execute:**

1. For every classified API endpoint, compute the endpoint interest score (§1). If score >= 70, attach an attack-path hint from §3 templates. 2. For mobile apps, compute ownership confidence (§2). Accept if >= 70; below threshold = `mobile_review_pending`. 3. For every finding, classify severity using the decision matrix (§4). Apply sector severity overrides (§5) when target is in a regulated sector. 4. For HIGH/CRITICAL findings, emit the matching attack-path hint from §3 templates. 5. Write sidecar JSON files (§6) for cross-module coordination when this module produces outputs that feed other modules. 6. Evidence handling: preserve all artifacts per §8 — URL + UTC timestamp + SHA-256 + operator ID for all downloads; store on encrypted volume. 7. For bulk JS/response analysis, apply AI-assisted OSINT patterns (§7) using local models for sensitive content. 8. For tooling setup and automation pipelines, follow §9 patterns and reference `docs/reference/tool-directory.md`.

**Output:** Scored findings with severity, attack-path hints, and sidecar JSON where applicable. All findings use `osint-methodology` §3 schema.

**Severity rules:** §1 thresholds for endpoint scores (>=90 CRITICAL, 70-89 HIGH, 50-69 MEDIUM, 25-49 LOW, <25 INFO). §4 decision matrix (92 examples). §5 sector overrides are mandatory -- never downgrade a sector-specific severity.

**Gating rules:** Mobile apps below ownership threshold 70 = `mobile_review_pending`, do not deep-analyze. ICS/SCADA targets require explicit OT team coordination before any active probing.

**Chain to:** Feed severity + attack-path hints to `osint-methodology` §14 for client deliverable generation. Receive findings from all other sub-skills for classification.

---

1. Endpoint Interest Score — 0–100 Rubric

For every classified API endpoint, apply this rubric:

| Signal | Points | Conditions | | -------------------------------- | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Unauth write** | +40 | POST/PUT/DELETE/PATCH returns 200/201/202/204 anonymously | | **Open GraphQL introspection** | +35 | `__schema` returns full type list anonymously | | **Verb tampering bypass** | +30 | OPTIONS reveals method not documented; accessible | | **Reflected CORS + credentials** | +25 | `Access-Control-Allow-Origin` reflects Origin AND `Access-Control-Allow-Credentials: true` | | **Sensitive keyword in path** | +20 | `admin`, `internal`, `debug`, `user`, `password`, `token`, `key`, `export`, `upload`, `backup`, `config`, `secret`, `private`, `delete`, `purge`, `wipe` | | **Schema leak in error** | +20 | Stack trace, ORM error class, framework signature in response | | **API key in URL** | +15 | `api_key=`, `apikey=`, `token=`, `access_token=` in query string | | **Wildcard CORS** | +10 | `Access-Control-Allow-Origin: *` | | **Missing rate-limit headers** | +10 | No `RateLimit-*` / `X-RateLimit-*` after rapid requests |

**Thresholds:**

| Score | Severity | | ----- | ------------ | | ≥ 90 | **CRITICAL** | | 70–89 | **HIGH** | | 50–69 | MEDIUM | | 25–49 | LOW | | < 25 | INFO |

For score ≥ 70, attach an `attack_path_hint` in evidence (see §3).

---

2. Mobile App Ownership Confidence — 0–100 Rubric

Before deep APK static analysis, score whether the app belongs to the target. **Threshold: ≥70 = accept.**

| Signal | Points | | --------------------------------------------------------------------------------- | ------ | | Package reverse-DNS matches target domain (`com.example.android` ↔ `example.com`) | +40 | | Developer email is `<anything>@<target-domain>` | +25 | | Developer website URL is the target domain