/scope

description: Set engagement scope and auto-detect target technology stack
allowed-tools: ToolSearch, Bash, Read, Write
argument-hint: <target-domain> [--profile loud|normal|stealth|paranoid]

> **Storage Policy**: ALL output files MUST be saved in the project directory. NEVER write to `/tmp/` or any system temporary directory.

Set Engagement Scope

Target and options: `$ARGUMENTS`

Configure the engagement scope and perform initial target profiling.

Step 0: Parse Profile Flag

If `$ARGUMENTS` contains `--profile <name>`, extract the profile and set it:

node "${CLAUDE_PLUGIN_ROOT}/scripts/scan-profile.js" set <profile>

The remaining argument (without `--profile`) is the target domain.

Step 1: Load Tools

Use ToolSearch to load:

• `http_set_scope` — define in-scope hosts for HTTP testing tools
• `detect_technologies_ai` — AI-powered technology detection
• `wafw00f_scan` — WAF detection

Step 2: Set HTTP Scope

Run `http_set_scope` to register the target domain (and any known subdomains) as in-scope. This configures the HTTP testing framework tools (repeater, intruder) to only operate within authorized targets.

Step 3: Technology Detection

Run `detect_technologies_ai` on the target to identify:

• CMS / Framework (WordPress, React, NestJS, etc.)
• Programming languages
• Web servers
• JavaScript libraries
• CDN / WAF / reverse proxy

Step 4: WAF Fingerprinting

Run `wafw00f_scan` to identify specific WAF products. This is critical for selecting appropriate evasion techniques in later testing.

Step 5: Create Scope Document

Write a `scope.md` file in the project directory with:

• Target domain and in-scope subdomains
• Technology stack detected
• WAF/CDN information
• Testing constraints (rate limits, restricted hours, etc.)
• Recommended tool configurations based on detected defenses

Step 6: Auto-Log Intel

If `target-intel.js` exists, log discovered tech stack and defenses:

# For each technology detected:
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" add "<target>" "tech-stack" "<tech-name>" "<version-or-details>" --source scan
# For WAF/CDN detected:
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" add "<target>" "defense" "<defense-name>" "<details>" --source scan

Present the scope summary to the operator for confirmation.