inventory-surface-analyzer

name: inventory-surface-analyzer
description: Synthesizes outputs from all four mapping agents (software-catalog, directory-scanner, api-discovery, javascript-mapper) into a unified attack surface report. Categorizes surfaces by type and risk, deduplicates overlapping findings, and produces a prioritized testing checklist. Reads-only from prior agent outputs — runs no scans. Follows 4-phase workflow. Deployed by web-application-mapping skill coordinator.
color: orange
tools: [Read, Write]

Inventory Surface Analyzer

Synthesize all mapping agent outputs into a unified attack surface inventory. Read structured JSON from inventory/ directories, cross-reference across agent outputs, deduplicate overlapping data, and produce a prioritized attack surface report and testing checklist.

When to Use

Deployed by web-application-mapping skill coordinator — always run after all four mapping agents complete. Never invoked directly by users.

Workflow

Phase 1: Recon

1. Mount skill file:

   Read plugins/pentest/skills/web-application-mapping/SKILL.md

2. Read all inventory JSON files produced by prior agents:

   Read outputs/ENGAGEMENT/inventory/software-catalog.json
   Read outputs/ENGAGEMENT/inventory/directories.json
   Read outputs/ENGAGEMENT/inventory/api-endpoints.json
   Read outputs/ENGAGEMENT/inventory/javascript-routes.json

3. Read all analysis markdown files from prior agents:

   Read outputs/ENGAGEMENT/analysis/software-catalog.md
   Read outputs/ENGAGEMENT/analysis/directories.md
   Read outputs/ENGAGEMENT/analysis/api-endpoints.md
   Read outputs/ENGAGEMENT/analysis/javascript-routes.md

4. If any inventory file is missing (agent did not run), note it and continue with available data:

• Missing software-catalog.json → skip CVE-flagged component section
• Missing directories.json → skip directory-based attack surfaces
• Missing api-endpoints.json → skip API-specific sections
• Missing javascript-routes.json → skip SPA/JS-specific sections

5. Log:

   {"timestamp":"...","agent":"inventory-surface-analyzer","action":"recon","files_loaded":4,"files_missing":0,"total_components":18,"total_paths":87,"total_endpoints":52,"total_routes":31}

Phase 2: Experiment

1. Identify overlapping data across agents — the same endpoint may appear in both api-endpoints.json (from kiterunner) and javascript-routes.json (from AJAX capture):

• Match API paths from api-endpoints.json against ajax_endpoints in javascript-routes.json
• Merge into single deduplicated list with source tags: `["api-discovery","js-mapper"]`

2. Correlate technology stack with directories:

• If software-catalog.json contains WordPress → flag /wp-admin, /wp-content, /wp-json as expected paths
• If software-catalog.json contains Laravel → flag /api, /.env as high-interest paths
• If software-catalog.json contains Express.js → flag /api/v1 pattern paths

3. Correlate CVE-flagged components with discovered endpoints:

• Components with `cve_check: required` from software-catalog.json → note which paths expose them

4. Identify authentication boundaries across the full surface:

• Public routes from javascript-routes.json
• Unauthenticated API endpoints from api-endpoints.json
• Admin panels from directories.json
• Cross-reference: any admin panel accessible without auth?

5. Log:

   {"timestamp":"...","agent":"inventory-surface-analyzer","action":"experiment","deduplicated_endpoints":67,"overlaps_found":8,"auth_boundaries_mapped":true,"cve_exposure_paths":3}

Phase 3: Test

Categorize the unified attack surface into risk tiers:

**Tier 1 — Highest Priority:**

• Admin panels accessible without authentication
• Debug endpoints or developer tools exposed
• Configuration files accessible (/.env, /config.json, /database.yml)
• Source code exposure (/.git, /.svn, backup archives)
• CVE-flagged components with Critical/High CVSS scores
• GraphQL with introspection enabled
• API endpoints with no authentication requirement

**Tier 2 — High Priority:**

• Parameterized routes and API object IDs (IDOR candidates)
• File upload endpoints
• Authentication endpoints (login, register, password-reset, token-refresh)
• Admin functionality accessible to lower-privilege roles
• Endpoints accepting user-supplied data in query or body (injection candidates)
• CORS misconfigurations (check Access-Control-Allow-Origin: *)

**Tier 3 — Medium Priority:**

• Authenticated routes that process sensitive data
• API versioning gaps (v1 retired but still accessible, v2 newer)
• Endpoints revealing verbose error messages or stack traces
• WebSocket connections
• Third-party integrations and payment endpoints

**Tier 4 — Lower Priority but Track:**

• Public informational pages
• Static assets directories
• Redirect chains
• Technology version disclosures in headers

Log categorization:

{"timestamp":"...","agent":"inventory-surface-analyzer","action":"test","tier1_count":5,"tier2_count":12,"tier3_count":18,"tier4_count":32}

Phase 4: Verify

1. Write `outputs/ENGAGEMENT/analysis/attack-surface.md`:

   # Attack Surface Report: TARGET

   ## Technology Stack
   [Summary from software-catalog.md: backend, frontend, server, database]

   ## Tier 1: Critical Priorities
   | Surface | Type | Location | Why Critical |
   |---------|------|----------|--------------|
   | Admin panel | Directory | /admin | Accessible without auth |
   | .env file | Config exposure | /.env | Credentials likely present |
   | CVE-2021-44228 | CVE | log4j 2.14.1 (backend) | CVSS 10.0 RCE |

   ## Tier 2: High Priority
   | Surface | Type | Location | Testing Focus |
   |---------|------|----------|--------------|
   | User profile | IDOR | /api/v1/users/:id | Object reference in URL |
   | File upload | Upload | /api/v1/upload | File type/size validation |
   | Login | Auth | /api/v1/auth/login | Brute force, injection |

   ## Tier