inventory-surface-analyzer

Inventory Surface Analyzer

Synthesize all mapping agent outputs into a unified attack surface inventory. Read structured JSON from inventory/ directories, cross-reference across agent outputs, deduplicate overlapping data, and produce a prioritized attack surface report and testing checklist.

When to Use

Deployed by web-application-mapping skill coordinator — always run after all four mapping agents complete. Never invoked directly by users.

Workflow

Phase 1: Recon

1. Mount skill file:

   Read plugins/pentest/skills/web-application-mapping/SKILL.md
   

2. Read all inventory JSON files produced by prior agents:

   Read outputs/ENGAGEMENT/inventory/software-catalog.json
   Read outputs/ENGAGEMENT/inventory/directories.json
   Read outputs/ENGAGEMENT/inventory/api-endpoints.json
   Read outputs/ENGAGEMENT/inventory/javascript-routes.json
   

3. Read all analysis markdown files from prior agents:

   Read outputs/ENGAGEMENT/analysis/software-catalog.md
   Read outputs/ENGAGEMENT/analysis/directories.md
   Read outputs/ENGAGEMENT/analysis/api-endpoints.md
   Read outputs/ENGAGEMENT/analysis/javascript-routes.md
   

4. If any inventory file is missing (agent did not run), note it and continue with available data:
   • Missing software-catalog.json → skip CVE-flagged component section
   • Missing directories.json → skip directory-based attack surfaces
   • Missing api-endpoints.json → skip API-specific sections
   • Missing javascript-routes.json → skip SPA/JS-specific sections
5. Log:

   {"timestamp":"...","agent":"inventory-surface-analyzer","action":"recon","files_loaded":4,"files_missing":0,"total_components":18,"total_paths":87,"total_endpoints":52,"total_routes":31}
   

Phase 2: Experiment

1. Identify overlapping data across agents — the same endpoint may appear in both api-endpoints.json (from kiterunner) and javascript-routes.json (from AJAX capture):
   • Match API paths from api-endpoints.json against ajax_endpoints in javascript-routes.json
   • Merge into single deduplicated list with source tags: ["api-discovery","js-mapper"]
2. Correlate technology stack with directories:
   • If software-catalog.json contains WordPress → flag /wp-admin, /wp-content, /wp-json as expected paths
   • If software-catalog.json contains Laravel → flag /api, /.env as high-interest paths
   • If software-catalog.json contains Express.js → flag /api/v1 pattern paths
3. Correlate CVE-flagged components with discovered endpoints:
   • Components with cve_check: required from software-catalog.json → note which paths expose them
4. Identify authentication boundaries across the full surface:
   • Public routes from javascript-routes.json
   • Unauthenticated API endpoints from api-endpoints.json
   • Admin panels from directories.json
   • Cross-reference: any admin panel accessible without auth?
5. Log:

   {"timestamp":"...","agent":"inventory-surface-analyzer","action":"experiment","deduplicated_endpoints":67,"overlaps_found":8,"auth_boundaries_mapped":true,"cve_exposure_paths":3}