Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/everywan-dev/claude-code-engineering/map-the-attack-surfacenpx skills add everywan-dev/claude-code-engineering --skill map-the-attack-surfacegit clone --depth 1 https://github.com/everywan-dev/claude-code-engineeringWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01134 |
| Opus 5 | $0.00024 | $0.00567 |
| Sonnet 5 | $0.00010 | $0.00227 |
| Haiku 4.5 | $0.00005 | $0.00113 |
Grade A, and why
map-the-attack-surface scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Map the attack surface
Most security work in ordinary projects is not cryptography. It is answering one question honestly:
Who can reach what, and what stops them from reaching more?
The bugs that actually hurt are rarely exotic. They are an endpoint that checks you are logged in but not that the record is yours, a test environment sharing production credentials, an admin panel reachable from the internet because a proxy rule was broader than intended.
🔴 Automated scanners find injection. They do not find authorisation. A scanner cannot know that record 41 belongs to a different customer than record 42. That gap is where the expensive findings live, and it is found by asking, not by tooling.
When to use this
- Before exposing anything to the internet, or widening who can reach it
- After inheriting a system nobody can fully explain
- When a scan came back clean and you want to know what it could not see
- Before handling customer data, money or credentials
- After any credential leak, to work out what it could reach
The procedure
1. List the entrances. Every way in: public endpoints, admin interfaces, APIs, webhooks, file uploads, scheduled jobs that fetch from outside, database ports, management planes, SSH. Include the ones you assume are internal — then check whether they are.
2. For each entrance, name what is on the other side and who is allowed. Write it as a sentence. Vagueness here is the finding: if nobody can state the rule, nobody is enforcing it.
3. Test authorisation with two accounts, not one. This is the step that finds the real bugs. Log in as tenant A, take an identifier belonging to tenant B, and ask for it. Do it for every object type that has an owner. A scanner will never do this for you.
| Question | What it finds |
|---|---|
| Can A read B's record by changing an id? | Broken object-level authorisation |
| Can a normal user reach an admin action directly? | Missing function-level checks |
| Does the list endpoint filter by owner, or the detail one only? | The most common variant |
| Do the test and production systems share a credential? | One breach becoming two |
| Does an error message differ for "not yours" and "does not exist"? | Enumeration |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 105 lines · 48 tokens per session scan A 7c4c87e533aa
map-the-attack-surface is a skill published in the GitHub repository everywan-dev/claude-code-engineering (2 stars, last pushed 13d ago), licensed Apache-2.0. It adds 48 tokens to every session and 1,134 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
claude-project-manifest
Creates annotated bibliography-style manifests for Claude projects, tracking files, conversation threads, and relationships with unique IDs and annotations. Use when documenting project contents, creating file inventories, tracking conversation history, or building navigable knowledge maps.
proofpress
Preserve or inspect decision history for Markdown and static HTML knowledge artifacts with Proofpress. Use when creating or accepting a meaningful revision to an ADR, design doc, PRD, README, strategy note, portable .md artifact, or static .html/.htm artifact in a configured repository, or when receiving a file…
llm-wiki
Maintain a personal team knowledge base using the LLM Wiki pattern — incremental ingest, query, and lint operations on a layered wiki architecture.
Principle Synthesizer
Synthesize invariant principles from 3+ sources — find the core that survives across all expressions.
PBE Extractor
Extract invariant principles from any text — find the ideas that survive rephrasing.
golden-rss
Use when testing the rss golden build.