What problem does it solve? Security researchers often jump into testing without a structured understanding of the target, wasting time on low-impact paths. This Skill guides a disciplined 5-step attack surface mapping process that converts recon data into a pre-threat model, so every subsequent test ties back to a crown jewel and provable impact. ## Core Features & Use Cases - 5-Step Attack Surface Mapping: Walks through application architecture, mechanisms and trust boundaries, notable objects, security controls, and crown jewels with nightmare scenarios. - Trust Boundary Analysis: Identifies what the backend assumes about each request, distinguishing session-derived ownership from client-supplied IDs (IDOR-prone) across login, password reset, CRUD, upload, and webhook mechanisms. - Security Control Enumeration: Documents CSP, cookie flags, CSRF, CORS, and JWT validation per subdomain to determine which attack classes are viable versus blocked. - Use Case: After running recon on a bug bounty target, feed the recon-data inventory into this Skill to produce understanding-app.md and threat-model/pre-threat-model.md, which then feed directly into STRIDE threat modeling and hypothesis generation. ## Quick Start Ask the assistant to run the pre-threat-model skill against your target application name or URL to generate a structured attack surface map from your recon data.
