Skip to content
Back to skills

Surface Extraction

ASecurity

Run the extractors, normalize the raw surfaces, and fingerprint the result so the site-map run has a deterministic, evidence-backed inventory of what the app exposes.

  • 8 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 2, 2026
ai-agents

Security analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned September 2, 2026

npx -y skills add Eliyce/paqad-ai --skill surface-extraction --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Surface Extraction?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Surface Extraction
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/eliyce-surface-extraction/badge)](https://www.skillsdirectory.com/skills/eliyce-surface-extraction)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: surface-extraction
description: Run the extractors, normalize the raw surfaces, and fingerprint the result so the site-map run has a deterministic, evidence-backed inventory of what the app exposes.
model_tier: fast
triggers:
  - workflow:
      - site-map
      - site-map-retest
cacheable: false
cache_key_inputs:
  - .paqad/site-map/baseline.json
output_format: json
input_schema:
  project_root:
    type: path
    required: true
    description: Repository root the extractors scan for surfaces (routes, commands, endpoints).
---

## What It Does

Produces the raw surface inventory the rest of the workflow builds on: every page, screen,
endpoint, or command the extractor can prove from the code, each with resolving `file:line`
evidence, deduped, and folded into a stable fingerprint. Mostly deterministic — the engine
does the scanning; this skill orchestrates it and confirms the output is clean.

## Use This When

Use this after readiness passes and before modeling. It is the bridge from "the app is
mappable" to "here is what the app exposes, with proof".

## Inputs

- The readiness verdict and detected extractor from `site-map-readiness`.
- The project source the extractor scans (route files, command programs, endpoint handlers).
- Read `references/extraction-evidence.md` before accepting or excluding a surface.

## Procedure

Extraction is deterministic — the engine owns it. Do not re-scan the code by hand.

1. Run `paqad-ai sitemap run`; it runs the extractors, dedupes, unions evidence, and computes
   the extraction fingerprint.
2. Read the `extraction.json` in the run bundle: each extracted surface carries its kind, a
   `file:line`, and a derivation (`static | convention`).
3. Confirm every surface's evidence resolves and no surface is a duplicate under a different
   label; flag any the engine could not ground rather than passing it through.

## Output Contract

- A JSON object `{ surfaces: [{ id, kind, evidence, derivation }], fingerprint, blocked_checks: [...] }`.
- Every `surfaces[]` entry carries at least one resolving `file:line` evidence pointer.
- `fingerprint` is present and stable across identical inputs.

## Escalate / Stop Conditions

- Stop and record a `blocked_checks` entry when the extractor cannot read the app shape; never
  invent a surface to fill the gap.
- Warn when the extraction is empty on a non-trivial app — that is a coverage gap, not a clean map.
- Do not promote a `convention`-derived surface to `static` confidence without resolving evidence.

## Resources

- `references/extraction-evidence.md`
- `agents/openai.yaml`

Files in this skill

  • SKILL.md2.5 KB
  • agents/openai.yaml166 B
  • references/extraction-evidence.md1.4 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.