Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com
Scanned 9/7/2026
Install to Claude Code
Skills Directorynpx -y skills add H-mmer/pentest-agents --skill cmd-surface --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Cmd Surface?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/h-mmer-cmd-surface-pentest-agents)More formats (shields.io, HTML) on the badges page.
---
name: surface
description: "Show ranked attack surface for a target. Invokes recon-ranker agent. Usage: /surface target.com"
---
Rank attack surface for: $ARGUMENTS
1. Verify recon data exists in recon/ directory. If not, suggest /recon first.
2. Read brain data for this target.
3. Launch `recon-ranker` agent: "Rank the attack surface for $ARGUMENTS. Read recon/ for discovery data and brain for tested endpoints. Output P1/P2/Kill ranking."
4. Show the ranking to the user.
5. Suggest: `/hunt $ARGUMENTS` to start testing P1 targets.
## Top-Tier Surface Ranking
Rank by exploit economics.
P1 requires at least two of:
- crown-jewel function: auth, billing, admin, tenant data, integrations, uploads, exports, webhooks, AI/tool execution
- weak boundary: cross-tenant IDs, mixed roles, public/private transition, OAuth callback, parser boundary, file ingestion
- novelty: new asset, changed JS, low hacktivity coverage, unusual vendor or beta endpoint
- proof path: two-account test, clear callback, readable response, browser-verifiable sink, local PoC
Kill or P3 assets that are static marketing pages, hardened vendor panels with no program-owned data, or endpoints already exhausted with strong evidence. Every P1 must include the best first vuln class and first request to try.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
Ultra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.
Adversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', ...
Routes multi-tool workflows through MCP servers for large datasets and pipelines. Use when Bash tool overhead is limiting throughput on data-heavy tasks.
Recovers prior coding-agent session context by running `catchup <agent> --since-compact`, which extracts a clean summary of a previous Codex, Claude Code, Antigravity, OpenCode, or Pi Agent session. Use when the user says "catch up", "what did the last session do", "get me up to speed", "I switched agents", or asks to recover/summarize a previous session before continuing. Do NOT use for the current conversation, git history, or any non-agent log.
A comprehensive mathematical reasoning skill for AI assistants — handles arithmetic to research-level problems with rigorous step-by-step reasoning, systematic verification, and transparent uncertainty handling
