القائمة
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Find default/weak/insecure configurations — weak crypto, TLS disabled, permissive CORS, debug mode in prod paths, unsafe deserialization switches, open S3 buckets, etc. These are the low-hanging fruit most noisy scanners miss.
| name | entry-point-analyzer |
| description | Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/entry-point-analyzer |
Grep for known route-registration patterns:
# Express / Fastify / Koa / Hono
grep -rnE "(app|router|fastify|koa|hono)\.(get|post|put|patch|delete|all|use)\(" target --include='*.{js,ts}'
# Flask / FastAPI
grep -rnE "@(app|router|bp)\.(get|post|put|delete|route)" target --include='*.py'
# Django urls.py
find target -name urls.py -exec grep -Hn "path\|url\|re_path" {} \;
# Spring
grep -rnE "@(Request|Get|Post|Put|Delete)Mapping" target --include='*.java'
# Go net/http / gin / chi / echo
grep -rnE "\.(GET|POST|PUT|DELETE|Handle|HandleFunc)\(" target --include='*.go'
# Rails routes.rb
find target -name routes.rb -exec cat {} \;
For each route, record: method, path, handler function, auth middleware.
# package.json bin entries
jq -r '.bin // {} | to_entries[] | "\(.key) → \(.value)"' target/package.json 2>/dev/null
# pyproject.toml entry points
grep -A 20 '\[project.scripts\]' target/pyproject.toml 2>/dev/null
# Go main packages
grep -rln "^package main" target --include='*.go'
# Rust bin targets
grep -A 2 '\[\[bin\]\]' target/Cargo.toml 2>/dev/null
# Node ESM exports
jq '.exports' target/package.json 2>/dev/null
# Python __all__
grep -rn "__all__" target --include='*.py'
# Rust pub items in lib.rs
grep -rnE "^pub (fn|struct|enum|trait|mod)" target --include='lib.rs'
.github/workflows/** — list every on: trigger; call out pull_request_target,
workflow_run, schedule, issue_comment..gitlab-ci.yml, .circleci/config.yml, azure-pipelines.yml.@KafkaListener, kafka.consumer.subscribechannel.consume, @RabbitListenersqs.receiveMessage / Lambda event sourcessubscribe, psubscribeProduce reports/entry-points.md with one section per category and, for each
entry point, a confidence-weighted risk tag:
| Entry point | Auth | Input sources | Risk |
|---|---|---|---|
POST /api/exec | none | JSON body cmd | HIGH |
GET /health | none | — | LOW |
GHA .github/workflows/pr.yml pull_request_target | N/A | fork PR body | HIGH |
Cross-reference with SAST findings: a route with no auth + a HIGH SAST finding on its handler is a P0.