| name | analysis-and-reporting |
| description | Endpoint interest scoring (0–100), mobile app ownership confidence, attack-path hint patterns (35 templates), severity decision matrix (92 examples), sector severity overrides, and sidecar coordination. |
| version | 1.0.0 |
| triggers | ["endpoint interest score","finding severity","severity decision matrix","attack path hint","mobile app ownership","mobile recon","AI-assisted OSINT","evidence preservation","archiving","automation workflow","cross module sidecar","tooling install","sector specific recon","healthcare DICOM","finance SWIFT","ICS SCADA","CVE prioritization","EPSS scoring","vulnerability prioritization","reporting"] |
Analysis & Reporting
Sub-skill of offensive-osint. Load osint-methodology for pipeline and triage context.
Authorized targets only.
BEHAVIORAL CONTRACT
When triggered: Endpoint scoring, finding severity classification, attack-path hint generation, mobile app ownership assessment, vulnerability prioritization, sector-specific recon analysis, AI-assisted OSINT analysis, evidence preservation, or tooling/automation setup is needed.
Execute:
- For every classified API endpoint, compute the endpoint interest score (§1). If score >= 70, attach an attack-path hint from §3 templates.
- For mobile apps, compute ownership confidence (§2). Accept if >= 70; below threshold =
mobile_review_pending.
- For every finding, classify severity using the decision matrix (§4). Apply sector severity overrides (§5) when target is in a regulated sector.
- For HIGH/CRITICAL findings, emit the matching attack-path hint from §3 templates.
- Write sidecar JSON files (§6) for cross-module coordination when this module produces outputs that feed other modules.
- Evidence handling: preserve all artifacts per §8 — URL + UTC timestamp + SHA-256 + operator ID for all downloads; store on encrypted volume.
- For bulk JS/response analysis, apply AI-assisted OSINT patterns (§7) using local models for sensitive content.
- For tooling setup and automation pipelines, follow §9 patterns and reference
docs/reference/tool-directory.md.
Output: Scored findings with severity, attack-path hints, and sidecar JSON where applicable. All findings use osint-methodology §3 schema.
Severity rules: §1 thresholds for endpoint scores (>=90 CRITICAL, 70-89 HIGH, 50-69 MEDIUM, 25-49 LOW, <25 INFO). §4 decision matrix (92 examples). §5 sector overrides are mandatory -- never downgrade a sector-specific severity.
Gating rules: Mobile apps below ownership threshold 70 = mobile_review_pending, do not deep-analyze. ICS/SCADA targets require explicit OT team coordination before any active probing.
Chain to: Feed severity + attack-path hints to osint-methodology §14 for client deliverable generation. Receive findings from all other sub-skills for classification.
1. Endpoint Interest Score — 0–100 Rubric
For every classified API endpoint, apply this rubric:
| Signal | Points | Conditions |
|---|
| Unauth write | +40 | POST/PUT/DELETE/PATCH returns 200/201/202/204 anonymously |
| Open GraphQL introspection | +35 | __schema returns full type list anonymously |
| Verb tampering bypass | +30 | OPTIONS reveals method not documented; accessible |
| Reflected CORS + credentials | +25 | Access-Control-Allow-Origin reflects Origin AND Access-Control-Allow-Credentials: true |
| Sensitive keyword in path | +20 | admin, internal, debug, user, password, token, key, export, upload, backup, config, secret, private, delete, purge, wipe |
| Schema leak in error | +20 | Stack trace, ORM error class, framework signature in response |
| API key in URL | +15 | api_key=, apikey=, token=, access_token= in query string |
| Wildcard CORS | +10 | Access-Control-Allow-Origin: * |
| Missing rate-limit headers | +10 | No RateLimit-* / X-RateLimit-* after rapid requests |
Thresholds:
| Score | Severity |
|---|
| ≥ 90 | CRITICAL |
| 70–89 | HIGH |
| 50–69 | MEDIUM |
| 25–49 | LOW |
| < 25 | INFO |
For score ≥ 70, attach an attack_path_hint in evidence (see §3).
2. Mobile App Ownership Confidence — 0–100 Rubric
Before deep APK static analysis, score whether the app belongs to the target. Threshold: ≥70 = accept.
| Signal | Points |
|---|
Package reverse-DNS matches target domain (com.acme.android ↔ acme.com) | +40 |
Developer email is <anything>@<target-domain> | +25 |
| Developer website URL is the target domain | +20 |
| App name contains a brand keyword from operator brand list | +10 |
| App has ≥ 20 reviews | +5 |
Apps below threshold: tag mobile_review_pending. Operator can lower threshold with --mobile-ownership-threshold 50.
3. Attack-Path Hint Patterns — 35 Templates
When emitting a HIGH/CRITICAL finding (score >= 70), include a one-sentence attack_path_hint:
| Trigger | Attack-path hint |
|---|
| Unauth POST / PUT / DELETE | "Unauthenticated {method} {path} — try IDOR + privilege escalation; check whether numeric IDs are sequential or guessable." |
| Open GraphQL introspection | "Open GraphQL introspection on {path} — enumerate mutations, look for createUser, setRole, transferFunds-shaped names; pivot to broken-auth or business-logic flaws." |
| Reflected CORS + creds | "Reflected CORS with credentials on {path} — host CSRF page on attacker-controlled origin; victim's browser will leak {sensitive-data-hint}." |
| Wildcard CORS + sensitive | "Wildcard CORS on {path} returning user-tied data — exfiltrate via cross-origin fetch from any page victim visits." |
| API key in URL | "API key in URL ?{param}=... — token leaks to access logs, browser history, Referer headers, third-party CDNs. Check Wayback / Google for cached copies." |
| Schema leak in error | "Schema leak in error response — framework signature {framework} exposed; map to known {framework} vulns and craft targeted payloads." |
| Sensitive keyword | "Path contains '{keyword}' — review for direct object reference, mass-assignment, or hidden admin functionality." |
| Open RTDB Firebase | "Open Firebase RTDB at https://{project}.firebaseio.com/.json — read everything, then test write at /<random-key>.json with PUT to gauge ACL scope." |
| Listable cloud bucket | "Listable {provider} bucket {bucket} — recursive object listing + content-type analysis; look for backups, logs, customer data, AWS keys in JSON configs." |
| .git exposed | "Exposed .git/config on {host} — reconstruct repository with git-dumper or githacker; full source history." |
| .env exposed | "Exposed .env on {host} — grep for _KEY, _SECRET, _TOKEN, _PASSWORD; validate all credentials read-only." |
| /actuator/env | "Spring Boot /actuator/env exposed — dump environment variables; look for , JWT secrets, cloud creds." |
4. Severity Decision Matrix — Worked Examples (selected)
| Finding | Severity | Why |
|---|
/.git/config reachable on prod | CRITICAL | Full source-code + secret history |
/.env reachable on prod | CRITICAL | Plaintext creds (DB, cloud, API) |
| Open Firebase RTDB returning data | CRITICAL | All app data readable; often writable |
| Listable S3 bucket containing PII | CRITICAL | Direct data exfil |
Spring Boot /actuator/env exposed | CRITICAL | DB creds, JWT secrets, cloud keys in env |
| Open Elasticsearch | CRITICAL | Full data reads; often writable |
| Open MongoDB (no auth) | CRITICAL | Full data + password hashes |
| Open Redis (no AUTH) | CRITICAL | Write authorized_keys → SSH foothold |
| Open Docker API (port 2375) | CRITICAL | Container/host takeover |
| Public PMAK validated live (broad scope) | CRITICAL | Full Postman + all team workspaces |
| Open kubelet on 10250 | CRITICAL | Pod exec without K8s API auth |
| Open etcd on 2379 | CRITICAL | Cluster state + secrets |
| Live Anthropic / OpenAI API key | CRITICAL | Quota cost + potential PII in past responses |
Live npm token with publish scope | CRITICAL | Supply-chain compromise of all maintained packages |
android:debuggable=true on prod app | CRITICAL | Production debug-build → full client compromise |
| Decommissioned legacy mail + breach + cloud migration | CRITICAL | SSO_EXPOSURE; stolen passwords survived migration via reuse |
| Heartbleed (CVE-2014-0160) detected |
5. Sector Severity Overrides
| Sector | Condition | Severity |
|---|
| Healthcare | PHI exposure | CRITICAL |
| Healthcare | HL7/DICOM open without auth | CRITICAL |
| Healthcare | DICOM port 11112 or 4242 open | CRITICAL |
| Finance | Account/balance data exposure | CRITICAL |
| Finance | SWIFT terminal external-facing | CRITICAL |
| Finance | FIX protocol (port 9876) cleartext | HIGH |
| ICS/SCADA | Any active probe without OT team coordination | FORBIDDEN |
| ICS/SCADA | Modbus (502) / BACnet (47808) / S7 (102) open | CRITICAL |
| IoT | MQTT (1883) readable without auth | HIGH |
| Government | Any finding | Severity >= commercial equivalent; political sensitivity applies |
Full sector context and vendor details: docs/reference/specialty-domains.md
6. Cross-Module Sidecar Coordination
Each module writes a sidecar JSON when it finishes:
<scan>/mobile_endpoints.json — endpoints + hostnames from APK static analysis.<scan>/secrets_sidecar.json — hostnames + endpoints + Firebase project IDs.<scan>/sso_tenants.json — discovered IdP tenants for breach correlation.
Downstream modules check for sidecars on start; if present, ingest.
Sidecar shape:
{
"endpoints": [
{
"method": "GET",
"url": "https://api.acme.com/v1/users",
"source": "apk:com.acme.android"
}
],
"hostnames": ["api.acme.com"],
"firebase_project_ids": ["acme-prod-12345"]
}
7. AI-Assisted OSINT Patterns
LLMs accelerate offline analysis of large, unstructured recon artifacts. All analysis below happens on already-collected data — no network interaction, zero detectability.
JS bundle summarization. Feed minified/webpack bundles to an LLM and ask it to extract API endpoints, internal hostnames, hardcoded tokens, and Firebase project IDs. This replaces hours of manual grep with a single structured pass.
Prompt template for bulk analysis:
Analyze this JS bundle and extract:
1. API endpoints (full URL or path pattern)
2. Internal hostnames and IP addresses
3. Hardcoded tokens, API keys, or secrets
4. Firebase project IDs or GCP resource identifiers
5. WebSocket URLs
6. Third-party service integrations (Stripe, Twilio, Sentry, etc.)
Output as JSON with keys: endpoints, hostnames, secrets, firebase_ids, websockets, third_party.
LLM-assisted pattern matching. Feed HTTP response bodies to identify non-standard API patterns that regex misses — custom RPC formats, protobuf-over-HTTP, GraphQL aliases, envelope patterns wrapping REST, and vendor-specific error schemas that leak framework internals.
Sensitive-content caveat. Never paste target PII, credentials, session tokens, or customer data into cloud-hosted LLMs (ChatGPT, Claude API, etc.). For engagement artifacts containing sensitive content, use local models (ollama, llama.cpp, vLLM) running on the operator's machine. This is a hard rule, not a preference.
Detectability: NONE. All analysis is offline against already-downloaded artifacts.
8. Evidence Preservation & Archiving
Every artifact collected during an engagement must be preserved with integrity metadata. This is non-negotiable for client deliverables and legal defensibility.
URL archiving. Before analyzing a page, archive it:
- archive.org:
curl -s -d "url=<https://target.com/page"> <https://web.archive.org/save> — returns archived URL.
- archive.today: Submit via their form endpoint as a backup when archive.org is slow or blocked.
- Local mirror:
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent -P ./evidence/ <https://target.com/path> for a full offline copy.
Screenshot evidence. Capture visual state of findings:
gowitness scan single --url <https://target.com/admin> --screenshot-path ./evidence/screenshots/playwright screenshot --url <https://target.com/admin> --output ./evidence/screenshots/admin.png- EyeWitness for bulk URL screenshot runs from a target list.
Hashing discipline. SHA-256 every downloaded artifact immediately upon collection:
sha256sum ./evidence/artifact.html >> ./evidence/checksums.sha256
Never modify an artifact after hashing. If transformation is needed (e.g., deobfuscation), work on a copy and hash both the original and the copy.
Chain of custody. Every artifact record must include:
- UTC timestamp (ISO 8601):
2026-05-29T14:32:00Z
- Source URL or retrieval command
- SHA-256 hash of the file as retrieved
- Operator ID (engagement handle, not personal name)
Storage. All engagement data lives on an encrypted volume:
- Linux: LUKS-encrypted partition or loopback device.
- Cross-platform: VeraCrypt container.
- Air-gapped storage for sensitive engagements (government, healthcare, finance).
Retention. Follow the client contract retention clause. Default: 90 days post-delivery. Cryptographic destruction (wipe + key deletion) on engagement close. Document the destruction date and method.
9. Automation & Tooling Quick-Install
Full tool catalog, version pins, and installation details: docs/reference/tool-directory.md. This section covers integration patterns only.
One-liner install patterns for the most common tool ecosystems:
- Go tools:
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
- Python tools:
pip install trufflehog semgrep (use the shared venv)
- Cargo tools:
cargo install rustscan
- System packages:
sudo apt install nmap masscan jq or brew install nmap masscan jq
Workflow automation. Chain tools with bash pipelines and jq for structured output:
subfinder -d target.com -silent | httpx -silent -json | jq -r '.url' | nuclei -silent -json | jq '.'
Structured output preference. Always use -json or -o json flags when available. Structured output enables programmatic severity classification (§4), sidecar generation (§6), and evidence hashing (§8) without fragile text parsing.
Sidecar integration. Automation pipelines should write their outputs in sidecar-compatible JSON (§6 shape) so downstream modules can ingest results automatically.
Structured Outrider run contract
Follow the shared run-contract instructions in ../_shared/run-contract.md.
- Contract skill identifier:
analysis-and-reporting.
- Consume
skill_request version 1 and produce skill_result version 1 when participating in an Outrider run.
- Use evidence IDs for all claims; do not cite unregistered local paths as claim evidence.
- Discoveries are observations and do not expand scope or approval.
- Do not claim final finding validation; use
finding_candidate only when a human-reviewed candidate should be handed off.
- Do not directly edit
manifest.json, scope.yaml, run.jsonl, evidence.jsonl, or approvals.jsonl.
- Use policy-gated MCP with the explicit
run_dir; the Python control layer and MCP boundary must reevaluate current controls.
Finding promotion boundary
Analysis may classify evidence-backed claims as finding_candidate and may recommend a severity, but it must not finalize severity, create validated_finding, or self-promote a claim. Human promotion occurs only through outrider finding promote after the Python control layer verifies the source contract, registered evidence, current scope, and workflow state.
