threat-surface-analysis

type	skill
lifecycle	stable
inheritance	inheritable
name	threat-surface-analysis
description	Discover a codebase's threat surface through systematic investigation — map ecosystem groups, dependency graphs, service connections, authentication mechanisms, and trust boundaries. Use when performing threat modeling, security review, or architectural analysis of any multi-ecosystem repository.
tier	standard
applyTo	**/*threat*,**/*surface*,**/*analysis*
currency	2026-04-30T00:00:00.000Z
lastReviewed	2026-04-30T00:00:00.000Z

Threat Surface Analysis

Systematic codebase investigation to discover the attack surface — services, dependencies, authentication, and trust boundaries. Language-agnostic, works across any ecosystem.

When to Use

• Security review of a new or unfamiliar codebase
• Threat modeling preparation (discovering what to model)
• Architecture discovery for legacy systems
• Identifying external service connections and auth mechanisms
• Finding unprotected endpoints or misconfigured trust boundaries

---

Core Principles

• Intent-based classification — classify by runtime purpose and behavior, not project name
• Evidence, not conclusions — record what was found; defer interpretation
• Unknowns are valuable — "Auth: Unknown" is better than guessing
• Source projects are anchors — entry points (web apps, functions, CLIs) become threat surfaces. Libraries are invisible.
• Config flows DOWN — a source project's config covers all its library dependencies

---

Phase 1: Ecosystem Detection

Discover all programming languages, build systems, and infrastructure-as-code in the repository.

Procedure (aim for ~5 tool calls)

1. List workspace root — one level deep
2. Scan for manifests using the table below (1–2 calls)
3. Identify ecosystem groups — a repo may contain multiple (e.g., .NET + React + Terraform)
4. Read workspace descriptors — .sln, package.json workspaces, go.work, etc.
5. Form hypothesis — 2–3 sentences on what the system does

Manifest → Ecosystem Mapping

Manifest Pattern	Ecosystem
*.sln, *.csproj, *.fsproj	.NET
package.json	Node.js / TypeScript
go.mod	Go
pyproject.toml, requirements.txt, Pipfile	Python