Draw a testable attack surface from one authorized target URL or one application. Use when the user says 攻击面, 供给面, 画攻击面, map the surface, application recon, find the business host, JS inventory, or when the only visible page is login. Derive hosts, APIs, keys, and the object graph from what the app already exposes. Do not open with directory brute or payload spray.
Install
The individual skill folder is not confirmed. This command opens the repository’s skill selector; follow the upstream instructions.
skills CLI
npx skills add yaklang/hack-skills