Attack Surface Mapping Given one target and one application , draw the surface from what that application already exposes. Then stop. Testing lives in other skills. This skill is the fast path. Success is a portrait plus a host/API inventory plus a key table plus response-class labels plus an object graph. A probe count is not success. Field patterns for where the rest of the surface actually lives: SURFACE PATTERNS.md. When - A new URL, a new app, or "I only see a login page" - Need to know what to test before loading injection / auth / upload skills - The agent is about to brute directories…