{
 "schema_version": 1,
 "generated": "2026-10-24",
 "id": "ch1nfo-riftx--map-attack-surface-with-parallel-agents",
 "repo": "Ch1nfo/RiftX",
 "repo_url": "https://github.com/Ch1nfo/RiftX",
 "repo_slug": "ch1nfo-riftx",
 "title": "Map an app's attack surface with parallel child agents",
 "page_title": "How to map an app's attack surface with parallel child agents with RiftX",
 "summary": "Crawl an in-scope app into an inventory, then split review work across child agents on a shared board.",
 "who": "A security tester starting an engagement on a large web application who wants a complete map before deep testing.",
 "problem": "Mapping links, forms, API routes, and auth boundaries by hand is slow, and parallel review is hard to coordinate across separate chats.",
 "outcome": "A structured attack-surface inventory and a board of review tasks, each claimed by a child agent and returned for main-agent review.",
 "steps": [
  "Open a session scoped to the authorized target and perform the first navigation in the browser.",
  "Run the crawl tool to collect links, forms including hidden fields, API routes from JS bundles, and authentication boundaries.",
  "Review the inventory, then ask the main Agent to propose review tasks on the shared task board.",
  "Approve the tasks so child Agents can claim them and run one work item at a time.",
  "Review each child result in the Agents and Messages views before marking the collaboration round finished."
 ],
 "agent_prompt": "In RiftX, run the crawl tool on the authorized target <target-url> and build a board of review tasks from the inventory. Return the task list with owners, status, and evidence references. Verify that no task is marked complete until the main Agent has accepted the child result.",
 "agents": [
  "any"
 ],
 "difficulty": "Advanced",
 "time": "90 minutes",
 "basis": "readme",
 "caveat": "The crawl only covers what the scoped browser can load, and the default limits of 32 admitted work items and 60 autonomous wakes apply to a single collaboration round.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "typescript",
 "requirements": [
  "Written authorization from the owner of the target system, with a defined scope",
  "A local machine where you can run the RiftX app (the README badges reference Node.js, Next.js, and React)",
  "A model provider key for OpenAI, Anthropic, Google, or a compatible endpoint",
  "Playwright and Chromium available for the browser tool"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": false,
 "score": 0.9,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/ch1nfo-riftx/map-attack-surface-with-parallel-agents/",
 "md": "https://dedupedai.com/use-cases/ch1nfo-riftx/map-attack-surface-with-parallel-agents/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/ch1nfo-riftx--map-attack-surface-with-parallel-agents.json",
 "api_version": "v1"
}