CyberEdge Assess Scope
Use cyberedge-agent as the JSON machine bridge. This is the umbrella workflow for a full authorized assessment; humans do not operate the CLI directly.
Workflow
- Require an existing
scope_id whose Scope has a non-empty, human-provided authorization_ref. If ownership or authorization is ambiguous, stop before active work.
- Call
GetReadiness. Report unavailable optional components before starting, but do not split the workflow into unrelated Tasks.
- Call
GetScope and verify every requested target is already inside the authorized Scope.
- Call
StartAssessment once:
- use
standard for routine inventory with the server-owned baseline ports;
- use
thorough only when the human explicitly requests comprehensive scanning. It uses the server-owned TCP 1-1024 profile plus selected high-value ports.
- Follow
WatchTask until a terminal event. Use GetTask if the stream is interrupted. Do not create parallel duplicate assessments.
- Call
GetTaskReport. Treat its coverage entries as authoritative for workflow completeness.
- Summarize assets, services, websites, certificates, and findings. For every stage, preserve
complete, partial, unavailable, or blocked; a completed Task does not mean every stage had coverage.
- Retrieve Evidence only for material claims that need inspection. Keep hashes and provenance in the report.
- When the human explicitly requests continuous monitoring, call
CreateSchedule with the same assessment policy and an interval of at least 3600 seconds. On later runs, use SearchAssetChanges and SearchExposureChanges; distinguish the first baseline from subsequent no-change results.
Safety Boundaries
- Never accept an arbitrary port list, URL, header, template, flag, command, CPE, organization search term, or provider query from the caller.
- Never expand outside the authorized root domains or addresses. Discovered names remain bounded to those roots.
- Never evade target throttling, WAF behavior policy, authentication, or provider limits. Mark the affected stage
blocked or partial.
- Never create a recurring Schedule unless the human explicitly requested monitoring or continuous coverage.
- Never infer a product version or vulnerability without retained evidence.
- On
CAPABILITY_DENIED, report the missing capability; do not change identity or fall back to direct shell scanners.
- Do not call the low-level policy Skills to make an unavailable assessment stage look complete.
Output Contract
Return the Task ID, profile, terminal state, readiness snapshot, per-stage coverage, inventory counts, evidence-backed findings, and explicit gaps. Say “full assessment requested” rather than “full assessment completed” unless every required coverage entry is complete.
1---2name: cyberedge-assess-scope3description: Run or continuously monitor one evidence-backed CyberEdge assessment workflow for an explicitly authorized Scope. Use when an AI operator must check readiness, expand domain assets, inventory services and websites, run bounded vulnerability and intelligence stages, follow one Task, create an explicitly requested recurring assessment, inspect exposure changes, and report exact coverage without claiming unavailable adapters were completed.4---56# CyberEdge Assess Scope78Use `cyberedge-agent` as the JSON machine bridge. This is the umbrella workflow for a full authorized assessment; humans do not operate the CLI directly.910## Workflow11121. Require an existing `scope_id` whose Scope has a non-empty, human-provided `authorization_ref`. If ownership or authorization is ambiguous, stop before active work.132. Call `GetReadiness`. Report unavailable optional components before starting, but do not split the workflow into unrelated Tasks.143. Call `GetScope` and verify every requested target is already inside the authorized Scope.154. Call `StartAssessment` once:16 - use `standard` for routine inventory with the server-owned baseline ports;17 - use `thorough` only when the human explicitly requests comprehensive scanning. It uses the server-owned TCP 1-1024 profile plus selected high-value ports.185. Follow `WatchTask` until a terminal event. Use `GetTask` if the stream is interrupted. Do not create parallel duplicate assessments.196. Call `GetTaskReport`. Treat its `coverage` entries as authoritative for workflow completeness.207. Summarize assets, services, websites, certificates, and findings. For every stage, preserve `complete`, `partial`, `unavailable`, or `blocked`; a completed Task does not mean every stage had coverage.218. Retrieve Evidence only for material claims that need inspection. Keep hashes and provenance in the report.229. When the human explicitly requests continuous monitoring, call `CreateSchedule` with the same assessment policy and an interval of at least 3600 seconds. On later runs, use `SearchAssetChanges` and `SearchExposureChanges`; distinguish the first baseline from subsequent no-change results.2324## Safety Boundaries2526- Never accept an arbitrary port list, URL, header, template, flag, command, CPE, organization search term, or provider query from the caller.27- Never expand outside the authorized root domains or addresses. Discovered names remain bounded to those roots.28- Never evade target throttling, WAF behavior policy, authentication, or provider limits. Mark the affected stage `blocked` or `partial`.29- Never create a recurring Schedule unless the human explicitly requested monitoring or continuous coverage.30- Never infer a product version or vulnerability without retained evidence.31- On `CAPABILITY_DENIED`, report the missing capability; do not change identity or fall back to direct shell scanners.32- Do not call the low-level policy Skills to make an unavailable assessment stage look complete.3334## Output Contract3536Return the Task ID, profile, terminal state, readiness snapshot, per-stage coverage, inventory counts, evidence-backed findings, and explicit gaps. Say “full assessment requested” rather than “full assessment completed” unless every required coverage entry is `complete`.
symph0nia