Cross-Wave Delta Analysis Skill

Methodology for comparing findings across multiple recon waves on the same target set. Detects NEW findings, REGRESSIONS (previously open now blocked), PERSISTENT vulnerabilities, and CHANGES over time. Distilled from 9 waves across 7 deep targets that revealed missed CORS findings, new port exposures, and infrastructure drift.

When to Use

• Running repeated recon on the same target set (Wave N+1 after Wave N).
• You want to know if a vulnerability was PATCHED since last wave.
• You want to know if a NEW surface appeared (new ports, new subdomains, new endpoints).
• After completing a deep recon wave — produce the delta report before next wave.
• Before reporting — confirm findings are still valid (not regressed).

Prerequisites

• Prior assessment output beneath ${OUTPUT_DIR:-./output}/baseline/.
• Current assessment output beneath ${OUTPUT_DIR:-./output}/current/.
• Structured findings per target (at minimum: ports, CORS status, WP users, XMLRPC status, sensitive paths).

How to Run