analysis-and-reportinglisted

# Analysis & Reporting > Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only. --- ## BEHAVIORAL CONTRACT **When triggered:** Endpoint scoring, finding severity classification, attack-path hint generation, mobile app ownership assessment, vulnerability prioritization, sector-specific recon analysis, AI-assisted OSINT analysis, evidence preservation, or tooling/automation setup is needed. **Execute:** 1. For every classified API endpoint, compute the endpoint interest score (§1). If score >= 70, attach an attack-path hint from §3 templates. 2. For mobile apps, compute ownership confidence (§2). Accept if >= 70; below threshold = `mobile_review_pending`. 3. For every finding, classify severity using the decision matrix (§4). Apply sector severity overrides (§5) when target is in a regulated sector. 4. For HIGH/CRITICAL findings, emit the matching attack-path hint from §3 templates. 5. Write sidecar JSON files (§6) for cross-module coordination when this module produces outputs that feed other modules. 6. Evidence handling: preserve all artifacts per §8 — URL + UTC timestamp + SHA-256 + operator ID for all downloads; store on encrypted volume. 7. For bulk JS/response analysis, apply AI-assisted OSINT patterns (§7) using local models for sensitive content. 8. For tooling setup and automation pipelines, follow §9 patterns and reference `docs/reference/tool-directory.md`. **Output:** Scored findings with severity,