> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Classification

> How the classification agent probes and scores leads.

The classification agent turns raw recon into scored leads. It has no HTTP
surface. It listens to domain events and writes its results into the lead
records you read through the API.

## What happens on a new lead

1. A scan or Hackbot publishes a `lead.created` event.
2. The classification agent picks the event and reads the lead.
3. The agent probes the lead before it scores. Probing beats guessing: the
   agent checks the evidence it has, then classifies.
4. The agent writes a classification with a score, a feature category, an
   analysis, and a diagram of the architecture it saw.
5. The lead detail view and the dashboard radar show the result.

## Where you see the output

* `GET /api/leads/{id}` carries the classification fields on the lead.
* The dashboard attack-surface radar groups leads by feature category.
* Lead priority drives `GET /api/leads/top`.

## Skills

The agent classifies through a curated skill set: one skill per asset class.
Each skill carries the checks and the severity lens for its class. The
platform team maintains the skill set. The API does not expose it.

## Hackbot's classifier

Hackbot chat runs its own classification sub-agent for asset questions in
conversation. That sub-agent uses a restricted tool set, so a chat answer
cannot wander into full recon. The restriction stays internal. Chat clients need no extra calls.