UnboundCompute
OrganizationSecurity-testing methodology as portable, tool-agnostic agent skills for Claude Code and any agent runtime: white-box bug hunting, AI-agent and LLM red-teaming, supply-chain risk, and appsec depth.
Categories
Indexed Skills (119)
auditing-graphql-attack-surface
Audit the attack surface a GraphQL API exposes that a plain endpoint does not: schema introspection left open, unbounded query depth and recursion, aliasing and field duplication that multiply cost, query batching that defeats rate limits and enables brute force, field-level authorization that a resolver skips even when the object check passed, and mutations reached without the guard their action needs. Covers the query and variables as the source, the resolver and the data or work it triggers as the sink, and the missing depth, cost, batch, or field guard as the bug. Use when reviewing a GraphQL schema, its resolvers, or a gateway that fronts one. Introspection and cost limits are one audit; per-field and per-mutation authorization is the other.
auditing-ssh-trust-and-agent-forwarding
Audit secure-shell trust hygiene, not cipher hardening: a forwarded authentication agent a remote host can abuse to log in as you elsewhere, client configuration or a proxy-command directive influenced by an untrusted source, host-key verification disabled or blind-accepted so a machine-in-the-middle succeeds, and authorized-key entries whose forced command can be escaped or whose source and forwarding are unrestricted. Covers agent-socket exposure on multi-user or untrusted hosts, config and proxy-command injection from attacker-controlled data, trust-on-first-use gaps, and permissive key options. Use when auditing how hosts and users establish secure-shell trust and what a compromised endpoint can reach. The forwarded socket, injected directive, or unverified key is the source, authentication or command execution as an unintended identity is the sink.
enumerating-snmp-exposure
Enumerate network-management exposure through the simple network-management protocol: default and guessable community strings, weak or downgradeable versions, read views that leak interface tables, routing and neighbor data, running configuration, process and user lists and sometimes credentials, and writable objects that let you change device state. Covers guessable read and write community strings, version-one and version-two exposure where authentication is a shared string sent in the clear, weak version-three auth, and over-broad views that disclose or mutate more than management needs. Use when auditing network devices, printers, appliances, or hosts that answer management queries. The community string or weak credential is the source, the disclosed data or writable object is the sink.
hunting-broken-object-level-authorization
Hunt broken object-level authorization (BOLA, also called IDOR): endpoints that accept a client-supplied object reference - a numeric id, UUID, key, slug, filename, or an id nested in a request body or token - and read or mutate that object without checking the authenticated caller is entitled to it. Covers direct references, enumerable and guessable ids, references buried in nested or batch payloads, second-order ids stored then trusted later, and ownership checks that run on one path but not its siblings. Use when reviewing any API or handler that fetches or changes a record by an id the client controls. The reference is the source, the data access is the sink, and the missing owner binding is the bug.
hunting-dynamic-linker-hijacks
Hunt local privilege escalation and code execution through the dynamic loader: a preload environment variable honored across a privilege boundary, a writable directory on the runtime library search path, an embedded run-path that points at a writable or origin-relative location, and libraries loaded by an unqualified name. Covers preload variables that survive a privilege transition through a service manager or delegation rule, world- or group-writable library directories a privileged binary searches, run-path entries relative to a writable component, and dynamic loads of a short name. Use when auditing a privileged binary, service, or image for loader-based hijacking. The attacker-controlled library or variable is the source, the loader mapping it into the privileged process is the sink, and the unstripped or writable search path is the bug.
hunting-mass-assignment-and-property-authz
Hunt mass assignment and broken object-property authorization: handlers that bind a client request payload straight onto a record or model and let the caller write fields it should never control - role, is_admin, owner_id, tenant, price, balance, verified, status, or another user's foreign key. Covers auto-binding and hydration that take the whole payload, blocklist filters that miss a field, nested and relation fields that reopen the hole, type juggling that flips a flag, and read paths that return properties the caller should not see. Use when reviewing any create or update handler that maps request fields onto a persisted object. The payload field is the source, the record write is the sink, and the server-controlled property is the bug.
hunting-scheduled-job-and-search-path-hijacks
Hunt local privilege escalation through scheduled jobs and the paths privileged processes trust: periodic and timer jobs whose script, or a file or directory they read, is writable by a lower-privileged user; commands invoked by an unqualified name resolved through a writable search-path entry; and argument injection where a command expands a shell wildcard over a directory an attacker can write to, so a file named like an option (a leading-dash filename) becomes a command-line flag. Covers writable job scripts, writable directories on an effective path, relative command execution, and the filename-as-flag wildcard trick. Use when auditing a host or image for local escalation through automation. The writable input is the source, execution as the job's identity is the sink.
hunting-setuid-and-capability-escalation
Hunt local privilege escalation through setuid and setgid binaries and per-file capabilities: programs that run as a more privileged identity, or files granted a capability such as changing user id, overriding file permissions, raw disk or memory access, or loading kernel modules, that expose an exec, file-read, file-write, or library-load primitive an unprivileged caller can reach. Covers known dangerous tools left with the bit set, custom or bundled setuid programs that shell out or trust a writable path, and over-broad capabilities that are privilege in all but name. Use when auditing a host, image, or package for local privilege escalation. The elevated identity is the source, the primitive it exposes is the sink, and the missing confinement is the bug.
testing-smtp-smuggling-and-email-spoofing
Test a mail setup for sender spoofing that survives authentication: SPF, DKIM, and DMARC records that exist but do not align or enforce, subdomains left unprotected, and the end-of-data desync known as SMTP smuggling, where an inbound and an outbound mail server disagree on where one message ends so a second message with a forged, auth-passing sender is smuggled in. Covers policy present but not enforced, alignment gaps between the envelope and header sender, missing subdomain policy, open relay, and inconsistent message-boundary parsing between hops. Use when auditing a domain's mail authentication or a mail server's boundary handling. The crafted or smuggled message is the source, an accepted spoofed delivery is the sink.
auditing-cors-and-cross-origin-trust
Audit the code and configuration that decide cross-origin access, for trust a browser turns into a read of authenticated data. Covers a response that reflects an arbitrary request origin into the allow-origin header alongside allow-credentials, an allowlist that accepts the null origin, allowlist matching by prefix, suffix, substring, or an unanchored pattern that a lookalike origin satisfies, the origin header trusted as an authorization or request-forgery defense, and a cross-window message handler that acts on data without an exact origin and source check. Scoped to the code and config that build the decision, not a live-header scan. Use when reviewing cross-origin response headers, origin-based access logic, or cross-window message handlers. The request origin or the posted message is the source, the credentialed cross-origin read or the message sink is the sink, and trusting an attacker-set origin is the bug.
auditing-device-code-and-pkce-flows
Audit the server side of the authorization-code-with-proof-key and device-authorization grants for bugs that let a stolen or guessed code become a token. Covers a token endpoint that issues without checking the proof-key verifier at all, that accepts the plain challenge method or a challenge-absent downgrade, or that binds the verifier to the client rather than to the specific code; and a device grant whose short user code is brute-forceable because polling is unthrottled, whose device code is not bound to the requesting client, or whose approval is not tied to the authenticated approver. Scoped to the proof-key and device-code specifics, not general federated login, which a separate skill covers. Use when reviewing a token endpoint or a device-authorization endpoint. The token request parameters are the source, token issuance is the sink, and an unenforced proof binding between them is the bug.
auditing-multi-tenant-isolation
Audit whether every data operation is scoped to the caller's tenant, so a request in one tenant cannot read or write another's data. Covers a query or object lookup with the object identifier but no tenant predicate, a tenant taken from client-controlled input at the operation rather than the authenticated session, scoping applied on the list path but dropped on the detail, update, delete, or export path, a cache or storage key with no tenant segment, and a background job, report, or privileged connection that runs across tenants or bypasses the mandatory scope. Frames isolation as a systemic invariant, not a single-object reference bug, which a separate skill covers. Use when reviewing data access in a system that serves multiple tenants. The tenant used at the operation is the source, the tenant-scoped data operation is the sink, and a sink scoped by anything but the authenticated tenant is the bug.
auditing-randomness-and-nonce-quality
Audit security-sensitive values for weak randomness: a non-cryptographic generator, a predictable or constant seed, a reused nonce or initialization vector, or an output too short to resist guessing, feeding a value whose only defense is unpredictability. Covers session and authentication tokens, password-reset and verification links, cross-site-request tokens and one-time codes, and cryptographic nonces or initialization vectors, drawn from a statistical generator instead of a cryptographic one, seeded from a timestamp or a constant, reused across messages under one key, or truncated into a space small enough to brute-force. Scoped to the randomness, seed, nonce lifecycle, and entropy length, not the choice of cipher, mode, or hash, which a separate skill covers. Use when a generated value gates access or protects a message. The generator is the source, the security-sensitive value is the sink, and predictability between them is the bug.
auditing-secure-boot-and-firmware-signing
Audit updater and bootloader code for a firmware trust boundary that lets an unsigned or downgraded image be flashed or booted. Covers an update image that reaches a flash write or a boot jump with no signature check between receipt and commit, a verification result that is ignored or inverted, an integrity hash mistaken for an authenticity signature, a signature checked over the wrong or partial bytes or over a different buffer than the one committed, a verification key kept in writable storage or selected by a field in the image, and anti-rollback that is missing or checked before the signature so a known-vulnerable version re-flashes. Use when reviewing code that receives, verifies, flashes, or boots a firmware image. The received image is the source, the flash write or boot jump is the sink, and a verified authenticity check failing to dominate that path is the bug.
auditing-security-logging-completeness
Audit whether an application actually records the security events an investigation would need, and whether the logs themselves leak or lie: a security decision (authentication, an authorization denial or sensitive grant, a credential or privilege change, access to sensitive data) that fires with no durable record, an audit entry missing the actor, target, or outcome, secrets or personal data flowing into a widely-readable log, and untrusted input written to a log without neutralizing line breaks so entries can be forged. Covers coverage gaps at the decision points, record sufficiency and tamper-resistance, log-as-disclosure, and log injection. Use when assessing whether the code emits the security signal downstream detection and forensics depend on. The security action or the secret is the source, the audit or log sink is the sink, and the missing or unsafe record is the finding.
auditing-serverless-event-source-trust
Audit event-driven function handlers that trust the event because it arrived from inside the platform: a handler that treats any delivered event as authentic without verifying its true source or integrity, event fields flowing untrusted into a database write, command, downstream call, or constructed path, a function reachable by several event types or actors that runs privileged logic for one that should not trigger it, and an over-broad execution identity that turns a single spoofed or injected event into wide reach. Covers source authentication, event injection, per-event-type and per-actor authorization, and execution-role blast radius across queues, object-store notifications, schedules, topics, and gateways. Use when functions are triggered by events and the handler trusts the payload or its claimed origin. The event payload is the source, the handler's action is the sink, and the assumed-not-verified trust is the bug.
auditing-webauthn-and-passkey-flows
Audit the server side of passwordless authentication for ceremony-verification bugs that let an attacker-shaped response become an authenticated session. Covers a registration or authentication ceremony whose challenge is not bound to a server-issued single-use value, an origin or relying-party identifier that is never checked or checked by substring, a user-verification flag ignored when policy required it, attestation accepted when it was required, a signature counter regression that hides a cloned authenticator, and the highest-severity case where a cryptographically valid assertion seats a session for a user other than the one the credential is bound to. Use when reviewing code that verifies a registration or authentication ceremony and establishes identity from the result. The attacker-shaped ceremony response is the source, the authenticated session is the sink, and a missing required check between them is the bug.
auditing-webhook-authenticity-and-callback-trust
Audit both directions of webhook trust: an inbound handler that acts on a payload without proving it authentic, and an outbound fetch of a caller-supplied URL that reaches internal targets. Covers inbound handlers with no signature check, a signature compared in non-constant time, a signature computed over a re-serialized body instead of the exact raw bytes, a verification result that is computed but never enforced, and no timestamp or replay defense; and outbound callback or fetch URLs validated by substring or blocklist, or by a single pre-connect lookup that a redirect or a rebind defeats. Use when reviewing code that receives a signed webhook and performs a state change, or that fetches a URL the caller controls. The inbound request or the caller-supplied URL is the source, the state-changing handler or the server-side fetch is the sink, and a missing or bypassable trust check between them is the bug.
hunting-firmware-secrets-and-debug-interfaces
Hunt the attack surface a firmware image ships by mistake: a secret baked into the binary, a debug or diagnostic interface left enabled, a network service exposed by default, or a privileged command or update path reachable with no authentication. Covers a private key, symmetric key, or backdoor credential compiled into the image and used for authentication, a serial or on-chip debug console that drops to a privileged shell without auth, a management or plaintext service bound to every interface at boot, and a command handler that flashes, reconfigures, or executes from external input before any auth check, including a shell command built from that input. Use when reviewing firmware source, init scripts, and default configuration. The externally reachable interface is the source, the unauthenticated privileged action or the secret disclosure is the sink, and a missing auth gate or an embedded secret is the bug.
hunting-orm-and-query-builder-injection
Hunt injection that survives an object-relational mapper or query builder: untrusted input reaching a raw-query escape hatch, an unparameterizable identifier (a column, table, or sort order), or a structured filter or update object whose keys become query operators or column references. Covers raw-query methods that take a string or fragment, sort and column selectors taken from the request, and operator injection where a request body passed as a filter turns a comparison always-true or references a field it should not. Use when data access goes through an ORM or query builder and untrusted input reaches a raw method, an identifier argument, or a filter or update object rather than a bound value. The untrusted value that becomes query structure is the source, the data-access call is the sink, and the missing allowlist between them is the bug.
hunting-redos-and-complexity-dos
Hunt single-request denial of service from super-linear work: untrusted input reaching a backtracking regular expression, a quadratic or worse algorithm, or a hash-keyed structure with attacker-chosen keys, with no size or complexity guard between. Covers regular expressions with nested or ambiguous quantifiers that explode on a crafted non-matching string, accidental nested scans and unbounded parsers over attacker-sized input, repeated string building in a loop, and hash flooding where predictable unseeded keys turn constant-time lookups quadratic. Use when reviewing code where request-controlled strings, collections, or numbers reach an expensive operation and the cost can grow faster than the input. The input's size or content is the source, the super-linear operation is the sink, and the missing bound is the bug.
hunting-unsafe-archive-extraction
Hunt unsafe extraction of untrusted compressed archives: an entry's declared path escaping the destination directory (traversal or an absolute path), a symlink or hardlink entry that a later entry writes through to reach outside, decompression amplification where a small archive expands to exhaust disk or memory, and content or name confusion where an extracted file is later executed, served, or loaded. Covers import, restore, plugin-install, and upload features that unpack archives from users or remote sources, and the difference between checking a path and checking the path a symlink resolves to. Use when reviewing code that extracts an archive whose contents come from an untrusted source. The archive entry's path, link target, or declared size is the source, the filesystem write or allocation during extraction is the sink, and the missing containment check is the bug.
reviewing-content-security-policy
Review a content security policy as a script-injection defense and judge whether it would actually stop injected script, with the discipline that a weak policy is a real finding mainly where an injection sink it would otherwise block exists. Covers a script source that allows inline script with no neutralizing nonce or hash, that allows arbitrary hosts or data URLs, or that trusts a host serving attacker-usable script; a nonce that is static, reused, low-entropy, or reflected from input; a missing base-uri or object-src that defeats an otherwise strong nonce policy; and a report-only header shipped as the only policy. Use when reviewing a policy in a response header, a meta tag, or config, alongside the pages it protects. The policy is the control under test, injected script is the sink it must block, and a gap the injection reaches is the bug.
auditing-android-component-exposure
Audit an Android app for components another app on the device can reach and drive, after the manifest export flags and permission gates are resolved. Covers an activity, service, broadcast receiver, or content provider exported without a permission gate, an intent filter that makes a component implicitly exported, a provider that grants URI access or exposes files across the app boundary, a permission declared with a weak protection level, and a component that trusts intent extras from an untrusted caller for a sensitive action. Use when reviewing the manifest and the component code that handles an inbound intent, not the deep-link URL trust that a WebView loads (that is the deep-link skill). A cross-app caller is the source, a reachable exported component acting on the intent is the sink, and a sensitive component another app can invoke unguarded is the bug.
auditing-container-image-build-hardening
Audit container image build definitions (Dockerfile, containerfile, and the compose or run config that sets runtime flags) for an image that ships over-privileged or carrying a secret, after multi-stage discards and deploy-time overrides are accounted for. Covers an image that runs as root, a secret baked into a layer, remote content pulled unpinned or unverified, a mutable or untagged base, an over-broad copy that pulls in local secrets and history, and a dangerous runtime request such as privileged mode or a sensitive host mount. Use when reviewing the image build plane, not the deploy-time security context or the cloud resource definition. The build definition is the source, the shipped image or run config is the sink, and privilege or a secret that survives into the final image is the bug.
auditing-infrastructure-as-code-exposures
Audit existing infrastructure-as-code definitions (Terraform, OpenTofu, CloudFormation, Bicep, Pulumi) for resource state that would provision an insecure resource, after variables, modules, and account defaults are resolved. Covers storage exposed to the public, a security-group or firewall rule open to the whole internet on a sensitive port, an identity or resource policy with wildcard actions or principals, encryption left off or a snapshot or image shared publicly, logging or audit trails disabled, and a plaintext secret in a variable default or connection string. Use when reviewing the static definition files, not authoring or refactoring them, and not walking the runtime identity graph. The declared resource block is the source, the insecure provisioned resource it would create is the sink, and effective config that violates the baseline is the bug.
auditing-kubernetes-workload-and-rbac-hardening
Audit Kubernetes manifests for a subject granted more than it needs or a workload that can escape its container, after the binding graph and admission policy are resolved. Covers a RoleBinding or ClusterRoleBinding to cluster-admin or a wildcard-verb role, a pod running privileged or with host namespaces or a sensitive hostPath mount, a container running as root or able to escalate privilege, dangerous added capabilities, a service-account token mounted where the workload does not need the API, and a workload left flat with no network policy. Use when reviewing the Kubernetes YAML plane (roles, bindings, and workload security contexts as declared), not the cloud identity graph or the image build. The manifest is the source, a cluster-admin subject or an escaping workload is the sink, and a grant or a privilege the binding graph and admission actually allow is the bug.
auditing-mobile-deeplink-trust
Audit how a mobile app handles a deep link, app link, or custom-scheme URL, so an attacker-supplied URL cannot drive a sensitive action or reach a trusted WebView context. Covers a custom scheme any app can register and hijack, an app link whose domain association is unverified so the link is not exclusively the app's, a deep-link parameter that flows unvalidated into a sensitive action, an attacker-controlled URL loaded into a WebView, and a JavaScript bridge exposed to a WebView that can load untrusted content. Use when reviewing deep-link routing, URL handling, and WebView configuration, not the manifest export state of the component that receives the link (that is the component-exposure skill). The attacker-supplied URL is the source, a sensitive action or a trusted WebView bridge acting on it is the sink, and a link parameter trusted without validation is the bug.
auditing-session-lifecycle-and-fixation
Audit how an application issues, rotates, and destroys session identifiers, so an attacker cannot fixate or outlive a session. Covers a session identifier not regenerated at login or privilege change, a logout that clears the client cookie but leaves the server session valid, a session that never expires or has no idle or absolute timeout, an identifier accepted from a URL or a header an attacker can seed, a session cookie missing the secure, http-only, or same-site attributes, and a cookie scoped to a parent domain shared with untrusted subdomains. Use when reviewing authentication, logout, and session-management code and the cookie attributes it sets; it assumes the identifier is unguessable and scopes to lifecycle, not entropy. An attacker who can set or keep a session identifier is the source, the victim authenticating into it is the sink, and a session that is not rotated or invalidated is the bug.
auditing-smart-contract-access-control
Audit a smart contract for a privileged action any caller can reach, so an attacker invokes a function that should be restricted. Covers a state-changing or fund-moving function missing an authorization modifier, an ownership or role check that is wrong or bypassable, an unprotected initializer that lets an attacker seize ownership of a proxy or an uninitialized contract, a delegatecall to an attacker-supplied or upgradeable target that runs foreign code in this contract's context, a self-destruct or upgrade reachable without the right role, and a role granted to an address that should not hold it. Use when the fix would add or repair an authorization check, not reorder effects before interactions (that is the reentrancy skill). The attacker calling a privileged function is the source, the restricted action executing for them is the sink, and a missing or defeated authorization check is the bug.
auditing-tls-and-certificate-validation
Audit client code for transport security that is disabled or defeated, so an attacker on the network path can intercept a connection the client believes is protected. Covers verification switched off (a trust-all setting, a permissive flag, an environment override), a custom trust manager or callback that returns success unconditionally, a hostname check that is skipped or always passes, acceptance of an expired or self-signed certificate through a swallowed error, certificate pinning that is absent where required or falls through to accept on failure, and a silent downgrade to cleartext when the handshake fails. Use when reviewing code that opens outbound TLS connections, configures an HTTP or socket client, or installs a custom trust store. An attacker in a man-in-the-middle position is the source, the client accepting a forged certificate is the sink, and validation that does not fail closed is the bug.
hunting-defi-economic-and-oracle-flaws
Hunt a decentralized-finance protocol for a way to profit by moving a price or breaking an economic invariant, rather than by defeating an access check or re-entering. Covers a price read from a spot source an attacker can move within a transaction, a manipulable oracle or a single-source feed with no sanity bound, a swap or liquidation that trusts a pool ratio a flash loan can skew, rounding or fee-accounting that a repeated interaction drains, share or collateral math that lets a first or precise depositor steal value, and a slippage or deadline parameter left unchecked. Use when the fix is an economic or pricing safeguard (a manipulation-resistant oracle, a bound, corrected math), not an authorization check or a reentrancy guard. The manipulable price or invariant is the source, the value the attacker extracts is the sink, and a value decision that trusts a movable input is the bug.
hunting-mobile-secret-and-storage-exposure
Hunt a mobile app for a real credential shipped in the binary or written to storage another party can read, scoped strictly to mobile-specific sinks. Covers a live secret embedded in the app package or its resources, sensitive data written to world-or-sandbox-readable storage without encryption, a secret placed outside the platform keystore where a weaker guard protects it, data cached or logged where another app or a device-level reader reaches it, and a backup or debug path that carries sensitive data off the device. Use when reviewing the app package, its storage writes, and its logging, distinguishing a public identifier from a credential and judging whether the platform sandbox already contains the data. The embedded or stored secret is the source, a party that can read it is the sink, and a real credential exposed beyond its intended reader is the bug.
auditing-account-recovery-and-reset-trust
Audit password reset and account recovery flows for the trust that lets an attacker take over an account: a reset token that is guessable, long-lived, reusable, or not bound to the account it was issued for, a recovery path that verifies a weaker factor than login and bypasses multi-factor, a reset link whose host comes from an attacker-controllable header so the token leaks, and a recovery that trusts an unverified email or phone change to redirect the reset. Covers the recovery surface of authentication systems, where resetting a credential or recovering access is the alternate door into an account. Use when an application offers password reset or account recovery and that flow is a path to authentication. The attacker-driven recovery request is the source, the account it takes over is the sink, and the weak token, bypassed factor, or leaked reset link that grants it is the bug.
auditing-admission-control-policy-gaps
Audit cluster admission control for gaps that let a non-compliant or hostile workload through: a validating webhook that fails open when its backend is unreachable, a policy that scopes by namespace or label and misses the namespaces that matter, a mutating webhook whose changes are trusted downstream, and an ordering or exemption that lets a privileged pod bypass the checks meant to stop it. Covers Kubernetes admission webhooks and policy engines that are supposed to enforce workload security at create and update time. Use when admission policies are the control that keeps privileged, unsigned, or over-permissioned workloads out of the cluster. The workload submitted for admission is the source, the admitted resource is the sink, and the policy gap that let it through is the bug.
auditing-ansible-become-and-vault-trust
Audit configuration-management privilege escalation and secret handling for trust that runs as root on every managed host: a task that escalates with become across a whole play when only one step needs it, a role or variable sourced from an untrusted place that runs under that escalation, a vault-encrypted secret whose decryption key is exposed to the runner or logged, and a templated value or module argument that takes attacker-influenceable input while privileged. Covers Ansible and similar agentless tools where a control node runs plays that escalate privilege and decrypt secrets across a fleet. Use when playbooks escalate with become or handle vault secrets across managed hosts. The untrusted role, variable, or input running under escalation is the source, the privileged task or decrypted secret is the sink, and the over-broad escalation or exposed key is the bug.
auditing-container-image-provenance
Audit how a cluster decides which container images to trust and run: an image referenced by a mutable tag rather than a content digest, a workload pulling from a registry that admits unsigned or unverified images, a signature or attestation policy that is configured but not enforced at admission, and a base image or layer whose origin the pipeline never verified. Covers Kubernetes and container platforms where the image a workload runs is the code that runs, and where tag mutability, signing, and provenance decide whether it is the intended artifact. Use when workloads pull images whose signing and provenance are not enforced end to end. The unverified image reference is the source, the running container is the sink, and the code that runs without proven provenance is the bug.
auditing-container-runtime-and-socket-exposure
Audit whether a workload can reach the container runtime and thereby control the host: the container runtime socket mounted into a pod or bound into a build or CI container, a privileged sidecar that talks to the runtime to launch or inspect containers, a runtime API exposed over a reachable port, and tooling that needs the runtime and is given it far more broadly than the one operation requires. Covers container hosts where reaching the runtime socket or API grants the ability to start privileged containers, mount the host filesystem, and take over the node. Use when a workload, build, or agent is given access to the container runtime. The workload with runtime access is the source, the container runtime is the sink, and the socket or API exposure that grants host control is the bug.
auditing-cross-account-role-trust-boundaries
Audit cross-account IAM role assumption for trust policies that let the wrong principal assume a role: a trust policy with a wildcard or overbroad principal, a missing or unverifiable external ID on a third-party role, a confused-deputy path where a vendor assumes your role on any customer's behalf, and a role chain that reaches privileges the origin principal should never hold. Covers AWS assume-role trust policies, condition keys that should scope who may assume, and the transitive reach of one assumption into the next. Use when roles in one account can be assumed from another account, a partner, or a service, and the trust policy is the boundary. The external principal permitted by the trust policy is the source, the assume-role grant is the sink, and the trust scope wider than the intended relationship is the bug.
auditing-datastore-exposure-and-abuse
Audit in-memory and cache datastores such as Redis and memcached for exposure and command abuse: an instance reachable without authentication, a request that composes datastore commands from untrusted input, or server-side scripting and module or config commands that reach code execution or a file write. Covers unauthenticated network exposure, command injection where input becomes a command rather than a value, Lua or scripting evaluation on untrusted input, and dangerous administrative commands that rewrite the on-disk file or load a module. Use when an application talks to a cache or key-value store and either the instance is network-reachable or untrusted input reaches the command layer. The untrusted input or the open port is the source, the datastore command interface is the sink, and the unauthenticated access or the composed dangerous command is the bug.
auditing-ecs-task-metadata-boundaries
Audit container task credential and metadata boundaries in orchestrated compute such as ECS: a workload that can reach the container credential endpoint or the host instance metadata service to obtain a role broader than the task needs, a task role over-scoped for the workload, a sidecar or co-located container sharing the same credentials, and a server-side request path inside the task that reaches the metadata endpoint. Covers the task credential relative URI, the instance metadata service reachable from a task, and the blast radius when one container in a task is compromised. Use when containerized workloads assume a task or instance role and the metadata endpoints are the boundary. The reachable metadata endpoint is the source, the credential it returns is the sink, and the role wider than the task's need is the bug.
auditing-host-mount-and-device-exposure
Audit the host paths and devices a workload mounts for reach across the container boundary onto the node: a writable hostPath into a sensitive node directory, a mount of the host root or a system path that exposes other pods' data and node configuration, a raw device or block volume that grants low-level host access, and a hostPath whose subpath or symlink handling lets a workload escape the intended directory. Covers Kubernetes and container hosts where hostPath volumes and device mounts connect a container to the node filesystem and hardware. Use when workloads mount host paths or devices and the question is what node state that mount exposes. The workload holding the host mount is the source, the node file or device it reaches is the sink, and the host-path or device exposure beyond the workload's need is the bug.
auditing-http2-and-grpc-multiplexing-trust
Audit HTTP/2 and gRPC edges for framing and multiplexing trust that breaks when a stream is translated or reused: an h2c or HTTP/2-to-HTTP/1.1 downgrade that reintroduces request smuggling, pseudo-header and header handling that lets a stream forge its path or authority, multiplexed streams on one connection whose authentication or rate limit is applied per connection rather than per stream, and a gRPC gateway that trusts metadata or a method name a caller controls. Covers HTTP/2 front ends, gRPC services, and gateways that translate between protocols. Use when an edge terminates or downgrades HTTP/2 or multiplexes gRPC calls and per-stream trust is assumed. The crafted stream or metadata is the source, the back-end request or method it reaches is the sink, and the downgrade or per-connection trust that admits it is the bug.
auditing-iac-module-and-provider-supply-chain
Audit the supply chain of infrastructure-as-code modules and providers for trust that runs at plan or apply time: a module sourced from an unpinned or attacker-influenceable location, a provider or plugin pulled from a registry without integrity pinning, a module that executes local commands or fetches remote content during planning, and a lockfile that is missing, ignored, or not enforced in CI. Covers Terraform and similar declarative tools where a module or provider runs with the credentials of whoever applies it. Use when infrastructure is built from third-party or shared modules and providers and the apply identity is privileged. The untrusted module or provider source is the source, the plan or apply execution is the sink, and the code running under the applier's credentials without integrity pinning is the bug.
auditing-init-and-sidecar-injection-trust
Audit the init and sidecar containers a workload runs, including ones injected by a mutating admission webhook, for trust the main container never granted: an injected sidecar that runs with broader privileges, host access, or credentials than the workload, an init container that fetches and executes remote content before the app starts, a shared volume or process namespace that lets a sidecar read the main container's secrets, and an injection whose image and configuration come from a source the workload owner does not control. Covers Kubernetes pods where init and sidecar containers, declared or webhook-injected, share the pod with the application. Use when pods run init or sidecar containers, especially injected ones. The injected or auxiliary container is the source, the pod resource or credential it reaches is the sink, and the trust it holds beyond the main container is the bug.
auditing-jwt-verification-and-key-trust
Audit how a service verifies JSON Web Tokens for the classic verification bypasses: an algorithm-confusion attack where a token switches the signing algorithm so a public key is used as a symmetric secret or the algorithm is set to none, a key selected from an attacker-controllable header (a key id, a JWKS URL, or an embedded key) so the token names its own signer, a signature that is decoded but not actually verified, and claims (expiry, issuer, audience) that are parsed but not enforced. Covers services that accept and verify JWTs to authenticate or authorize a caller. Use when a JWT is the credential and its verification is the boundary. The forged or unverified token is the source, the authenticated or authorized action it grants is the sink, and the algorithm confusion, attacker-chosen key, or unverified claim that accepts it is the bug.
auditing-kms-key-policy-and-envelope-encryption
Audit key-management policies and envelope-encryption design for a decrypt path broader than intended: a key policy or grant that admits a principal who should never decrypt, a wildcard key resource in an identity policy that covers unrelated keys, an encryption context that is not enforced so a data key decrypts outside its intended scope, and a cross-account key grant that widens the decrypt set. Covers cloud key-management services, key policies and grants, and envelope encryption where a data key protects the payload and the key policy protects the data key. Use when data is protected by a managed key and the key policy plus encryption context are the boundary on who can decrypt. The principal the key policy admits is the source, the decrypt operation is the sink, and the decryptor beyond the data's intended readers is the bug.
auditing-message-broker-topic-authorization
Audit message-broker topic and queue authorization for reach a client should not have: a wildcard subscription that receives another tenant's messages, a publish permission broad enough to inject into a control or command topic, a shared broker where topic naming is the only separation between tenants, and a client authenticated to the broker but not authorized per topic so any connection can read or write any topic. Covers MQTT, Kafka, AMQP, and similar brokers where publish and subscribe permissions on topics or queues are the boundary between producers, consumers, and tenants. Use when a broker carries messages across trust boundaries and topic-level authorization is the control. The client publishing or subscribing is the source, the topic or queue it reaches is the sink, and the wildcard or missing per-topic authorization that admits it is the bug.
auditing-namespace-as-tenant-boundary
Audit a Kubernetes namespace that is treated as a tenant isolation boundary for the isolation it does not actually provide: cluster-scoped resources and nodes shared across namespaces, RBAC that grants a tenant reach beyond its own namespace, missing network policy so pods cross namespaces freely, and shared cluster services (DNS, ingress, admission, storage classes) that see or serve every tenant. Covers multi-tenant clusters where each tenant is given a namespace and the namespace is assumed to contain them. Use when a namespace is the unit of tenant separation and the assumption is that a tenant cannot affect or observe another. The tenant confined to a namespace is the source, the cross-tenant resource or namespace it reaches is the sink, and the isolation the namespace does not enforce is the bug.
auditing-network-policy-segmentation-gaps
Audit cluster network segmentation for the reachability a workload should not have: a namespace with no default-deny so every pod can reach every other pod, a missing egress policy that lets a compromised pod call out to the internet or the cloud metadata endpoint, an overly broad selector that admits more sources than intended, and a policy that governs one direction while the other stays open. Covers Kubernetes network policies and equivalent segmentation where pod-to-pod, pod-to-service, and pod-to-external reachability is meant to be constrained. Use when network policy is the control limiting lateral movement and egress in a cluster. The reachable source pod is the source, the pod, service, or external endpoint it can reach is the sink, and the segmentation gap that permits the reach is the bug.
auditing-oauth-token-audience-and-scope-trust
Audit how a resource server trusts OAuth access tokens for confusion it should reject: a token minted for one audience accepted by a different service, a scope treated as coarser or finer than it is so a token reaches an operation it was not granted, a token-issuer or authorization-server mix-up where a token from one issuer is honored by a party that trusts another, and a resource server that validates the signature but not the audience, issuer, or scope. Covers OAuth and bearer-token architectures where an access token authorizes a call between a client, an authorization server, and one or more resource servers. Use when a resource server accepts bearer tokens and the audience, issuer, and scope checks are the boundary. The token presented to the wrong audience or beyond its scope is the source, the resource operation it reaches is the sink, and the missing audience, issuer, or scope validation is the bug.
auditing-observability-pipeline-collector-trust
Audit telemetry collectors and observability pipelines for trust they should not extend: a collector endpoint that ingests metrics, logs, or traces without authenticating the sender, a processor that executes or forwards based on attacker-controllable telemetry fields, a collector running with broad credentials whose exporters reach sensitive destinations, and an ingestion path where log or trace content becomes a command, a query, or a downstream request. Covers agents and gateway collectors for logs, metrics, and traces, where the pipeline reads data from many sources and acts on it. Use when a telemetry collector ingests from workloads or the network and forwards, transforms, or stores that data. The unauthenticated or attacker-shaped telemetry is the source, the collector processor or exporter is the sink, and the unauthenticated ingestion or the acted-upon field is the bug.
auditing-payment-callback-and-amount-integrity
Audit payment provider callbacks and settlement notifications for the trust that lets an attacker forge or alter a payment result: a callback whose signature is not verified so a spoofed success is accepted, an amount or currency taken from the callback or client rather than reconciled against the order the server created, a success notification not bound to a specific order so it can be replayed onto another order, and a settled status trusted without confirming it out of band with the provider. Covers redirect returns, server-to-server webhooks, and status polls where a payment processor tells the application a charge succeeded. Use when the application learns a payment result from an external processor and that message gates fulfillment. The forged or altered payment notification is the source, the order marked paid and fulfilled is the sink, and the unverified signature, unreconciled amount, or unbound order reference is the bug.
auditing-payment-state-machine-and-idempotency
Audit payment and checkout state machines for transitions an attacker can drive out of order or replay for value: an order marked paid before the charge is confirmed, a step that can be skipped or repeated so goods ship without settlement, a non-idempotent charge or fulfillment endpoint that double-processes on a retried or replayed request, and a refund or cancel that returns value while the underlying charge stays captured. Covers checkout, charge, fulfillment, and refund flows where money and goods change hands across a sequence of state transitions. Use when a purchase moves through ordered payment states and the transitions and their idempotency are the boundary. The out-of-order or replayed transition is the source, the value released without settlement is the sink, and the skippable step or non-idempotent handler that allows it is the bug.
auditing-presigned-url-scope-abuse
Audit presigned object-storage URLs for scope that grants more than the request intended: a signature that covers a broader key, prefix, or bucket than the user should reach, an overlong expiry, a method or content-type left unconstrained, or a signer identity whose permissions exceed the caller's. Covers presigned GET and PUT URLs for S3 and compatible stores, where the signed policy is the only boundary once the URL leaves the server, and where an attacker who edits the key, reuses the URL, or uploads a different object escapes the intended scope. Use when a service mints presigned URLs so clients read or write storage directly. The caller-influenced key or policy input is the source, the signing call is the sink, and the signed scope wider than the caller's entitlement is the bug.
auditing-s3-object-ownership-trust
Audit object-storage ownership and per-object access for trust the bucket policy does not cover: an object uploaded by another account that keeps that uploader's ownership and ACL, a bucket where object ACLs still grant access despite a restrictive bucket policy, a cross-account write that lands an object the bucket owner cannot read or that carries a public grant, and a policy that scopes by prefix while an ACL on the object overrides it. Covers S3 and compatible stores where object ownership, object ACLs, and the bucket policy interact to decide who reads and controls each object. Use when a bucket receives objects from more than one principal and access is meant to be governed centrally. The cross-account or ACL-granted principal is the source, the object read or control is the sink, and the access the bucket policy did not intend is the bug.
auditing-saml-and-oidc-federation-trust
Audit federated single sign-on for assertions a relying party should not trust: a SAML response whose signature is not verified over the right element so a wrapped or altered assertion passes, an OIDC ID token whose issuer, audience, or nonce is unchecked, a relying party that accepts an assertion for any user because the subject or email is trusted without binding, and a federation that honors an identity provider or signing key it should not. Covers SAML and OpenID Connect where a relying party consumes assertions or ID tokens minted by an identity provider to authenticate users. Use when login trust crosses from an identity provider to a relying party and assertion validation is the boundary. The forged or misbound assertion is the source, the authenticated session it grants is the sink, and the missing signature, issuer, audience, or binding check that accepts it is the bug.
auditing-account-abstraction-and-paymaster-trust
Audit an ERC-4337 account-abstraction deployment for trust misplaced in the user-operation lifecycle: a smart account whose validation accepts a signature or nonce it should reject, a paymaster that agrees to sponsor gas for operations it should not so an attacker drains its deposit, a bundler or entry-point assumption that lets a user operation be replayed or reordered for gain, and validation logic that reads mutable state or reaches outside its allowed scope. Covers smart-contract wallets, paymasters, bundlers, and the entry point in an account-abstraction stack where a user operation is validated and sponsored before it executes. Use when a user operation is validated, paid for, and executed by separate parties and that trust split is the boundary. The crafted user operation is the source, the drained paymaster or unauthorized execution is the sink, and the over-permissive validation or sponsorship rule is the bug.
auditing-ble-and-gatt-authorization
Audit a Bluetooth Low Energy device for missing authorization on its GATT attributes: a characteristic performing a sensitive action or revealing sensitive data readable or writable by any peer, pairing or bonding that is not required or falls back to an unauthenticated Just Works mode with no link encryption, an authorization decision the device pushes to the mobile app instead of enforcing on the peripheral, and a replayable command a sniffer can capture and resend. Covers BLE peripherals, wearables, locks, medical and IoT devices, and their GATT services where a connected peer reads or writes characteristics. Use when a peer can connect over BLE and the peripheral's own enforcement of who may read or write each characteristic is the boundary. The unauthorized connected peer or captured command is the source, the sensitive read, write, or action on the peripheral is the sink, and the missing pairing, characteristic-level authorization, or replay protection is the bug.
auditing-clickjacking-and-ui-redressing
Audit a web application for UI-redressing attacks where an attacker frames the real site and tricks a user into acting on it unknowingly: a sensitive page that can be embedded in an attacker's iframe because it lacks frame-ancestors or X-Frame-Options, a state-changing action reachable by a single click that an overlay or transparent frame steers, a drag-and-drop or keystroke redressing that captures input meant for the attacker page, and a confirmation step that a framed overlay hides. Covers web pages with authenticated, state-changing actions (settings changes, purchases, approvals, connect flows) that could be loaded inside a frame the user cannot see. Use when a sensitive action can be triggered by a click and the page can be framed by another origin, making framing the boundary. The attacker page that frames or overlays the real site is the source, the unknowing state-changing click is the sink, and the missing framing protection or unguarded one-click action is the bug.
auditing-cross-chain-bridge-and-message-trust
Audit a cross-chain bridge or messaging protocol for misplaced trust in messages that cross chains: a destination contract that accepts a mint or release on a forged or unverified proof of a source-chain event, a message whose signer set or validator quorum can be spoofed or is too small, a message that can be replayed on the destination or across chains for a repeated withdrawal, and a lock-and-mint or burn-and-release accounting that a crafted message pushes out of balance. Covers token bridges, message-passing layers, and any protocol where an action on one chain is authorized by an event claimed to have happened on another. Use when a destination-chain action depends on trusting a source-chain event and that verification is the boundary. The forged or replayed cross-chain message is the source, the unauthorized mint, release, or state change is the sink, and the missing or spoofable source-event verification is the bug.
auditing-ml-inference-endpoint-abuse
Audit a hosted model inference endpoint for abuse that costs money or steals the asset: an unauthenticated or weakly keyed endpoint anyone can call, no per-caller rate or spend limit so a caller runs up unbounded inference cost, model extraction where systematic queries reconstruct the model or its decision boundary, membership and training-data inference that recovers whether a record was in the training set, and a response that returns full probabilities or embeddings that make extraction and inversion easier. Covers deployed prediction and embedding endpoints for classifiers, recommenders, and other served models, distinct from loading an untrusted model or serving a chat assistant. Use when a model is exposed as a callable endpoint and its cost, confidentiality, and integrity are the boundary. The unbounded or systematic query stream is the source, the run-up cost or reconstructed model or training data is the sink, and the missing auth, rate/spend bound, or over-informative response is the bug.
auditing-ota-and-firmware-update-channel-trust
Audit an over-the-air or firmware update channel for a device that accepts an image it should reject: an update whose signature is not verified so an attacker installs arbitrary firmware, an update fetched over an unauthenticated transport an on-path attacker can swap, a rollback to an older signed image with known vulnerabilities because the device does not enforce version monotonicity, an update server or manifest URL the device trusts without authentication, and an unencrypted image that leaks secrets and eases reverse engineering. Covers IoT and embedded devices, routers, wearables, and any product that fetches and installs firmware or application updates in the field. Use when a device installs firmware it fetches and the verification of that image before it runs is the boundary. The unsigned, swapped, or rolled-back update is the source, the persistent code execution on the device is the sink, and the missing signature check, transport authentication, or rollback protection is the bug.
auditing-api-key-and-token-lifecycle
Audit the lifecycle of API keys and access tokens for weaknesses that let one keep working past its intended bounds: a key issued with broader scope than the caller needs so a leak grants far more than one function, a key or token with no expiry that stays valid indefinitely, a revocation path that does not actually stop the key so a rotated or compromised credential keeps authenticating, a key that leaks into logs, URLs, client-side code, or error messages and is never rotated, and a token whose scope or audience is not enforced on use so it works against endpoints it was never meant for. Use when a long-lived programmatic credential authenticates a caller and the bounds on that credential (scope, expiry, revocability) are the boundary. The over-scoped, unexpiring, or leaked key is the source, the access it grants past its intended bounds is the sink, and the missing scope limit, expiry, or working revocation is the bug.
auditing-break-glass-account-trust
Audit emergency break-glass and privileged-access accounts for the ways their standing power outlives the emergency they exist for: a break-glass account with a static, shared, or never-rotated credential that is a permanent superuser login rather than a sealed last resort, an emergency account excluded from the MFA, conditional-access, or logging controls covering other admins so its use is easy and invisible, a just-in-time elevation that grants more than the task needs or is not revoked when the task ends, an emergency-access path with no approval, time bound, or alerting so it is used routinely, and a break-glass use that triggers no review afterward. Use when a standing emergency identity or an elevation path holds power beyond ordinary admins and the controls around when and how it is used are the boundary. The break-glass credential or elevation request is the source, the unbounded or unaudited privileged access is the sink, and the missing rotation, control coverage, or use-time alerting is the bug.
auditing-directory-sync-trust
Audit bulk directory synchronization (LDAP, HR-system, IdP, or cross-directory feeds) between an external identity source and an application for trust misplaced in the sync feed: a sync that trusts a source attribute (group, department, an admin-like flag) to set local privilege or tenancy without validating it, a connector authenticated by a broad credential that can read and reshape the whole directory, a mapping that lets an external group name land on a privileged internal group, a sync that matches accounts by a spoofable key (email, external id) so an attacker record merges into an existing identity, and a source deletion that does not propagate so departed users linger. Use when an external directory feed drives account and privilege state and the application's trust in that feed is the boundary. The attacker-influenced source record is the source, the over-privileged, merged, or lingering internal account is the sink, and the unvalidated attribute mapping or spoofable match key is the bug.
auditing-idp-initiated-flow-trust
Audit identity-provider-initiated single sign-on for trust placed in an unsolicited assertion the application never asked for: an IdP-initiated SAML response the service provider accepts with no matching request so there is no request state to bind it to, an unsolicited assertion an attacker captures and replays or delivers to a victim to log them into an attacker-chosen account, a RelayState value trusted as a redirect target so it becomes an open redirect, an assertion with no or a too-wide audience so it is accepted by a service provider it was not meant for, and a missing replay defense (no one-time-use, weak expiry) that lets one assertion be used more than once. Use when an application accepts a login assertion it did not request and the validation of that unsolicited assertion is the boundary. The unsolicited or replayed assertion is the source, the unintended authenticated session is the sink, and the missing request binding, audience, or replay defense is the bug.
auditing-jit-provisioning-and-role-mapping
Audit just-in-time account provisioning at federated (SAML or OIDC) login for trust misplaced in the assertion that drives it: a first login that creates an account and assigns roles from identity-provider claims (groups, email domain, department) the service never validates, a claim-to-role mapping that grants more privilege than the claim should or defaults new users into a privileged role, an email or domain claim trusted to auto-join a tenant so an attacker with a lookalike address lands inside it, and a JIT update that re-elevates an account on every login from mutable claims. Use when a federated login provisions an account and the mapping from assertion claims to local roles and tenancy is the boundary. The attacker-shaped login assertion is the source, the over-privileged or wrong-tenant provisioned account is the sink, and the unvalidated claim or over-granting role mapping is the bug.
auditing-machine-identity-issuance
Audit how a platform issues machine and workload identities (certificate authorities, workload-identity federation, service-mesh identity, attestation-based credentialing) for trust misplaced in the thing asking for one: a credential issued on a weak or forgeable proof (a self-asserted name, an unvalidated label, a reachable metadata endpoint) so forging the proof yields a real identity, an issuing authority not constrained to the names it may mint, a federation trust configured so broadly (a wildcard subject, unpinned issuer, missing audience) that an outside principal can assume it, a certificate with an over-long lifetime or no revocation, and an issuance path with no binding to a verified workload. Use when a platform decides what proof earns a machine identity and that is the boundary. The forgeable issuance proof or over-broad trust is the source, the illegitimately issued machine identity is the sink, and the weak attestation, unconstrained issuer, or over-broad federation trust is the bug.
auditing-mfa-enrollment-and-reset-abuse
Audit multi-factor authentication enrollment, reset, and recovery for paths that let an attacker add their own factor or bypass the check: a first-factor session that can enroll a new authenticator without re-proving identity so a stolen password adds a second factor, an MFA reset or recovery flow guarded only by a weak signal (an email link, a knowledge question, a support request) that resets the factor to attacker control, a step-up prompt that can be skipped or is not enforced server-side on a sensitive action, backup codes that are weak, reusable, or issued without authentication, and an MFA-fatigue or push-bombing flow that approves on a single tap. Use when adding, resetting, or satisfying a second factor is the boundary between a stolen first factor and a full account takeover. The enrollment or reset request is the source, the attacker-controlled factor or bypassed check is the sink, and the missing identity proof or skippable step-up is the bug.
auditing-csrf-and-unsafe-state-changes
Audit state-changing endpoints for cross-site request forgery, where a request that rides the victim's ambient cookies is authorized on that session alone with no unpredictable, session-bound proof the request came from the app, letting an attacker page trigger the change as the victim. Use when reviewing forms and actions that modify data, change settings, move funds, or alter access, and how each is protected. Covers missing or unvalidated tokens, tokens not bound to the session, cookie-only same-site reliance and its gaps, state-changing GET requests, and content-type or method-override assumptions. The cross-site request on the victim's session is the source, the state-changing endpoint is the sink, and acting without unpredictable session-bound proof of origin is the bug.
auditing-error-handling-and-information-exposure
Audit error handling and diagnostic surfaces for sensitive information a real client receives, where an exception path, a debug feature, or a diagnostic endpoint returns stack traces, database errors, internal paths, framework or version banners, configuration, secrets, or messages that differ enough to enumerate users. Use when reviewing how a service responds to malformed, unauthorized, or failing requests in its deployed configuration, and whether debug modes, source maps, or version-control metadata are exposed. Scoped to what production actually returns, not developer-only verbosity. The error or diagnostic path is the source, the response, header, or user-visible log is the sink, and disclosing detail that aids a further attack is the bug.
auditing-android-intent-redirection-and-pendingintent
Audit Android privilege and access leaks through intent redirection and mutable pending intents, where a privileged component receives an intent carrying a nested intent it then launches, or hands out a pending intent an untrusted app can fill in, so the untrusted caller reaches a protected component or acts with the privileged app's identity, because the component forwards an attacker-supplied intent without constraint or the pending intent is mutable and under-specified. Use when an Android app forwards intents extracted from input or shares pending intents with other apps. Covers nested-intent redirection to protected components, mutable pending intents, implicit pending-intent delivery, and forwarding that carries the app's permissions. The attacker-supplied nested or fillable intent is the source, the privileged component launching or sending it is the sink, and reaching a protected target with the app's identity is the bug.
auditing-group-policy-and-sysvol-trust
Audit trust placed in group policy content and the domain policy share, where a low-privileged principal can write a policy object, its files on the domain share, or its link, causing that policy to run scripts, set scheduled tasks, install software, or change security settings on every machine the policy applies to, or where a stored credential or an unsigned policy file lets any domain user act on the policy. Use when policy objects, their share files, or their links may be writable by non-administrators or carry stored secrets. Covers writable policy content, writable links and scope, embedded credentials, and unsigned or world-readable policy files. The low-privileged write to policy content or link is the source, the machines applying the policy are the sink, and running attacker-chosen policy on those machines is the bug.
auditing-ios-app-group-and-pasteboard-exposure
Audit sensitive data leaving an iOS app's protection through shared containers and system-wide channels, where a secret or private value is written to a shared app-group container, a shared keychain access group, the general pasteboard, or app state that lands in snapshots and extensions, so another app, an app extension, or any process reading the pasteboard can recover it, because the shared surface is broader than the data's sensitivity requires. Use when reviewing what an iOS app shares with its own extensions or other apps and what it copies or exposes system-wide. Covers app-group container leakage, over-broad shared keychain groups, general-pasteboard secrets, and snapshot or extension data exposure. The sensitive value placed on a shared surface is the source, the other app or process reading that surface is the sink, and recovering the value outside the app's boundary is the bug.
adjudicating-dependency-cve-reachability
Decide whether a CVE in a dependency actually exposes your application before you scramble to patch: is the vulnerable function on a real call path from your code, do the trigger preconditions hold, and can an attacker control the input that reaches it. Use when an advisory, SCA scan, or dependency bot flags a CVE and you must separate a genuine exposure from unreachable noise, or justify why you are or are not affected. Covers pinning the vulnerable symbol, call-path reachability, precondition checks, and taint from your entry points.
adjudicating-taint-paths
Decide whether a whitebox lead is a real bug by tracing taint from an untrusted source to a dangerous sink and confirming every hop against live source. Use after a scanner, a candidate list, or your own reading surfaces a "this looks dangerous" sink (SQL exec, system/exec, file open, deserialize, template render, redirect target, memcpy) and you must decide whether attacker- controlled input actually reaches it - or kill the lead with evidence. Covers forward and reverse taint, witness paths, sanitizer analysis, and the evidence rules that separate a finding from a false positive.
auditing-ai-agent-permissions
Audit what an AI agent is actually allowed to do versus what its task needs. Covers excessive agency (tools, scopes, and autonomy beyond the job), missing human-in-the-loop gates on irreversible actions, over-broad credentials and their blast radius, sandbox and code-interpreter escape, unfiltered egress, and unbounded resource or spend (denial-of-wallet). Use when granting an agent a tool or scope, reviewing an agent's permission posture, or deciding which actions need approval. The model's restraint is not a control; permissions are.
auditing-cicd-oidc-trust
Audit continuous-integration pipelines for the trust they extend to untrusted input: workflows that run on incoming change requests from forks while holding repository secrets, steps that let attacker-controlled content reach a privileged command, and cloud role trust conditions that accept a pipeline's short-lived token too broadly. Covers secret and token exposure on fork-triggered runs, poisoned-pipeline execution, and over-broad trust on the identity claim a pipeline presents to a cloud account. Use when reviewing CI/CD configuration, pipeline identity, or the boundary between a build and the cloud it can reach. An exploitable token or command from untrusted input is the finding.
auditing-declarative-authorization
Audit authorization expressed as configuration or framework convention rather than inline code: row-level security and policy rules, framework before-action and middleware filters that must be attached to every protected route, serverless and gateway access rules, and object-ownership checks. Covers routes that skip the filter, policies with a permissive default, rules that check authentication but not ownership, and gaps between where the rule is declared and where the data is accessed. Use when reviewing role- or policy-driven access control. Coverage and correctness are separate checks.
auditing-guard-gaps
Find the missing-check bug by comparing sibling functions that reach the same sink - one validates its input, its peer does not. Use on an authorized source target to surface broken access control, missing bounds checks, and skipped sanitization that linear file-reading hides; when you suspect one handler in a family forgot the check its siblings all perform. Covers finding a guarded anchor, enumerating structural peers, diffing guard-for-guard by what each actually enforces, and confirming the unguarded peer is reachable with attacker input.
auditing-mcp-tool-integrations
Red-team the tool layer of an AI agent: the tool definitions, metadata, and outputs that a model reads and trusts. Covers tool poisoning (instructions hidden in a tool's description), tool shadowing and name collisions, rug-pulls (definitions that change after approval), line jumping (metadata acting before any call), token and credential passthrough, and tool-output injection. Use when adding or reviewing a tool, an MCP server, or a tool-marketplace entry, or when auditing an agent's tool manifest. The model reads every tool description as input; treat all of it as untrusted instruction surface.
auditing-ml-model-supply-chain
Audit the machine-learning models you load as untrusted code, not just data. Covers deserialization RCE from unsafe checkpoint formats (a model file that runs code on load), poisoned or backdoored weights, tampered or trojaned models pulled from a public hub, name and version confusion for model artifacts, and skipped integrity verification. Use when adding a model, checkpoint, or weights file to a pipeline, reviewing where models are loaded, or vetting a third-party model. A model file is executable input until you prove otherwise.
auditing-saml-and-oidc-flows
Audit federated single sign-on for the flaws that let an attacker forge or replay an identity: signature wrapping and signature stripping on signed assertions, unsigned or unverified tokens accepted, redirect_uri and audience manipulation, missing state and nonce allowing replay and cross-site request forgery, and identity confusion where one provider's assertion is honored for another account. Use when reviewing a SAML or OIDC integration, an identity-provider connection, or any login that trusts an external assertion. The verification step is the target.
auditing-the-lethal-trifecta
Find where an AI agent becomes dangerous: the trust context in which access to private data, exposure to untrusted content, and an ability to send data out all coexist. Any two legs are usually safe; all three let planted content make the agent read secrets and exfiltrate them. Use when designing or reviewing a tool-using LLM agent, before granting it a new tool or data scope, or to judge whether a prompt injection is actually exploitable. Covers capability inventory, the three legs, kill-chain construction, and which leg to cut.
detecting-memory-safety-bugs
Find memory-safety bugs in C/C++ and other unmanaged code - use-after-free, double-free, out-of-bounds read/write, uninitialized use, and NULL deref - by reasoning about object lifetime and buffer bounds along real code paths. Use on an authorized source target when a candidate catalog does NOT model these temporal/lifetime classes (most don't), so a keyword or sink scan will miss them; when reviewing allocators, parsers, buffer handling, or refcounting. Pairs the lifetime/bounds reasoning with source→sink confirmation and the shared finding schema.
detecting-race-conditions
Find concurrency and time-of-check/time-of-use bugs - TOCTOU, unsynchronized shared state, check-then-act, and atomicity violations - by reasoning about what state is shared, what can interleave, and where a window opens between a check and its use. Use on an authorized source target when the risk is ordering, not a single tainted value; when reviewing multithreaded code, shared caches/counters, filesystem checks, or "verify then act" sequences (balance checks, auth-then-use, dedup guards). Confirms each as an interleaving witness and emits the shared finding schema.
evaluating-model-guardrails
Systematically test whether a model's safety and policy guardrails hold under adversarial pressure, as a repeatable evaluation rather than a one-off trick. Covers building a policy-grounded probe set, multi-turn escalation, encoding and obfuscation bypasses, role and context reframing, instruction-hierarchy conflicts, and measuring bypass rate with reproducible graded outcomes. Use when reviewing a model deployment, a system prompt, or a content-safety layer, or before shipping an assistant that must refuse a defined set of requests. A rate, not an anecdote.
exploiting-ssrf-to-cloud-metadata
Adjudicate whether a server-side request-forgery primitive actually reaches high-value internal targets, especially a cloud instance metadata endpoint that hands out credentials. Covers proving the fetch is attacker-steered, reaching link-local and internal addresses, defeating allowlist and parser-based filters through DNS rebinding and URL confusion, retrieving instance credentials, and blind out-of-band confirmation. Use when a feature fetches a URL, host, or address the user can influence, or when triaging an SSRF lead for real impact.
extracting-nday-from-a-patch
Turn a security patch or version diff into fresh findings: infer the fixed vulnerability from what the fix changed, reconstruct the pre-patch bug, then hunt the paths the fix did not cover and the same bug in code it never touched. Use when you have a fix commit, a vague advisory with a linked diff, a version bump, or a "security release" and want to know what it silently fixed and what it missed. Covers reading a fix as a treasure map, incomplete-fix analysis, and variant discovery in the same tree and its forks.
finding-crypto-misuse
Find exploitable cryptographic misuse, not theoretical weakness: reused nonces (stream and counter/GCM keystream reuse, ECDSA private-key recovery from a repeated per-signature secret), padding oracles that decrypt ciphertext, hash length-extension on naive MAC constructions, predictable or reused IVs and keys, and a hash chosen for the wrong job. Use when reviewing code that encrypts, signs, authenticates, or hashes, or when a protocol rolls its own crypto. The finding is a concrete recovery or forgery, not "weak algorithm."
finding-fail-open-flaws
Find security controls that grant access when they should deny it: an authorization check that returns allow on error or timeout, an empty or wildcard allowlist that matches everything, a default-allow branch when input is missing or unrecognized, and a caught exception that swallows a denial and continues. Use when reviewing authentication, authorization, or any gate whose failure path matters, or when a check "passes" for reasons you have not confirmed. The dangerous default is allow; prove every gate denies by default.
hunting-bug-variants
Given one confirmed vulnerability, systematically find its siblings: the same defect shape repeated elsewhere in the codebase, and the parts of it the fix left uncovered. Use right after you confirm or read about a bug (your own finding, a CVE, a patch, a writeup) and want the other instances instead of stopping at one. Turns a single seed into a structural signature and sweeps the whole tree for same-shape code, copy-paste clones, sibling handlers, and incomplete fixes. Covers signature extraction, the variant sweep, and adjudicating each candidate.
hunting-bugs-with-a-code-graph
Hunt security bugs across a whole codebase by reasoning over its structure (call graph and dataflow) instead of grepping for keywords. Use when you have source access to an authorized target (your own code, an OSS project, or an in-scope engagement) and want systematic coverage of a bug taxonomy rather than a single hunch; when the question is "who calls this, what reaches this sink, which peer function is unguarded." Orients on an unfamiliar codebase, enumerates the full bug taxonomy before drilling in, and turns structural leads into decided findings.
hunting-business-logic-flaws
Hunt for vulnerabilities that live in what an application is allowed to do, not in how it is coded: workflow steps that can be skipped or reordered, quantity/price/limit values that go negative or overflow a cap, state transitions that should be unreachable, replay and concurrency abuse, and privileged outcomes reached through a sequence of individually-valid requests. Use when reviewing checkout, transfers, redemption, quotas, or any rule the code enforces implicitly. These are the flaws static analysis and scanners structurally miss.
hunting-iam-privilege-escalation-paths
Hunt privilege-escalation paths in cloud identity and access management: a low-privileged principal that chains role assumptions, policy rewrites, role-passing, and over-broad trust relationships to reach an administrative or data-access principal. Covers the identity-to-permission-to-resource graph, the known escalation primitives (passing a more privileged role to a service, rewriting a policy to a permissive version, assuming a role whose trust condition is too loose), and the boundary controls that should stop the chain. Use when reviewing cloud IAM, role and policy configuration, or an identity graph. A reachable path from an untrusted principal to admin is the finding.
hunting-non-human-identity-and-secret-reachability
Hunt machine credentials that are live, over-privileged, and actually reachable, not just present. Covers non-human identities and secrets across code, configuration, and infrastructure definitions: API keys, service-account credentials, and long-lived tokens. Separates a secret that merely exists from one an attacker can reach and use, and adjudicates each by whether it is still valid, how much it grants, and whether an untrusted path leads to it. Use when reviewing secret exposure, machine identities, or the blast radius of a leaked credential, and when a scanner reports many secrets and you need to know which ones matter. A reachable, live, over-privileged credential is the finding.
hunting-supply-chain-risks
Hunt for the ways an attacker gets code into your build without touching your repo: dependency confusion (a public package shadowing an internal name), typosquatting and slopsquatting (a package named after a model's hallucination), poisoned pipeline execution (untrusted input running as a build step), and over-privileged or injectable CI. Use when reviewing a build pipeline, a dependency manifest, an internal package registry, or a CI/CD configuration. The app code can be clean while the artifact you ship is not.
mapping-attack-surface
Map and prioritize the attack surface of an authorized black-box web target before testing it - enumerate hosts, endpoints, parameters, auth flows, and technologies, then order them by where bugs actually live. Use at the start of an in-scope engagement or bug-bounty target when you have a URL/app but no source, and need a systematic surface inventory instead of poking random endpoints; when you need to know what to test first. Enforces a scope gate and produces a prioritized surface inventory that feeds the vuln-class skills.
red-teaming-multi-agent-systems
Test a system of multiple cooperating AI agents for attacks that exist only because agents message, spawn, and delegate to each other. Covers agent-to-agent injection (agent-in-the-middle), delegation abuse and recursive loops, orchestrator injection, confused-deputy across a trust boundary, identity spoofing between agents, capability collusion, and denial-of-wallet. Use when reviewing an orchestrator, a crew or swarm, agent-to-agent messaging, or any pipeline where one agent's output becomes another agent's input. Every internal edge where output becomes instruction is an injection channel.
Showing top 100 of 119 skills by quality score. Browse the full catalog at /browse.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.