UnboundCompute
OrganizationSecurity-testing methodology as portable, tool-agnostic agent skills for Claude Code and any agent runtime: white-box bug hunting, AI-agent and LLM red-teaming, supply-chain risk, and appsec depth.
Categories
Indexed Skills (45)
auditing-graphql-attack-surface
Audit the attack surface a GraphQL API exposes that a plain endpoint does not: schema introspection left open, unbounded query depth and recursion, aliasing and field duplication that multiply cost, query batching that defeats rate limits and enables brute force, field-level authorization that a resolver skips even when the object check passed, and mutations reached without the guard their action needs. Covers the query and variables as the source, the resolver and the data or work it triggers as the sink, and the missing depth, cost, batch, or field guard as the bug. Use when reviewing a GraphQL schema, its resolvers, or a gateway that fronts one. Introspection and cost limits are one audit; per-field and per-mutation authorization is the other.
auditing-ssh-trust-and-agent-forwarding
Audit secure-shell trust hygiene, not cipher hardening: a forwarded authentication agent a remote host can abuse to log in as you elsewhere, client configuration or a proxy-command directive influenced by an untrusted source, host-key verification disabled or blind-accepted so a machine-in-the-middle succeeds, and authorized-key entries whose forced command can be escaped or whose source and forwarding are unrestricted. Covers agent-socket exposure on multi-user or untrusted hosts, config and proxy-command injection from attacker-controlled data, trust-on-first-use gaps, and permissive key options. Use when auditing how hosts and users establish secure-shell trust and what a compromised endpoint can reach. The forwarded socket, injected directive, or unverified key is the source, authentication or command execution as an unintended identity is the sink.
enumerating-snmp-exposure
Enumerate network-management exposure through the simple network-management protocol: default and guessable community strings, weak or downgradeable versions, read views that leak interface tables, routing and neighbor data, running configuration, process and user lists and sometimes credentials, and writable objects that let you change device state. Covers guessable read and write community strings, version-one and version-two exposure where authentication is a shared string sent in the clear, weak version-three auth, and over-broad views that disclose or mutate more than management needs. Use when auditing network devices, printers, appliances, or hosts that answer management queries. The community string or weak credential is the source, the disclosed data or writable object is the sink.
hunting-broken-object-level-authorization
Hunt broken object-level authorization (BOLA, also called IDOR): endpoints that accept a client-supplied object reference - a numeric id, UUID, key, slug, filename, or an id nested in a request body or token - and read or mutate that object without checking the authenticated caller is entitled to it. Covers direct references, enumerable and guessable ids, references buried in nested or batch payloads, second-order ids stored then trusted later, and ownership checks that run on one path but not its siblings. Use when reviewing any API or handler that fetches or changes a record by an id the client controls. The reference is the source, the data access is the sink, and the missing owner binding is the bug.
hunting-dynamic-linker-hijacks
Hunt local privilege escalation and code execution through the dynamic loader: a preload environment variable honored across a privilege boundary, a writable directory on the runtime library search path, an embedded run-path that points at a writable or origin-relative location, and libraries loaded by an unqualified name. Covers preload variables that survive a privilege transition through a service manager or delegation rule, world- or group-writable library directories a privileged binary searches, run-path entries relative to a writable component, and dynamic loads of a short name. Use when auditing a privileged binary, service, or image for loader-based hijacking. The attacker-controlled library or variable is the source, the loader mapping it into the privileged process is the sink, and the unstripped or writable search path is the bug.
hunting-mass-assignment-and-property-authz
Hunt mass assignment and broken object-property authorization: handlers that bind a client request payload straight onto a record or model and let the caller write fields it should never control - role, is_admin, owner_id, tenant, price, balance, verified, status, or another user's foreign key. Covers auto-binding and hydration that take the whole payload, blocklist filters that miss a field, nested and relation fields that reopen the hole, type juggling that flips a flag, and read paths that return properties the caller should not see. Use when reviewing any create or update handler that maps request fields onto a persisted object. The payload field is the source, the record write is the sink, and the server-controlled property is the bug.
hunting-scheduled-job-and-search-path-hijacks
Hunt local privilege escalation through scheduled jobs and the paths privileged processes trust: periodic and timer jobs whose script, or a file or directory they read, is writable by a lower-privileged user; commands invoked by an unqualified name resolved through a writable search-path entry; and argument injection where a command expands a shell wildcard over a directory an attacker can write to, so a file named like an option (a leading-dash filename) becomes a command-line flag. Covers writable job scripts, writable directories on an effective path, relative command execution, and the filename-as-flag wildcard trick. Use when auditing a host or image for local escalation through automation. The writable input is the source, execution as the job's identity is the sink.
hunting-setuid-and-capability-escalation
Hunt local privilege escalation through setuid and setgid binaries and per-file capabilities: programs that run as a more privileged identity, or files granted a capability such as changing user id, overriding file permissions, raw disk or memory access, or loading kernel modules, that expose an exec, file-read, file-write, or library-load primitive an unprivileged caller can reach. Covers known dangerous tools left with the bit set, custom or bundled setuid programs that shell out or trust a writable path, and over-broad capabilities that are privilege in all but name. Use when auditing a host, image, or package for local privilege escalation. The elevated identity is the source, the primitive it exposes is the sink, and the missing confinement is the bug.
testing-smtp-smuggling-and-email-spoofing
Test a mail setup for sender spoofing that survives authentication: SPF, DKIM, and DMARC records that exist but do not align or enforce, subdomains left unprotected, and the end-of-data desync known as SMTP smuggling, where an inbound and an outbound mail server disagree on where one message ends so a second message with a forged, auth-passing sender is smuggled in. Covers policy present but not enforced, alignment gaps between the envelope and header sender, missing subdomain policy, open relay, and inconsistent message-boundary parsing between hops. Use when auditing a domain's mail authentication or a mail server's boundary handling. The crafted or smuggled message is the source, an accepted spoofed delivery is the sink.
adjudicating-dependency-cve-reachability
Decide whether a CVE in a dependency actually exposes your application before you scramble to patch: is the vulnerable function on a real call path from your code, do the trigger preconditions hold, and can an attacker control the input that reaches it. Use when an advisory, SCA scan, or dependency bot flags a CVE and you must separate a genuine exposure from unreachable noise, or justify why you are or are not affected. Covers pinning the vulnerable symbol, call-path reachability, precondition checks, and taint from your entry points.
adjudicating-taint-paths
Decide whether a whitebox lead is a real bug by tracing taint from an untrusted source to a dangerous sink and confirming every hop against live source. Use after a scanner, a candidate list, or your own reading surfaces a "this looks dangerous" sink (SQL exec, system/exec, file open, deserialize, template render, redirect target, memcpy) and you must decide whether attacker- controlled input actually reaches it - or kill the lead with evidence. Covers forward and reverse taint, witness paths, sanitizer analysis, and the evidence rules that separate a finding from a false positive.
auditing-ai-agent-permissions
Audit what an AI agent is actually allowed to do versus what its task needs. Covers excessive agency (tools, scopes, and autonomy beyond the job), missing human-in-the-loop gates on irreversible actions, over-broad credentials and their blast radius, sandbox and code-interpreter escape, unfiltered egress, and unbounded resource or spend (denial-of-wallet). Use when granting an agent a tool or scope, reviewing an agent's permission posture, or deciding which actions need approval. The model's restraint is not a control; permissions are.
auditing-cicd-oidc-trust
Audit continuous-integration pipelines for the trust they extend to untrusted input: workflows that run on incoming change requests from forks while holding repository secrets, steps that let attacker-controlled content reach a privileged command, and cloud role trust conditions that accept a pipeline's short-lived token too broadly. Covers secret and token exposure on fork-triggered runs, poisoned-pipeline execution, and over-broad trust on the identity claim a pipeline presents to a cloud account. Use when reviewing CI/CD configuration, pipeline identity, or the boundary between a build and the cloud it can reach. An exploitable token or command from untrusted input is the finding.
auditing-declarative-authorization
Audit authorization expressed as configuration or framework convention rather than inline code: row-level security and policy rules, framework before-action and middleware filters that must be attached to every protected route, serverless and gateway access rules, and object-ownership checks. Covers routes that skip the filter, policies with a permissive default, rules that check authentication but not ownership, and gaps between where the rule is declared and where the data is accessed. Use when reviewing role- or policy-driven access control. Coverage and correctness are separate checks.
auditing-guard-gaps
Find the missing-check bug by comparing sibling functions that reach the same sink - one validates its input, its peer does not. Use on an authorized source target to surface broken access control, missing bounds checks, and skipped sanitization that linear file-reading hides; when you suspect one handler in a family forgot the check its siblings all perform. Covers finding a guarded anchor, enumerating structural peers, diffing guard-for-guard by what each actually enforces, and confirming the unguarded peer is reachable with attacker input.
auditing-mcp-tool-integrations
Red-team the tool layer of an AI agent: the tool definitions, metadata, and outputs that a model reads and trusts. Covers tool poisoning (instructions hidden in a tool's description), tool shadowing and name collisions, rug-pulls (definitions that change after approval), line jumping (metadata acting before any call), token and credential passthrough, and tool-output injection. Use when adding or reviewing a tool, an MCP server, or a tool-marketplace entry, or when auditing an agent's tool manifest. The model reads every tool description as input; treat all of it as untrusted instruction surface.
auditing-ml-model-supply-chain
Audit the machine-learning models you load as untrusted code, not just data. Covers deserialization RCE from unsafe checkpoint formats (a model file that runs code on load), poisoned or backdoored weights, tampered or trojaned models pulled from a public hub, name and version confusion for model artifacts, and skipped integrity verification. Use when adding a model, checkpoint, or weights file to a pipeline, reviewing where models are loaded, or vetting a third-party model. A model file is executable input until you prove otherwise.
auditing-saml-and-oidc-flows
Audit federated single sign-on for the flaws that let an attacker forge or replay an identity: signature wrapping and signature stripping on signed assertions, unsigned or unverified tokens accepted, redirect_uri and audience manipulation, missing state and nonce allowing replay and cross-site request forgery, and identity confusion where one provider's assertion is honored for another account. Use when reviewing a SAML or OIDC integration, an identity-provider connection, or any login that trusts an external assertion. The verification step is the target.
auditing-the-lethal-trifecta
Find where an AI agent becomes dangerous: the trust context in which access to private data, exposure to untrusted content, and an ability to send data out all coexist. Any two legs are usually safe; all three let planted content make the agent read secrets and exfiltrate them. Use when designing or reviewing a tool-using LLM agent, before granting it a new tool or data scope, or to judge whether a prompt injection is actually exploitable. Covers capability inventory, the three legs, kill-chain construction, and which leg to cut.
detecting-memory-safety-bugs
Find memory-safety bugs in C/C++ and other unmanaged code - use-after-free, double-free, out-of-bounds read/write, uninitialized use, and NULL deref - by reasoning about object lifetime and buffer bounds along real code paths. Use on an authorized source target when a candidate catalog does NOT model these temporal/lifetime classes (most don't), so a keyword or sink scan will miss them; when reviewing allocators, parsers, buffer handling, or refcounting. Pairs the lifetime/bounds reasoning with source→sink confirmation and the shared finding schema.
detecting-race-conditions
Find concurrency and time-of-check/time-of-use bugs - TOCTOU, unsynchronized shared state, check-then-act, and atomicity violations - by reasoning about what state is shared, what can interleave, and where a window opens between a check and its use. Use on an authorized source target when the risk is ordering, not a single tainted value; when reviewing multithreaded code, shared caches/counters, filesystem checks, or "verify then act" sequences (balance checks, auth-then-use, dedup guards). Confirms each as an interleaving witness and emits the shared finding schema.
evaluating-model-guardrails
Systematically test whether a model's safety and policy guardrails hold under adversarial pressure, as a repeatable evaluation rather than a one-off trick. Covers building a policy-grounded probe set, multi-turn escalation, encoding and obfuscation bypasses, role and context reframing, instruction-hierarchy conflicts, and measuring bypass rate with reproducible graded outcomes. Use when reviewing a model deployment, a system prompt, or a content-safety layer, or before shipping an assistant that must refuse a defined set of requests. A rate, not an anecdote.
exploiting-ssrf-to-cloud-metadata
Adjudicate whether a server-side request-forgery primitive actually reaches high-value internal targets, especially a cloud instance metadata endpoint that hands out credentials. Covers proving the fetch is attacker-steered, reaching link-local and internal addresses, defeating allowlist and parser-based filters through DNS rebinding and URL confusion, retrieving instance credentials, and blind out-of-band confirmation. Use when a feature fetches a URL, host, or address the user can influence, or when triaging an SSRF lead for real impact.
extracting-nday-from-a-patch
Turn a security patch or version diff into fresh findings: infer the fixed vulnerability from what the fix changed, reconstruct the pre-patch bug, then hunt the paths the fix did not cover and the same bug in code it never touched. Use when you have a fix commit, a vague advisory with a linked diff, a version bump, or a "security release" and want to know what it silently fixed and what it missed. Covers reading a fix as a treasure map, incomplete-fix analysis, and variant discovery in the same tree and its forks.
finding-crypto-misuse
Find exploitable cryptographic misuse, not theoretical weakness: reused nonces (stream and counter/GCM keystream reuse, ECDSA private-key recovery from a repeated per-signature secret), padding oracles that decrypt ciphertext, hash length-extension on naive MAC constructions, predictable or reused IVs and keys, and a hash chosen for the wrong job. Use when reviewing code that encrypts, signs, authenticates, or hashes, or when a protocol rolls its own crypto. The finding is a concrete recovery or forgery, not "weak algorithm."
finding-fail-open-flaws
Find security controls that grant access when they should deny it: an authorization check that returns allow on error or timeout, an empty or wildcard allowlist that matches everything, a default-allow branch when input is missing or unrecognized, and a caught exception that swallows a denial and continues. Use when reviewing authentication, authorization, or any gate whose failure path matters, or when a check "passes" for reasons you have not confirmed. The dangerous default is allow; prove every gate denies by default.
hunting-bug-variants
Given one confirmed vulnerability, systematically find its siblings: the same defect shape repeated elsewhere in the codebase, and the parts of it the fix left uncovered. Use right after you confirm or read about a bug (your own finding, a CVE, a patch, a writeup) and want the other instances instead of stopping at one. Turns a single seed into a structural signature and sweeps the whole tree for same-shape code, copy-paste clones, sibling handlers, and incomplete fixes. Covers signature extraction, the variant sweep, and adjudicating each candidate.
hunting-bugs-with-a-code-graph
Hunt security bugs across a whole codebase by reasoning over its structure (call graph and dataflow) instead of grepping for keywords. Use when you have source access to an authorized target (your own code, an OSS project, or an in-scope engagement) and want systematic coverage of a bug taxonomy rather than a single hunch; when the question is "who calls this, what reaches this sink, which peer function is unguarded." Orients on an unfamiliar codebase, enumerates the full bug taxonomy before drilling in, and turns structural leads into decided findings.
hunting-business-logic-flaws
Hunt for vulnerabilities that live in what an application is allowed to do, not in how it is coded: workflow steps that can be skipped or reordered, quantity/price/limit values that go negative or overflow a cap, state transitions that should be unreachable, replay and concurrency abuse, and privileged outcomes reached through a sequence of individually-valid requests. Use when reviewing checkout, transfers, redemption, quotas, or any rule the code enforces implicitly. These are the flaws static analysis and scanners structurally miss.
hunting-iam-privilege-escalation-paths
Hunt privilege-escalation paths in cloud identity and access management: a low-privileged principal that chains role assumptions, policy rewrites, role-passing, and over-broad trust relationships to reach an administrative or data-access principal. Covers the identity-to-permission-to-resource graph, the known escalation primitives (passing a more privileged role to a service, rewriting a policy to a permissive version, assuming a role whose trust condition is too loose), and the boundary controls that should stop the chain. Use when reviewing cloud IAM, role and policy configuration, or an identity graph. A reachable path from an untrusted principal to admin is the finding.
hunting-non-human-identity-and-secret-reachability
Hunt machine credentials that are live, over-privileged, and actually reachable, not just present. Covers non-human identities and secrets across code, configuration, and infrastructure definitions: API keys, service-account credentials, and long-lived tokens. Separates a secret that merely exists from one an attacker can reach and use, and adjudicates each by whether it is still valid, how much it grants, and whether an untrusted path leads to it. Use when reviewing secret exposure, machine identities, or the blast radius of a leaked credential, and when a scanner reports many secrets and you need to know which ones matter. A reachable, live, over-privileged credential is the finding.
hunting-supply-chain-risks
Hunt for the ways an attacker gets code into your build without touching your repo: dependency confusion (a public package shadowing an internal name), typosquatting and slopsquatting (a package named after a model's hallucination), poisoned pipeline execution (untrusted input running as a build step), and over-privileged or injectable CI. Use when reviewing a build pipeline, a dependency manifest, an internal package registry, or a CI/CD configuration. The app code can be clean while the artifact you ship is not.
mapping-attack-surface
Map and prioritize the attack surface of an authorized black-box web target before testing it - enumerate hosts, endpoints, parameters, auth flows, and technologies, then order them by where bugs actually live. Use at the start of an in-scope engagement or bug-bounty target when you have a URL/app but no source, and need a systematic surface inventory instead of poking random endpoints; when you need to know what to test first. Enforces a scope gate and produces a prioritized surface inventory that feeds the vuln-class skills.
red-teaming-multi-agent-systems
Test a system of multiple cooperating AI agents for attacks that exist only because agents message, spawn, and delegate to each other. Covers agent-to-agent injection (agent-in-the-middle), delegation abuse and recursive loops, orchestrator injection, confused-deputy across a trust boundary, identity spoofing between agents, capability collusion, and denial-of-wallet. Use when reviewing an orchestrator, a crew or swarm, agent-to-agent messaging, or any pipeline where one agent's output becomes another agent's input. Every internal edge where output becomes instruction is an injection channel.
reviewing-ai-generated-code
Security-review discipline for code a language model wrote or completed: the failure patterns that show up more often in generated code and the review method that catches them. Covers hallucinated and confusable dependencies, insecure defaults and missing validation carried from training data, propagated vulnerable patterns, over-broad or fabricated permissions, and plausible-looking code that does not do what it claims. Use when reviewing an AI-authored change, an assistant's suggestion, or a large generated diff. Fluent is not correct.
testing-agents-for-indirect-prompt-injection
Test whether an AI agent obeys instructions hidden in the content it ingests, rather than only the user's. Enumerate every channel through which untrusted content reaches the model context (retrieved docs, fetched pages, uploaded files, emails, tool outputs, filenames, images and PDFs, other agents), plant channel-appropriate payloads, and measure whether they change the agent's actions. Use when reviewing any agent or LLM app that reads external content and can act. Covers channel enumeration, overt and covert payloads, canary observables, and impact via the trifecta.
testing-client-side-dom-vulnerabilities
Test the vulnerabilities that live entirely in the browser, where the server is never the sink: DOM-based cross-site scripting from client-side sinks, DOM clobbering, prototype pollution that corrupts application logic, unsafe cross-window messaging, client-side path and open-redirect handling, and cross-origin information leaks. Use when reviewing a single-page app, heavy client-side JavaScript, a browser extension, or any code that reads attacker-influenceable input and writes it into the DOM, a sink, or a shared object. The taint never reaches the server.
testing-llm-insecure-output-handling
Test what happens after the model speaks: whether an application trusts model output and passes it, unescaped, into a browser, a terminal, a shell, a database, or another system. Covers model-driven XSS and markup injection, data exfiltration through rendered markdown images and links, terminal and ANSI escape injection, invisible-unicode and ascii smuggling in output, and output used to build code, SQL, or shell commands. Use when reviewing any app that renders, executes, or forwards LLM output. The model's output is an untrusted string.
testing-rag-and-memory-poisoning
Test whether an attacker can plant content in the knowledge an AI agent later retrieves and trusts: a RAG index or vector store, an agent's persistent memory, or the search and web results it pulls at runtime. Covers poisoned documents that surface as authoritative context, memory entries that persist across sessions, retrieval-ranking abuse, and injected instructions that ride retrieved chunks. Use when reviewing a RAG pipeline, an agent with long-term memory, or any retrieval step feeding the model. The poison fires on an innocent query.
testing-request-smuggling
Test whether a chain of HTTP servers disagrees about where one request ends and the next begins, letting an attacker smuggle a request past the front end into the back end. Covers front-end and back-end desync from conflicting length signals, connection-reuse poisoning, single-packet and timing detection, and adjacent boundary confusion where a proxy and origin parse framing differently. Use when reviewing a reverse proxy, load balancer, CDN, or any multi-hop HTTP path where two parsers sit in series. The bug is a disagreement between parsers, not one flaw.
testing-web-cache-attacks
Test how a caching layer between users and an application can be turned against it: cache poisoning (getting a harmful response stored and served to other users) and cache deception (tricking the cache into storing a victim's private response where the attacker can read it). Covers finding the cache key and unkeyed inputs, identifying cacheable responses, poisoning through unkeyed headers, and deceiving path-based caching into storing authenticated content. Use when reviewing a CDN, a reverse proxy, or any shared HTTP cache in front of an app.
writing-vuln-reports
Turn a confirmed finding into a clear, reproducible vulnerability report a maintainer or triager can act on without a back-and-forth. Use after a finding is confirmed (via the finding schema) and you need a writeup - a bug-bounty submission, a security advisory, an internal ticket, or a disclosure email. Covers the report structure that gets findings fixed, writing a reproduction that actually reproduces, justifying severity honestly, and the disclosure etiquette that keeps you in bounds.
auditing-declared-vs-used-permissions
Find the consent gap in an agent skill or MCP server: the distance between the permissions and capabilities it declares and what its bundled code and instructions actually exercise. Covers over-broad grants a skill requests but never uses, capabilities it exercises without declaring, and grants that are used but still wider than the task needs. Read the declared surface in frontmatter or manifest, inventory the real behavior, and diff the two in both directions. Use when reviewing a skill or server before install, or auditing least privilege across an agent's installed set. An over-broad or undeclared grant is the finding.
auditing-skill-and-mcp-instructions
Lint the natural-language instruction text of an agent skill or MCP server, not its code: the skill body, the frontmatter description, tool descriptions, and parameter text a model reads and obeys. Covers instructions hidden in comments or markup, invisible and look-alike Unicode, override phrases that countermand earlier instructions, concealment directives that tell the agent to hide an action from the user, and instructions that steer the agent to read secrets and send them out. Use when reviewing a skill, an MCP server, or a marketplace entry before trusting it, or auditing what instruction text enters an agent's context. Every word the model reads is instruction surface; a planted instruction is the finding.
vetting-skills-before-install
Vet an agent skill or MCP server before you install it, and reach a clear verdict: install, install with constraints, or deny. Combines an instruction-text audit, a declared-versus-used permission diff, and a bundled-code inspection for secret exfiltration (harvesting environment variables, credential files, or dotfiles and sending them out) and for obfuscation and install-time supply-chain risk (decode-then-execute, download-and-run on install, unpinned fetches). Pin the exact artifact you vet, audit each surface, and record the reason for the verdict. Use whenever adding a third-party skill, server, or marketplace entry to an agent. The verdict plus its evidence is the finding.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.