Security

unboundcompute Skill

Audit a WebSocket endpoint for trust established once at the handshake and never re-checked, so a cross-site page or a post-handshake message drives a privileged action, after the origin check and the credential source are resolved. Covers a missing or always-true origin check on the upgrade with ambient-cookie authentication, authentication at the handshake with no per-message authorization, a message treated as transport into a downstream injection sink, an unbounded frame or connection allowance inviting denial of service, tunneling past HTTP-layer controls that inspect only the request, and sensitive data broadcast to under-scoped subscribers. Use when reviewing the upgrade handler, the per-message dispatch, and the origin and credential checks, not the wss certificate validation the transport skill owns. A cross-origin or unauthenticated handshake is the source, a privileged action reached over the socket is the sink, and trust checked only at the upgrade is the bug.

unboundcompute Skill

Audit the lifecycle of API keys and access tokens for weaknesses that let one keep working past its intended bounds: a key issued with broader scope than the caller needs so a leak grants far more than one function, a key or token with no expiry that stays valid indefinitely, a revocation path that does not actually stop the key so a rotated or compromised credential keeps authenticating, a key that leaks into logs, URLs, client-side code, or error messages and is never rotated, and a token whose scope or audience is not enforced on use so it works against endpoints it was never meant for. Use when a long-lived programmatic credential authenticates a caller and the bounds on that credential (scope, expiry, revocability) are the boundary. The over-scoped, unexpiring, or leaked key is the source, the access it grants past its intended bounds is the sink, and the missing scope limit, expiry, or working revocation is the bug.

unboundcompute Skill

Audit the code and configuration that decide cross-origin access, for trust a browser turns into a read of authenticated data. Covers a response that reflects an arbitrary request origin into the allow-origin header alongside allow-credentials, an allowlist that accepts the null origin, allowlist matching by prefix, suffix, substring, or an unanchored pattern that a lookalike origin satisfies, the origin header trusted as an authorization or request-forgery defense, and a cross-window message handler that acts on data without an exact origin and source check. Scoped to the code and config that build the decision, not a live-header scan. Use when reviewing cross-origin response headers, origin-based access logic, or cross-window message handlers. The request origin or the posted message is the source, the credentialed cross-origin read or the message sink is the sink, and trusting an attacker-set origin is the bug.

unboundcompute Skill

Audit in-memory and cache datastores such as Redis and memcached for exposure and command abuse: an instance reachable without authentication, a request that composes datastore commands from untrusted input, or server-side scripting and module or config commands that reach code execution or a file write. Covers unauthenticated network exposure, command injection where input becomes a command rather than a value, Lua or scripting evaluation on untrusted input, and dangerous administrative commands that rewrite the on-disk file or load a module. Use when an application talks to a cache or key-value store and either the instance is network-reachable or untrusted input reaches the command layer. The untrusted input or the open port is the source, the datastore command interface is the sink, and the unauthenticated access or the composed dangerous command is the bug.

unboundcompute Skill

Audit container task credential and metadata boundaries in orchestrated compute such as ECS: a workload that can reach the container credential endpoint or the host instance metadata service to obtain a role broader than the task needs, a task role over-scoped for the workload, a sidecar or co-located container sharing the same credentials, and a server-side request path inside the task that reaches the metadata endpoint. Covers the task credential relative URI, the instance metadata service reachable from a task, and the blast radius when one container in a task is compromised. Use when containerized workloads assume a task or instance role and the metadata endpoints are the boundary. The reachable metadata endpoint is the source, the credential it returns is the sink, and the role wider than the task's need is the bug.

unboundcompute Skill

Audit security-sensitive values for weak randomness: a non-cryptographic generator, a predictable or constant seed, a reused nonce or initialization vector, or an output too short to resist guessing, feeding a value whose only defense is unpredictability. Covers session and authentication tokens, password-reset and verification links, cross-site-request tokens and one-time codes, and cryptographic nonces or initialization vectors, drawn from a statistical generator instead of a cryptographic one, seeded from a timestamp or a constant, reused across messages under one key, or truncated into a space small enough to brute-force. Scoped to the randomness, seed, nonce lifecycle, and entropy length, not the choice of cipher, mode, or hash, which a separate skill covers. Use when a generated value gates access or protects a message. The generator is the source, the security-sensitive value is the sink, and predictability between them is the bug.

unboundcompute Skill

Stress detection-as-code rules the way an attacker who has read them would: a rule keyed on one literal spelling of an action that a casing, quoting, whitespace, path, flag-ordering, or encoding variant slips past, a left-anchored or misplaced-wildcard match defeated by added noise, an exclusion or allowlist keyed on a field the attacker sets, and a rule over telemetry the log source never actually emits. Covers matching the spelling instead of the behavior, anchor and wildcard placement, self-defeating negation, and coverage gaps in the underlying events. Use when reviewing or threat-modeling detection content for brittleness rather than authoring it. The attacker-set field is the source, the rule's match decision is the guard, and a malicious event that performs the action yet does not match is the finding.

unboundcompute Skill

Audit state-changing endpoints for cross-site request forgery, where a request that rides the victim's ambient cookies is authorized on that session alone with no unpredictable, session-bound proof the request came from the app, letting an attacker page trigger the change as the victim. Use when reviewing forms and actions that modify data, change settings, move funds, or alter access, and how each is protected. Covers missing or unvalidated tokens, tokens not bound to the session, cookie-only same-site reliance and its gaps, state-changing GET requests, and content-type or method-override assumptions. The cross-site request on the victim's session is the source, the state-changing endpoint is the sink, and acting without unpredictable session-bound proof of origin is the bug.

unboundcompute Skill

Audit trust placed in group policy content and the domain policy share, where a low-privileged principal can write a policy object, its files on the domain share, or its link, causing that policy to run scripts, set scheduled tasks, install software, or change security settings on every machine the policy applies to, or where a stored credential or an unsigned policy file lets any domain user act on the policy. Use when policy objects, their share files, or their links may be writable by non-administrators or carry stored secrets. Covers writable policy content, writable links and scope, embedded credentials, and unsigned or world-readable policy files. The low-privileged write to policy content or link is the source, the machines applying the policy are the sink, and running attacker-chosen policy on those machines is the bug.

unboundcompute Skill

Audit whether an application actually records the security events an investigation would need, and whether the logs themselves leak or lie: a security decision (authentication, an authorization denial or sensitive grant, a credential or privilege change, access to sensitive data) that fires with no durable record, an audit entry missing the actor, target, or outcome, secrets or personal data flowing into a widely-readable log, and untrusted input written to a log without neutralizing line breaks so entries can be forged. Covers coverage gaps at the decision points, record sufficiency and tamper-resistance, log-as-disclosure, and log injection. Use when assessing whether the code emits the security signal downstream detection and forensics depend on. The security action or the secret is the source, the audit or log sink is the sink, and the missing or unsafe record is the finding.

unboundcompute Skill

Audit a smart contract for a privileged action any caller can reach, so an attacker invokes a function that should be restricted. Covers a state-changing or fund-moving function missing an authorization modifier, an ownership or role check that is wrong or bypassable, an unprotected initializer that lets an attacker seize ownership of a proxy or an uninitialized contract, a delegatecall to an attacker-supplied or upgradeable target that runs foreign code in this contract's context, a self-destruct or upgrade reachable without the right role, and a role granted to an address that should not hold it. Use when the fix would add or repair an authorization check, not reorder effects before interactions (that is the reentrancy skill). The attacker calling a privileged function is the source, the restricted action executing for them is the sink, and a missing or defeated authorization check is the bug.

unboundcompute Skill

Audit a web application for UI-redressing attacks where an attacker frames the real site and tricks a user into acting on it unknowingly: a sensitive page that can be embedded in an attacker's iframe because it lacks frame-ancestors or X-Frame-Options, a state-changing action reachable by a single click that an overlay or transparent frame steers, a drag-and-drop or keystroke redressing that captures input meant for the attacker page, and a confirmation step that a framed overlay hides. Covers web pages with authenticated, state-changing actions (settings changes, purchases, approvals, connect flows) that could be loaded inside a frame the user cannot see. Use when a sensitive action can be triggered by a click and the page can be framed by another origin, making framing the boundary. The attacker page that frames or overlays the real site is the source, the unknowing state-changing click is the sink, and the missing framing protection or unguarded one-click action is the bug.

unboundcompute Skill

Audit how a service verifies JSON Web Tokens for the classic verification bypasses: an algorithm-confusion attack where a token switches the signing algorithm so a public key is used as a symmetric secret or the algorithm is set to none, a key selected from an attacker-controllable header (a key id, a JWKS URL, or an embedded key) so the token names its own signer, a signature that is decoded but not actually verified, and claims (expiry, issuer, audience) that are parsed but not enforced. Covers services that accept and verify JWTs to authenticate or authorize a caller. Use when a JWT is the credential and its verification is the boundary. The forged or unverified token is the source, the authenticated or authorized action it grants is the sink, and the algorithm confusion, attacker-chosen key, or unverified claim that accepts it is the bug.

unboundcompute Skill

Audit the trust a mobile app places in web content loaded in an embedded WebView, where a native bridge exposes app capabilities to JavaScript, letting web content that the app did not author, remote pages, loaded third-party frames, or attacker-influenced URLs, call native methods, read app data, or act with the app's privileges, because the bridge is exposed to untrusted origins, the loaded content is not origin-restricted, or the bridge methods do not check the caller. Use when a native app embeds a WebView that both loads remote or mixed content and exposes a native interface to script. Covers script-to-native bridges reachable by untrusted content, unrestricted content loading, and bridge methods that trust any caller. The untrusted web content reaching the bridge is the source, the native method it invokes is the sink, and web script driving native capability is the bug.

unboundcompute Skill

Audit federated single sign-on for assertions a relying party should not trust: a SAML response whose signature is not verified over the right element so a wrapped or altered assertion passes, an OIDC ID token whose issuer, audience, or nonce is unchecked, a relying party that accepts an assertion for any user because the subject or email is trusted without binding, and a federation that honors an identity provider or signing key it should not. Covers SAML and OpenID Connect where a relying party consumes assertions or ID tokens minted by an identity provider to authenticate users. Use when login trust crosses from an identity provider to a relying party and assertion validation is the boundary. The forged or misbound assertion is the source, the authenticated session it grants is the sink, and the missing signature, issuer, audience, or binding check that accepts it is the bug.

unboundcompute Skill

Audit how an application issues, rotates, and destroys session identifiers, so an attacker cannot fixate or outlive a session. Covers a session identifier not regenerated at login or privilege change, a logout that clears the client cookie but leaves the server session valid, a session that never expires or has no idle or absolute timeout, an identifier accepted from a URL or a header an attacker can seed, a session cookie missing the secure, http-only, or same-site attributes, and a cookie scoped to a parent domain shared with untrusted subdomains. Use when reviewing authentication, logout, and session-management code and the cookie attributes it sets; it assumes the identifier is unguessable and scopes to lifecycle, not entropy. An attacker who can set or keep a session identifier is the source, the victim authenticating into it is the sink, and a session that is not rotated or invalidated is the bug.

unboundcompute Skill

Audit client code for transport security that is disabled or defeated, so an attacker on the network path can intercept a connection the client believes is protected. Covers verification switched off (a trust-all setting, a permissive flag, an environment override), a custom trust manager or callback that returns success unconditionally, a hostname check that is skipped or always passes, acceptance of an expired or self-signed certificate through a swallowed error, certificate pinning that is absent where required or falls through to accept on failure, and a silent downgrade to cleartext when the handshake fails. Use when reviewing code that opens outbound TLS connections, configures an HTTP or socket client, or installs a custom trust store. An attacker in a man-in-the-middle position is the source, the client accepting a forged certificate is the sink, and validation that does not fail closed is the bug.

unboundcompute Skill

Audit password reset and account recovery flows for the trust that lets an attacker take over an account: a reset token that is guessable, long-lived, reusable, or not bound to the account it was issued for, a recovery path that verifies a weaker factor than login and bypasses multi-factor, a reset link whose host comes from an attacker-controllable header so the token leaks, and a recovery that trusts an unverified email or phone change to redirect the reset. Covers the recovery surface of authentication systems, where resetting a credential or recovering access is the alternate door into an account. Use when an application offers password reset or account recovery and that flow is a path to authentication. The attacker-driven recovery request is the source, the account it takes over is the sink, and the weak token, bypassed factor, or leaked reset link that grants it is the bug.

unboundcompute Skill

Audit an editor or IDE extension for actions it runs on untrusted workspace contents, after the workspace-trust capability and activation events are resolved. Covers a task, debug preLaunchTask, or command that auto-runs on folder open, a tool path or command template read from workspace settings and executed, a workspace-trust bypass where a risky operation runs in restricted mode, a language server that loads or executes a workspace-declared binary, repo-controlled data reaching a shell or task-execution sink, and an extension webview that renders repo content without a content-security policy. Use when reviewing an extension manifest (activation events, the untrusted-workspace capability), its workspace config handling, or its language-server tool resolution. A cloned untrusted repository is the source, an action the extension auto-runs on open is the sink, and repo-controlled code reaching execution without a trust gate is the bug.

unboundcompute Skill

Audit updater and bootloader code for a firmware trust boundary that lets an unsigned or downgraded image be flashed or booted. Covers an update image that reaches a flash write or a boot jump with no signature check between receipt and commit, a verification result that is ignored or inverted, an integrity hash mistaken for an authenticity signature, a signature checked over the wrong or partial bytes or over a different buffer than the one committed, a verification key kept in writable storage or selected by a field in the image, and anti-rollback that is missing or checked before the signature so a known-vulnerable version re-flashes. Use when reviewing code that receives, verifies, flashes, or boots a firmware image. The received image is the source, the flash write or boot jump is the sink, and a verified authenticity check failing to dominate that path is the bug.

unboundcompute Skill

Hunt trust placed in the Host or a forwarded host header and in inconsistently parsed URLs, where the app builds absolute links, keys a cache, routes a request, or matches an allowlist from a header or a parsed URL an attacker can influence or that two components parse differently. Use when a service derives its own external URL from the request, when a cache or router keys on the host, or when a security decision parses a URL. Covers password-reset and verification-link poisoning, cache poisoning, routing to internal virtual hosts, and redirect or fetch allowlist bypass through parser differentials. The attacker-influenced host or ambiguous URL is the source, the link builder, cache key, router, or allowlist parse is the sink, and trusting a host or a parse the attacker controls is the bug.

unboundcompute Skill

Audit HTTP/2 and gRPC edges for framing and multiplexing trust that breaks when a stream is translated or reused: an h2c or HTTP/2-to-HTTP/1.1 downgrade that reintroduces request smuggling, pseudo-header and header handling that lets a stream forge its path or authority, multiplexed streams on one connection whose authentication or rate limit is applied per connection rather than per stream, and a gRPC gateway that trusts metadata or a method name a caller controls. Covers HTTP/2 front ends, gRPC services, and gateways that translate between protocols. Use when an edge terminates or downgrades HTTP/2 or multiplexes gRPC calls and per-stream trust is assumed. The crafted stream or metadata is the source, the back-end request or method it reaches is the sink, and the downgrade or per-connection trust that admits it is the bug.

unboundcompute Skill

Audit just-in-time account provisioning at federated (SAML or OIDC) login for trust misplaced in the assertion that drives it: a first login that creates an account and assigns roles from identity-provider claims (groups, email domain, department) the service never validates, a claim-to-role mapping that grants more privilege than the claim should or defaults new users into a privileged role, an email or domain claim trusted to auto-join a tenant so an attacker with a lookalike address lands inside it, and a JIT update that re-elevates an account on every login from mutable claims. Use when a federated login provisions an account and the mapping from assertion claims to local roles and tenancy is the boundary. The attacker-shaped login assertion is the source, the over-privileged or wrong-tenant provisioned account is the sink, and the unvalidated claim or over-granting role mapping is the bug.

unboundcompute Skill

Audit a service mesh for the trust it claims but does not enforce: a mesh in permissive mode that accepts plaintext alongside mutual TLS so an unauthenticated caller still gets through, an authorization policy that is absent, scoped too narrowly, or defaults to allow, a workload reachable outside the mesh that bypasses the sidecar entirely, and an identity check that trusts a header a caller can set. Covers service meshes where sidecars are supposed to enforce mutual TLS and per-service authorization between workloads. Use when a mesh is the control asserting who may call whom and that calls are authenticated. The unauthenticated or unauthorized caller is the source, the called service is the sink, and the permissive mode or missing authz policy that admits it is the bug.

unboundcompute Skill

Audit single sign-on logout and session revocation for sessions that outlive the event meant to end them: a logout that clears the local application session but never ends the identity-provider session so re-login is silent, a single-logout flow the application ignores so signing out at the identity provider leaves downstream application sessions alive, an access or refresh token that keeps working after logout or after an admin disables the account, a session that survives a password reset or deprovisioning event, and a back-channel logout notification the application never processes. Covers SAML and OIDC single sign-on, single logout, back-channel logout, and token revocation across relying applications. Use when a user, admin, or identity provider ends a session and whether every downstream session and token actually terminates is the boundary. The logout or revocation event is the source, the session or token that keeps working is the sink, and the unpropagated logout or unrevoked token is the bug.

unboundcompute Skill

Audit privilege escalation through Windows access token and privilege abuse, where a process holds a sensitive privilege or can obtain a more privileged token, letting a lower-privileged foothold impersonate a privileged caller, load a driver, take ownership, back up protected files, or debug another process to reach a higher context. Use when a service or process runs with a named sensitive privilege enabled or can receive and impersonate tokens from privileged callers. Covers impersonation privileges, token theft and duplication, and the backup, restore, ownership, load-driver, and debug privileges. The privilege or the capturable privileged token is the source, the operation the privilege authorizes is the sink, and reaching a higher-privileged context from a lower one is the bug.

unboundcompute Skill

Hunt a mobile app for a real credential shipped in the binary or written to storage another party can read, scoped strictly to mobile-specific sinks. Covers a live secret embedded in the app package or its resources, sensitive data written to world-or-sandbox-readable storage without encryption, a secret placed outside the platform keystore where a weaker guard protects it, data cached or logged where another app or a device-level reader reaches it, and a backup or debug path that carries sensitive data off the device. Use when reviewing the app package, its storage writes, and its logging, distinguishing a public identifier from a credential and judging whether the platform sandbox already contains the data. The embedded or stored secret is the source, a party that can read it is the sink, and a real credential exposed beyond its intended reader is the bug.

unboundcompute Skill

Audit message-broker topic and queue authorization for reach a client should not have: a wildcard subscription that receives another tenant's messages, a publish permission broad enough to inject into a control or command topic, a shared broker where topic naming is the only separation between tenants, and a client authenticated to the broker but not authorized per topic so any connection can read or write any topic. Covers MQTT, Kafka, AMQP, and similar brokers where publish and subscribe permissions on topics or queues are the boundary between producers, consumers, and tenants. Use when a broker carries messages across trust boundaries and topic-level authorization is the control. The client publishing or subscribing is the source, the topic or queue it reaches is the sink, and the wildcard or missing per-topic authorization that admits it is the bug.

unboundcompute Skill

Audit redirect and navigation flows where an untrusted return, next, or callback URL, a stored value, or a referer drives a server redirect, a client-side location assignment, or a meta refresh to an attacker-chosen destination, enabling phishing, credential capture on a lookalike page, or theft of an OAuth code or token carried on the redirect. Use when a parameter or stored value controls where a user is sent after login, logout, an action, or an authorization step. Covers protocol-relative and backslash hosts, userinfo and whitespace tricks, and dangerous schemes that a naive allowlist misses. The untrusted target URL is the source, the redirect or navigation is the sink, and sending the user to an attacker-controlled destination is the bug.

unboundcompute Skill

Audit local privilege escalation through Windows inter-process interfaces, where a privileged service exposes a named pipe, remote procedure call endpoint, or local COM server that a lower-privileged caller can reach and that performs a privileged action, impersonates the caller unsafely, or trusts caller-supplied input without authorization, letting a standard user drive privileged behavior. Use when a service listens on a named pipe, an RPC interface, or a COM server reachable by non-administrators. Covers weak interface permissions, unsafe impersonation of a connecting client, missing caller authorization, and privileged actions exposed to low-privileged callers. The lower-privileged call into the interface is the source, the privileged action the service performs is the sink, and driving privileged behavior as a standard user is the bug.

unboundcompute Skill

Hunt exposure of Windows credential material, where secrets that authenticate a user or machine, cached logon verifiers, stored service and task passwords, protected-store secrets, saved connection credentials, and credentials left in memory of a privileged process, are readable by a principal that should not reach them because of a weak permission, an over-privileged token, or storage that does not bind the secret to the intended account. Use when reviewing where Windows keeps authentication secrets and which principals can read each store. Covers cached verifiers, service and scheduled-task secrets, protected-store material, saved credentials, and process memory. The readable credential store or process is the source, the read that recovers usable secret material is the sink, and obtaining a credential the reader was not entitled to is the bug.

unboundcompute Skill

Audit a cross-chain bridge or messaging protocol for misplaced trust in messages that cross chains: a destination contract that accepts a mint or release on a forged or unverified proof of a source-chain event, a message whose signer set or validator quorum can be spoofed or is too small, a message that can be replayed on the destination or across chains for a repeated withdrawal, and a lock-and-mint or burn-and-release accounting that a crafted message pushes out of balance. Covers token bridges, message-passing layers, and any protocol where an action on one chain is authorized by an event claimed to have happened on another. Use when a destination-chain action depends on trusting a source-chain event and that verification is the boundary. The forged or replayed cross-chain message is the source, the unauthorized mint, release, or state change is the sink, and the missing or spoofable source-event verification is the bug.

unboundcompute Skill

Audit how a resource server trusts OAuth access tokens for confusion it should reject: a token minted for one audience accepted by a different service, a scope treated as coarser or finer than it is so a token reaches an operation it was not granted, a token-issuer or authorization-server mix-up where a token from one issuer is honored by a party that trusts another, and a resource server that validates the signature but not the audience, issuer, or scope. Covers OAuth and bearer-token architectures where an access token authorizes a call between a client, an authorization server, and one or more resource servers. Use when a resource server accepts bearer tokens and the audience, issuer, and scope checks are the boundary. The token presented to the wrong audience or beyond its scope is the source, the resource operation it reaches is the sink, and the missing audience, issuer, or scope validation is the bug.

unboundcompute Skill

Hunt the attack surface a firmware image ships by mistake: a secret baked into the binary, a debug or diagnostic interface left enabled, a network service exposed by default, or a privileged command or update path reachable with no authentication. Covers a private key, symmetric key, or backdoor credential compiled into the image and used for authentication, a serial or on-chip debug console that drops to a privileged shell without auth, a management or plaintext service bound to every interface at boot, and a command handler that flashes, reconfigures, or executes from external input before any auth check, including a shell command built from that input. Use when reviewing firmware source, init scripts, and default configuration. The externally reachable interface is the source, the unauthenticated privileged action or the secret disclosure is the sink, and a missing auth gate or an embedded secret is the bug.

unboundcompute Skill

Hunt secrets and abusable configuration shipped inside a mobile app bundle, where the installable package carries hardcoded API keys, backend credentials, signing or encryption material, private endpoints, or feature and debug flags in its code, resources, web assets, or configuration files, so anyone who unpacks the distributed app recovers them, because the bundle is treated as private when a distributed binary is fully readable. Use when reviewing what a shipped mobile app package contains, including a hybrid app's embedded web assets and configuration. Covers hardcoded credentials and keys, embedded private endpoints, bundled web-asset secrets, and shipped debug or feature flags. The secret or abusable setting shipped in the bundle is the source, unpacking the distributed app is the sink, and recovering usable material or a privileged toggle from the package is the bug.

unboundcompute Skill

Audit sensitive data leaving an iOS app's protection through shared containers and system-wide channels, where a secret or private value is written to a shared app-group container, a shared keychain access group, the general pasteboard, or app state that lands in snapshots and extensions, so another app, an app extension, or any process reading the pasteboard can recover it, because the shared surface is broader than the data's sensitivity requires. Use when reviewing what an iOS app shares with its own extensions or other apps and what it copies or exposes system-wide. Covers app-group container leakage, over-broad shared keychain groups, general-pasteboard secrets, and snapshot or extension data exposure. The sensitive value placed on a shared surface is the source, the other app or process reading that surface is the sink, and recovering the value outside the app's boundary is the bug.