Results for “horizon”

Test horizontal and vertical authorization bypass via session ID swapping between accounts, IDOR through parameter manipulation (invoice=, user=, menuitem=, EventID=), and special header injection (X-Original-URL, X-Rewrite-URL, X-Forwarded-For, X-Remote-IP, X-Client-IP with 127.0.0.1/localhost/RFC1918 values). Tools: Burp Suite with Autorize/AuthMatrix extensions, OWASP ZAP Access Control Testing add-on.

Use to scan support conversations for a harm nobody has categorised yet — a new failure mode, a scam pattern, or a product change hurting a group of customers before it shows in any metric. Trigger for "is anything new going wrong", "scan for emerging issues", "early warning from support", horizon scanning, a new scam pattern, or preparing for a question about what you might be missing.

Compute aerospace environment properties including atmosphere (ISA, COESA, NRLMSISE-00, non-standard, CIRA), gravity (spherical harmonic, WGS84, zonal, centrifugal), horizontal wind (HWM), magnetic field (WMM, IGRF), geoid height, geocentric radius, space weather data, planetary ephemeris, Earth orientation (polar motion, nutation, delta-UT1, CIP). Use when computing atmospheric density, temperature, pressure, gravity vectors, wind profiles, magnetic field components, geoid undulation, solar flux indices, planet positions, or Earth orientation parameters for aerospace vehicle analysis, spacecraft environment modeling, or navigation corrections.

Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.

Autonomously improve a real artifact (code, training recipe, agent harness, data pipeline, prompt) against an objective and an evaluator, using Hypothesis Tree Refinement (HTR) from the Arbor paper. Use this whenever someone wants to iteratively optimize something over many experiments without overfitting — e.g. "get my model's eval score up", "improve this agent/harness", "tune this pipeline", "beat the baseline on this benchmark", "run a search over approaches and keep the best", "do an MLE-bench / Kaggle-style optimization", or any long-horizon "make this artifact better and don't just memorize the dev set" task. Trigger it even when the user doesn't say "Arbor" or "hypothesis tree" but describes repeated experiment-and-evaluate loops, branching exploration of competing ideas, or worries about a dev/test gap. Runs Claude itself as the coordinator with subagent executors in...

Create OR review a wireflow — the artifact BETWEEN user journeys and wireframes. It maps whole journeys into swimlane flows with high-level navigation (screens, decisions, system/agent steps) while keeping Jobs-To-Be-Done at the core, WITHOUT deep UI. Use whenever the user wants to "map the flows", "make/build a wireflow", turn journeys / JTBDs / a spec / a live prototype into flows, or put every journey on one board against shared owner lanes — even if they never say "wireflow". ALSO use it to REVIEW or critique an existing wireflow (image, FigJam, or description). In the A-Team pipeline this is a definition-phase skill: output lands in docs/features/<slug>/briefs/wireflow/ with jobs consumed by id from docs/product/jtbd/; pipeline mode derives the method decisions and highlights the riskiest at the gate, standalone mode runs the full grill. CREATE generates verified SVG/HTML (self-checked by rendering and Reading its output) in a horizontal per-journey OR shared-matrix layout, and can rebuild in FigJam. Do