# Torusguard Exploit Check

> Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.

- Skill: `githubmofo/torusguard-exploit-check` (Agent Skill)
- Install (CLI): `npx skillmds@latest add githubmofo/torusguard-exploit-check`
- Raw SKILL.md: https://api.skillmd.com/api/skills/githubmofo/torusguard-exploit-check/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: githubmofo (https://skillmd.com/u/githubmofo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/githubmofo/torusguard-exploit-check

---


# TorusGuard Exploit Check — Bounded Exploitability Confirmation

## Objective
Confirm whether candidate findings are practically exploitable using safe, single-step sentinel canaries without data loss or weaponized execution.

---

## Authorization Gate Check
Before dispatching any exploitability probe:
1. Verify target route is explicitly authorized in `.torusguard/config/scope.json`.
2. Verify authorization TTL has not expired.
3. Assert probe passes `.torusguard/scripts/safety_gate.py`.

---

## Bounded Probe Strategies
- **SQLi:** Mathematical identity canary (`' OR 1=1--`) asserting differential response without altering data.
- **XSS:** Inert HTML marker tag (`<tg-canary-tag>`) checking unescaped reflection in DOM.
- **IDOR:** Cross-tenant GET using secondary tenant session; assert 403 vs leak.
- **Auth:** Omit auth header on protected route; assert 401.

---

## Execution Steps

1. **Verify Scope:** Read `scope.json`; assert authorized endpoint.
2. **Select Canary:** Choose matching non-destructive probe strategy.
3. **Handle Automation Failure:** If automated exploit check scripts fail, YOU must manually construct the safe HTTP request (using `curl` or `fetch`) and inspect the response.
4. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
5. **Classify Status:** Transition finding into one of 5 canonical outcomes:
   - `Confirmed`: Canary reflected or secondary tenant data leaked.
   - `Not Reproducible`: Endpoint responded with 401/403 or sanitized input.
   - `Needs Review`: Ambiguous status code or incomplete response.
   - `Blocked by Controls`: WAF or rate limiter stopped probe.
   - `Out of Scope`: Target endpoint is not authorized.
6. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.

---

## Safety Constraints
- Zero destructive payloads (`DROP`, `DELETE`, `UPDATE`).
- No denial-of-service or continuous fuzzing loops.
- Redact tokens before recording traces.

---

## Output Format
```markdown
🎯 [TorusGuard] Exploitability Confirmation (AI Assisted)
- Finding ID: <Finding ID> | Target: <Route>
- Status: <Confirmed / Not Reproducible / Blocked>
- Evidence: <Response snippet or status code>
Next: Run `/torusguard harden` to formulate surgical remediation bundle.
```