# Analyst Overview

> Root pointer for the analyst's vulnerability research playbooks. Load this first at iteration start to see the full catalog of vuln-class and chain-building skills.

- Skill: `purpleailab/analyst-overview` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/analyst-overview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/analyst-overview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/analyst-overview

---


# Analyst Skill Catalog

The analyst has specialised playbooks under this tree. Load the one
matching your current hunting lane — don't load them all at once.

## Taint / source-review playbooks
Use when you have source code and are hunting a specific weakness class.

| Skill                                       | Use for                                                        |
|---------------------------------------------|----------------------------------------------------------------|
| `/skills/standard/analyst/sql-injection/SKILL.md`    | String-concat + format-string → SQL sink                       |
| `/skills/standard/analyst/ssrf/SKILL.md`             | User-controlled URL reaches http client                        |
| `/skills/standard/analyst/deserialization/SKILL.md`  | pickle / Java ObjectInputStream / .NET BinaryFormatter / YAML  |
| `/skills/standard/analyst/ssti/SKILL.md`             | User input rendered by Jinja/Twig/Freemarker/Velocity          |
| `/skills/standard/analyst/xxe/SKILL.md`              | XML parser with external entity expansion enabled              |
| `/skills/standard/analyst/path-traversal/SKILL.md`   | User input reaches filesystem path                             |
| `/skills/standard/analyst/prototype-pollution/SKILL.md` | JS merge / assign / clone of untrusted object                 |
| `/skills/standard/analyst/command-injection/SKILL.md`| User input → shell, exec, system                              |
| `/skills/standard/analyst/idor/SKILL.md`             | Missing authorization check on object reference                |
| `/skills/standard/analyst/auth-bypass/SKILL.md`      | Broken auth state machine, missing session checks              |
| `/skills/standard/analyst/prompt-injection/SKILL.md` | LLM prompts built from untrusted input                         |

## Research expansion playbooks

| Skill | Use for |
|---|---|
| `/skills/standard/analyst/patch-diff/SKILL.md` | Pinned vulnerable-to-fixed differential testing and variant analysis |
| `/skills/standard/analyst/pattern-exhaustion/SKILL.md` | Independent validation of related root-cause candidates |

## Chain playbooks
Use when you have a bag of individual findings and want to combine them
into a critical impact chain.

| Skill                                       | Use for                                                        |
|---------------------------------------------|----------------------------------------------------------------|
| `/skills/standard/analyst/chains/ssrf-to-rce/SKILL.md`  | SSRF → metadata → IAM → RCE                                |
| `/skills/standard/analyst/chains/xss-to-takeover/SKILL.md` | Self-XSS → CSRF → admin creds                            |
| `/skills/standard/analyst/chains/cred-reuse/SKILL.md`   | Low-priv cred → service pivot → domain admin               |
| `/skills/standard/analyst/chains/idor-to-priv-esc/SKILL.md` | IDOR on settings → role elevation                      |

## Workflow
1. `kg_stats` — see what you already know.
2. Identify the target's language / framework.
3. Load the matching vuln-class skill (one or two per iteration).
4. Run the skill's recipe, record findings as graph nodes.
5. When enough vulns exist, load a chain playbook and call
   `plan_attack_chains(promote=True)` to persist any complete chains.