UnboundCompute

@unboundcompute source repo

194 skills
0 followers
11 hours ago last updated

▌
Hunting Windows Service Privilege Escalation · unboundcompute
Hunt local privilege escalation through Windows service misconfiguration, where a low-privileged user can influence what a service runs as a higher-privileged account, through a weak service object permission, a writable service binary or its directory, an unquoted service path with a writable intervening directory, or a weak permission on the service's registry configuration. Use when reviewing installed services and their binaries, paths, and permissions on a Windows host for a standard-user-to-SYSTEM path. Covers weak service DACLs, writable binaries and paths, unquoted paths, and writable service registry keys. The standard-user control over service configuration or its on-disk target is the source, the service manager starting the binary as a privileged account is the sink, and running attacker-chosen code as that account is the bug.

0
installs
▌
Mapping Service Account Impersonation Chains · unboundcompute
Map service-account impersonation and token-generation paths that let a principal act as a more-privileged identity: a role granting impersonation or token creation on a service account, an actAs or token-creator permission that chains one identity into another, and a sequence of such grants that reaches a highly privileged account from a low-privileged start. Covers cloud service-account impersonation, short-lived-token generation, and the transitive graph where each impersonation grant is an edge from one identity to another. Use when principals can impersonate service accounts or mint tokens for them and you need to know where those edges lead. The principal holding an impersonation grant is the source, the impersonate or token-generation call is the sink, and the reachable privileged identity at the chain's end is the bug.

0
installs
▌
Testing Agents For Indirect Prompt Injection · unboundcompute
Test whether an AI agent obeys instructions hidden in the content it ingests, rather than only the user's. Enumerate every channel through which untrusted content reaches the model context (retrieved docs, fetched pages, uploaded files, emails, tool outputs, filenames, images and PDFs, other agents), plant channel-appropriate payloads, and measure whether they change the agent's actions. Use when reviewing any agent or LLM app that reads external content and can act. Covers channel enumeration, overt and covert payloads, canary observables, and impact via the trifecta.

0
installs
▌
Auditing Cross Chain Bridge And Message Trust · unboundcompute
Audit a cross-chain bridge or messaging protocol for misplaced trust in messages that cross chains: a destination contract that accepts a mint or release on a forged or unverified proof of a source-chain event, a message whose signer set or validator quorum can be spoofed or is too small, a message that can be replayed on the destination or across chains for a repeated withdrawal, and a lock-and-mint or burn-and-release accounting that a crafted message pushes out of balance. Covers token bridges, message-passing layers, and any protocol where an action on one chain is authorized by an event claimed to have happened on another. Use when a destination-chain action depends on trusting a source-chain event and that verification is the boundary. The forged or replayed cross-chain message is the source, the unauthorized mint, release, or state change is the sink, and the missing or spoofable source-event verification is the bug.

0
installs
▌
Auditing Iac Module And Provider Supply Chain · unboundcompute
Audit the supply chain of infrastructure-as-code modules and providers for trust that runs at plan or apply time: a module sourced from an unpinned or attacker-influenceable location, a provider or plugin pulled from a registry without integrity pinning, a module that executes local commands or fetches remote content during planning, and a lockfile that is missing, ignored, or not enforced in CI. Covers Terraform and similar declarative tools where a module or provider runs with the credentials of whoever applies it. Use when infrastructure is built from third-party or shared modules and providers and the apply identity is privileged. The untrusted module or provider source is the source, the plan or apply execution is the sink, and the code running under the applier's credentials without integrity pinning is the bug.

0
installs
▌
Auditing Mobile Backend And Firebase Exposure · unboundcompute
Audit the backend a mobile app talks to for authorization that lives only in the client, where a mobile-backend service, a hosted datastore, a storage bucket, or a cloud function trusts the app to enforce access and so lets any client read or write another user's data, call a privileged operation, or reach records it should not, because the service rules are permissive, the operation authorizes by client-set values, or the backend assumes only the genuine app calls it. Use when a mobile app uses a hosted backend or datastore whose access rules and operations you can exercise directly. Covers permissive datastore rules, unauthenticated or over-scoped reads and writes, storage bucket exposure, and client-trusting cloud functions. The direct client request bypassing the app is the source, the backend rule or operation serving it is the sink, and reaching data or actions the user is not entitled to is the bug.

0
installs
▌
Auditing OAUTH Token Audience And Scope Trust · unboundcompute
Audit how a resource server trusts OAuth access tokens for confusion it should reject: a token minted for one audience accepted by a different service, a scope treated as coarser or finer than it is so a token reaches an operation it was not granted, a token-issuer or authorization-server mix-up where a token from one issuer is honored by a party that trusts another, and a resource server that validates the signature but not the audience, issuer, or scope. Covers OAuth and bearer-token architectures where an access token authorizes a call between a client, an authorization server, and one or more resource servers. Use when a resource server accepts bearer tokens and the audience, issuer, and scope checks are the boundary. The token presented to the wrong audience or beyond its scope is the source, the resource operation it reaches is the sink, and the missing audience, issuer, or scope validation is the bug.

0
installs
▌
Auditing Windows Uac And Integrity Boundaries · unboundcompute
Audit elevation and integrity boundaries on Windows, where a medium-integrity process reaches a high- integrity context without a genuine consent prompt, through an auto-elevating binary that loads an attacker-influenced input, a writable resource an elevated process consumes, an over-broad elevation policy, or an integrity level that does not gate the operation it should. Use when reviewing how a host distinguishes elevated from non-elevated code and whether a non-administrator can cross that line without real consent. Covers auto-elevation abuse, elevated processes consuming writable inputs, permissive elevation policy, and integrity levels that fail to gate an operation. The medium-integrity influence over what an elevated process consumes is the source, the auto-elevating or elevated operation is the sink, and reaching a high- integrity context without genuine consent is the bug.

0
installs
▌
Hunting Dotnet Deserialization Type Injection · unboundcompute
Hunt .NET deserialization where untrusted input reaches a formatter that resolves the type from the data itself: BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter or ObjectStateFormatter on ViewState, or Json.NET and similar with type-name handling enabled. Covers formatters that instantiate an attacker-named type and drive a gadget through a set accessor, a callback, or a converter to a command, a process start, or a file operation. Use when a service reads serialized .NET objects it did not produce and the formatter honors an embedded or annotated type name. The untrusted serialized payload is the source, the type-resolving formatter is the sink, and the attacker-chosen type driving a gadget to a dangerous call is the bug.

0
installs
▌
Hunting Firmware Secrets And Debug Interfaces · unboundcompute
Hunt the attack surface a firmware image ships by mistake: a secret baked into the binary, a debug or diagnostic interface left enabled, a network service exposed by default, or a privileged command or update path reachable with no authentication. Covers a private key, symmetric key, or backdoor credential compiled into the image and used for authentication, a serial or on-chip debug console that drops to a privileged shell without auth, a management or plaintext service bound to every interface at boot, and a command handler that flashes, reconfigures, or executes from external input before any auth check, including a shell command built from that input. Use when reviewing firmware source, init scripts, and default configuration. The externally reachable interface is the source, the unauthenticated privileged action or the secret disclosure is the sink, and a missing auth gate or an embedded secret is the bug.

0
installs
▌
Hunting Hybrid App Bundle And Config Exposure · unboundcompute
Hunt secrets and abusable configuration shipped inside a mobile app bundle, where the installable package carries hardcoded API keys, backend credentials, signing or encryption material, private endpoints, or feature and debug flags in its code, resources, web assets, or configuration files, so anyone who unpacks the distributed app recovers them, because the bundle is treated as private when a distributed binary is fully readable. Use when reviewing what a shipped mobile app package contains, including a hybrid app's embedded web assets and configuration. Covers hardcoded credentials and keys, embedded private endpoints, bundled web-asset secrets, and shipped debug or feature flags. The secret or abusable setting shipped in the bundle is the source, unpacking the distributed app is the sink, and recovering usable material or a privileged toggle from the package is the bug.

0
installs
▌
Hunting IOS Keychain And Data Protection Gaps · unboundcompute
Hunt at-rest exposure of secrets on iOS, where a credential, token, or sensitive value is stored with a keychain accessibility class or a data-protection class weaker than it needs, so it is readable when the device is locked, survives into a device backup, or is reachable by another app or after theft, because the item is marked always-accessible, is not restricted to this device, or the file protection lets it be read outside an unlocked session. Use when reviewing how an app stores secrets and files and which protection class each carries. Covers over-permissive keychain accessibility, missing this-device-only restriction, backup-included secrets, and weak file data-protection classes. The secret stored under a weak protection class is the source, the read outside the intended unlocked and on-device context is the sink, and recovering a usable secret in that weaker context is the bug.

0
installs
▌
Hunting Mev And Transaction Ordering Exposure · unboundcompute
Hunt for value a validator or searcher can extract by controlling the order of transactions in a block: a swap or trade with no slippage bound that a sandwich attack front-runs and back-runs, an oracle update or liquidation whose profit depends on being sequenced first, an on-chain action that leaks its intent to the public mempool before it settles, and a protocol that assumes fair ordering when block producers choose it. Covers DeFi swaps, AMMs, lending liquidations, auctions, and any on-chain flow whose outcome depends on where its transaction lands in the block. Use when the profit or safety of an on-chain action depends on ordering that the submitter does not control. The attacker-ordered or front-run transaction is the source, the extracted value or failed action is the sink, and the missing slippage bound or ordering assumption is the bug.

0
installs
▌
Hunting Scheduled Job And Search Path Hijacks · unboundcompute
Hunt local privilege escalation through scheduled jobs and the paths privileged processes trust: periodic and timer jobs whose script, or a file or directory they read, is writable by a lower-privileged user; commands invoked by an unqualified name resolved through a writable search-path entry; and argument injection where a command expands a shell wildcard over a directory an attacker can write to, so a file named like an option (a leading-dash filename) becomes a command-line flag. Covers writable job scripts, writable directories on an effective path, relative command execution, and the filename-as-flag wildcard trick. Use when auditing a host or image for local escalation through automation. The writable input is the source, execution as the job's identity is the sink.

0
installs
▌
Hunting Tenant Onboarding And Discovery Abuse · unboundcompute
Hunt for multi-tenant SaaS onboarding and organization-discovery flows that let an attacker join, claim, or enumerate a tenant they should not: a self-service signup that auto-joins a new user to an existing organization by email domain so anyone with a matching address lands inside it, a domain-claim step that can be satisfied without proving ownership so an attacker claims a domain and its users, an invitation whose token is guessable, reusable, or not bound to the invited address, a tenant-discovery endpoint that reveals which organizations or domains exist, and a first-admin race where claiming an unclaimed org grants admin over users who later join. Use when joining or claiming a tenant, or learning that one exists, is the boundary between an outsider and an organization's data. The onboarding or discovery request is the source, the unauthorized tenant membership, claim, or enumeration is the sink, and the unverified domain claim or unbound invitation is the bug.

0
installs
▌
Reviewing Secrets Manager Access Policy Trust · unboundcompute
Review who can actually read a managed secret: a secrets-manager or vault access policy that grants read to a broader principal set than the secret's consumers, a resource policy and an identity policy that combine to admit an unintended reader, a wildcard on the secret name or path that sweeps in unrelated secrets, and a decryption grant on the underlying key that widens access beyond the store's own policy. Covers cloud secrets managers and vault-style stores where the effective read set is the union of resource policy, identity policy, and key-decrypt permission. Use when applications fetch secrets from a managed store and the access policy is the boundary on who reads them. The principal the combined policy admits is the source, the secret read is the sink, and the reader beyond the secret's intended consumers is the bug.

0
installs
▌
Auditing Container Runtime And Socket Exposure · unboundcompute
Audit whether a workload can reach the container runtime and thereby control the host: the container runtime socket mounted into a pod or bound into a build or CI container, a privileged sidecar that talks to the runtime to launch or inspect containers, a runtime API exposed over a reachable port, and tooling that needs the runtime and is given it far more broadly than the one operation requires. Covers container hosts where reaching the runtime socket or API grants the ability to start privileged containers, mount the host filesystem, and take over the node. Use when a workload, build, or agent is given access to the container runtime. The workload with runtime access is the source, the container runtime is the sink, and the socket or API exposure that grants host control is the bug.

0
installs
▌
Auditing IOS App Group And Pasteboard Exposure · unboundcompute
Audit sensitive data leaving an iOS app's protection through shared containers and system-wide channels, where a secret or private value is written to a shared app-group container, a shared keychain access group, the general pasteboard, or app state that lands in snapshots and extensions, so another app, an app extension, or any process reading the pasteboard can recover it, because the shared surface is broader than the data's sensitivity requires. Use when reviewing what an iOS app shares with its own extensions or other apps and what it copies or exposes system-wide. Covers app-group container leakage, over-broad shared keychain groups, general-pasteboard secrets, and snapshot or extension data exposure. The sensitive value placed on a shared surface is the source, the other app or process reading that surface is the sink, and recovering the value outside the app's boundary is the bug.

0
installs
▌
Auditing Ota And Firmware Update Channel Trust · unboundcompute
Audit an over-the-air or firmware update channel for a device that accepts an image it should reject: an update whose signature is not verified so an attacker installs arbitrary firmware, an update fetched over an unauthenticated transport an on-path attacker can swap, a rollback to an older signed image with known vulnerabilities because the device does not enforce version monotonicity, an update server or manifest URL the device trusts without authentication, and an unencrypted image that leaks secrets and eases reverse engineering. Covers IoT and embedded devices, routers, wearables, and any product that fetches and installs firmware or application updates in the field. Use when a device installs firmware it fetches and the verification of that image before it runs is the boundary. The unsigned, swapped, or rolled-back update is the source, the persistent code execution on the device is the sink, and the missing signature check, transport authentication, or rollback protection is the bug.

0
installs
▌
Auditing Payment Callback And Amount Integrity · unboundcompute
Audit payment provider callbacks and settlement notifications for the trust that lets an attacker forge or alter a payment result: a callback whose signature is not verified so a spoofed success is accepted, an amount or currency taken from the callback or client rather than reconciled against the order the server created, a success notification not bound to a specific order so it can be replayed onto another order, and a settled status trusted without confirming it out of band with the provider. Covers redirect returns, server-to-server webhooks, and status polls where a payment processor tells the application a charge succeeded. Use when the application learns a payment result from an external processor and that message gates fulfillment. The forged or altered payment notification is the source, the order marked paid and fulfilled is the sink, and the unverified signature, unreconciled amount, or unbound order reference is the bug.

0
installs
▌
Auditing Payment State Machine And Idempotency · unboundcompute
Audit payment and checkout state machines for transitions an attacker can drive out of order or replay for value: an order marked paid before the charge is confirmed, a step that can be skipped or repeated so goods ship without settlement, a non-idempotent charge or fulfillment endpoint that double-processes on a retried or replayed request, and a refund or cancel that returns value while the underlying charge stays captured. Covers checkout, charge, fulfillment, and refund flows where money and goods change hands across a sequence of state transitions. Use when a purchase moves through ordered payment states and the transitions and their idempotency are the boundary. The out-of-order or replayed transition is the source, the value released without settlement is the sink, and the skippable step or non-idempotent handler that allows it is the bug.

0
installs
▌
Hunting Wallet Drainer And Dapp Approval Abuse · unboundcompute
Hunt for dApp flows that trick a user's wallet into signing away its assets: an unlimited or unnecessary token approval a user grants to a contract that can then move all of their tokens, a signed permit or approve-for-all that authorizes spending far beyond the intended action, a blind-signing prompt that hides what is really being authorized, a malicious or spoofed spender or contract address the user is led to approve, and a transaction whose displayed intent differs from what it actually executes. Covers dApp front ends, wallet-connection flows, and token-approval interactions where a user's signature or approval authorizes a contract to move their assets. Use when a user signs an approval or transaction and the gap between what they think they authorized and what they did is the boundary. The deceptive or overbroad approval request is the source, the drained or movable assets are the sink, and the unlimited scope or hidden intent is the bug.

0
installs
▌
Hunting Windows Dll Hijacking And Search Order · unboundcompute
Hunt code execution through Windows library search order, where a privileged process loads a library by name and resolves it from a location a lower-privileged user can write, because the library is absent from its expected directory, the application directory or a path entry is writable, or the load uses an unsafe search that reaches the current or a user-controlled directory. Use when reviewing how a privileged executable or service resolves its dynamic libraries and whether any resolution step lands in a writable location. Covers phantom missing libraries, writable application directories, unsafe search modes, and side-loading through a copied trusted binary. The lower-privileged write into a resolved search location is the source, the privileged process loading the library by name is the sink, and executing attacker-supplied library code in that process is the bug.

0
installs
▌
Auditing Kms Key Policy And Envelope Encryption · unboundcompute
Audit key-management policies and envelope-encryption design for a decrypt path broader than intended: a key policy or grant that admits a principal who should never decrypt, a wildcard key resource in an identity policy that covers unrelated keys, an encryption context that is not enforced so a data key decrypts outside its intended scope, and a cross-account key grant that widens the decrypt set. Covers cloud key-management services, key policies and grants, and envelope encryption where a data key protects the payload and the key policy protects the data key. Use when data is protected by a managed key and the key policy plus encryption context are the boundary on who can decrypt. The principal the key policy admits is the source, the decrypt operation is the sink, and the decryptor beyond the data's intended readers is the bug.

0
installs
▌
Auditing Kubernetes Workload And Rbac Hardening · unboundcompute
Audit Kubernetes manifests for a subject granted more than it needs or a workload that can escape its container, after the binding graph and admission policy are resolved. Covers a RoleBinding or ClusterRoleBinding to cluster-admin or a wildcard-verb role, a pod running privileged or with host namespaces or a sensitive hostPath mount, a container running as root or able to escalate privilege, dangerous added capabilities, a service-account token mounted where the workload does not need the API, and a workload left flat with no network policy. Use when reviewing the Kubernetes YAML plane (roles, bindings, and workload security contexts as declared), not the cloud identity graph or the image build. The manifest is the source, a cluster-admin subject or an escaping workload is the sink, and a grant or a privilege the binding graph and admission actually allow is the bug.

0
installs
▌
Auditing Mobile Biometric And Local Auth Bypass · unboundcompute
Audit local authentication on a mobile app, where a biometric or device-passcode gate protects sensitive access but can be bypassed because the app trusts the result of the prompt rather than a key released by it, gates only the user interface while the protected data or action remains reachable, does not invalidate the key when enrolled biometrics change, or accepts a callback an attacker can forge on a controlled device. Use when a mobile app gates sensitive data or actions behind a biometric or local-auth prompt. Covers result-only trust without a bound key, interface-only gating, missing invalidation on enrollment change, and forgeable success callbacks. The local-auth prompt the app relies on is the source, the sensitive data or action it is meant to protect is the sink, and reaching that data or action without a genuine local authentication is the bug.

0
installs
▌
Auditing Observability Pipeline Collector Trust · unboundcompute
Audit telemetry collectors and observability pipelines for trust they should not extend: a collector endpoint that ingests metrics, logs, or traces without authenticating the sender, a processor that executes or forwards based on attacker-controllable telemetry fields, a collector running with broad credentials whose exporters reach sensitive destinations, and an ingestion path where log or trace content becomes a command, a query, or a downstream request. Covers agents and gateway collectors for logs, metrics, and traces, where the pipeline reads data from many sources and acts on it. Use when a telemetry collector ingests from workloads or the network and forwards, transforms, or stores that data. The unauthenticated or attacker-shaped telemetry is the source, the collector processor or exporter is the sink, and the unauthenticated ingestion or the acted-upon field is the bug.

0
installs
▌
Auditing Account Abstraction And Paymaster Trust · unboundcompute
Audit an ERC-4337 account-abstraction deployment for trust misplaced in the user-operation lifecycle: a smart account whose validation accepts a signature or nonce it should reject, a paymaster that agrees to sponsor gas for operations it should not so an attacker drains its deposit, a bundler or entry-point assumption that lets a user operation be replayed or reordered for gain, and validation logic that reads mutable state or reaches outside its allowed scope. Covers smart-contract wallets, paymasters, bundlers, and the entry point in an account-abstraction stack where a user operation is validated and sponsored before it executes. Use when a user operation is validated, paid for, and executed by separate parties and that trust split is the boundary. The crafted user operation is the source, the drained paymaster or unauthorized execution is the sink, and the over-permissive validation or sponsorship rule is the bug.

0
installs
▌
Auditing Error Handling And Information Exposure · unboundcompute
Audit error handling and diagnostic surfaces for sensitive information a real client receives, where an exception path, a debug feature, or a diagnostic endpoint returns stack traces, database errors, internal paths, framework or version banners, configuration, secrets, or messages that differ enough to enumerate users. Use when reviewing how a service responds to malformed, unauthorized, or failing requests in its deployed configuration, and whether debug modes, source maps, or version-control metadata are exposed. Scoped to what production actually returns, not developer-only verbosity. The error or diagnostic path is the source, the response, header, or user-visible log is the sink, and disclosing detail that aids a further attack is the bug.

0
installs
▌
Auditing Webhook Authenticity And Callback Trust · unboundcompute
Audit both directions of webhook trust: an inbound handler that acts on a payload without proving it authentic, and an outbound fetch of a caller-supplied URL that reaches internal targets. Covers inbound handlers with no signature check, a signature compared in non-constant time, a signature computed over a re-serialized body instead of the exact raw bytes, a verification result that is computed but never enforced, and no timestamp or replay defense; and outbound callback or fetch URLs validated by substring or blocklist, or by a single pre-connect lookup that a redirect or a rebind defeats. Use when reviewing code that receives a signed webhook and performs a state change, or that fetches a URL the caller controls. The inbound request or the caller-supplied URL is the source, the state-changing handler or the server-side fetch is the sink, and a missing or bypassable trust check between them is the bug.

0
installs
▌
Hunting Code Interpreter And Tool Sandbox Escape · unboundcompute
Hunt for ways attacker-influenced code or a tool call escapes the sandbox an AI application runs it in: a code-interpreter or tool runtime that executes model-generated code with network access, a writable host filesystem, or credentials it should never see, a sandbox that shares a kernel, a mount, or an environment variable with the host so the guest reaches out, a resource with no CPU, memory, time, or output bound so one run starves the host, and a tool whose arguments reach a shell or a path outside the jail. Covers AI features that run model-produced code or shell in a sandbox: code interpreters, agent tool runtimes, and notebook or eval backends. Use when a model's output becomes code that executes and the sandbox is the boundary. The model-generated code or tool argument is the source, the host resource it reaches is the sink, and the missing isolation, credential, or resource bound that lets it out is the bug.

0
installs
▌
Hunting Connection String And Jdbc Url Injection · unboundcompute
Hunt injection into database connection strings and JDBC or driver URLs where untrusted input sets the host, a driver property, or a URL parameter, turning a data connection into a request to an attacker server or an unsafe driver feature. Covers a tenant, hostname, or option taken from input and spliced into a connection URL, driver properties that enable local file reads, arbitrary command execution, or class loading, and multi-attribute connection strings where an extra property overrides a security setting. Use when an application builds a database or service connection string from user or tenant input rather than from fixed configuration. The untrusted value that becomes a connection host or property is the source, the connect call is the sink, and the dangerous driver feature or redirected endpoint it reaches is the bug.

0
installs
▌
Hunting Signature Replay And Eip712 Domain Trust · unboundcompute
Hunt for signed messages a contract or backend accepts more than once or in a context they were never meant for: an EIP-712 signature with no nonce so it replays, a signature missing chain id or verifying-contract in its domain separator so it replays across chains or deployments, a permit or meta-transaction reused after it was already consumed, a signature whose signed fields omit something the action depends on so a different action reuses it, and a signer recovery that accepts a malleable or zero-address signature. Covers on-chain signature verification, permits, meta-transactions, and off-chain-signed orders where a signature authorizes an action. Use when a signed message authorizes an action and the binding of that signature to one action, one chain, and one use is the boundary. The reused or cross-context signature is the source, the repeated or unintended authorized action is the sink, and the missing nonce or domain binding is the bug.

0
installs
▌
Hunting Server Side Rendering And Svg Image Abuse · unboundcompute
Hunt abuse of server-side renderers of user-supplied markup, such as headless-browser PDF or screenshot generation, SVG rasterization, thumbnailers, and chart or document renderers, where the renderer fetches remote or local resources, follows redirects, executes embedded script, or reads local files while producing output. Use when untrusted HTML, SVG, or a URL is handed to a rendering component server-side. Covers server-side request forgery including to cloud metadata, local file disclosure through file schemes or external entities, blind out-of-band interaction, and script execution inside the generated document. The untrusted markup or URL is the source, the resolving renderer is the sink, and the fetch, file read, or script execution it performs is the bug.

0
installs
▌
Hunting Non Human Identity And Secret Reachability · unboundcompute
Hunt machine credentials that are live, over-privileged, and actually reachable, not just present. Covers non-human identities and secrets across code, configuration, and infrastructure definitions: API keys, service-account credentials, and long-lived tokens. Separates a secret that merely exists from one an attacker can reach and use, and adjudicates each by whether it is still valid, how much it grants, and whether an untrusted path leads to it. Use when reviewing secret exposure, machine identities, or the blast radius of a leaked credential, and when a scanner reports many secrets and you need to know which ones matter. A reachable, live, over-privileged credential is the finding.

0
installs
▌
Auditing Mobile Root Jailbreak And Tamper Resistance · unboundcompute
Audit whether a mobile app's integrity and environment checks actually enforce a security decision, where the app runs a root or jailbreak check, a repackaging or debugger check, or an emulator check but decides the result on the client, so a controlled device defeats it, or the app relies on such a check to protect a secret or an operation that a genuine attacker on their own device simply bypasses, because the check is advisory rather than a real control and the protected asset is reachable once it is defeated. Use when a mobile app performs environment or tamper checks and treats their outcome as a security boundary. Covers client-decided integrity checks, checks not bound to a server-verified attestation, and secrets or operations gated only by such a check. The controlled or tampered device the check cannot truly detect is the source, the client integrity decision is the sink, and reaching the protected asset by defeating the check is the bug.

0
installs
▌
Auditing Android Intent Redirection And Pendingintent · unboundcompute
Audit Android privilege and access leaks through intent redirection and mutable pending intents, where a privileged component receives an intent carrying a nested intent it then launches, or hands out a pending intent an untrusted app can fill in, so the untrusted caller reaches a protected component or acts with the privileged app's identity, because the component forwards an attacker-supplied intent without constraint or the pending intent is mutable and under-specified. Use when an Android app forwards intents extracted from input or shares pending intents with other apps. Covers nested-intent redirection to protected components, mutable pending intents, implicit pending-intent delivery, and forwarding that carries the app's permissions. The attacker-supplied nested or fillable intent is the source, the privileged component launching or sending it is the sink, and reaching a protected target with the app's identity is the bug.

0
installs
▌
Hunting Unicode Normalization And Canonicalization Bypass · unboundcompute
Hunt security bypasses where a check passes on one representation of untrusted input and a normalization, decoding, or case-folding step then turns it into a different, dangerous form at the sink. Use when an authorization, filter, allowlist, path-containment, or identifier comparison runs on input that is later normalized, percent- or entity-decoded, or case-folded before it reaches the operation it guards. Covers Unicode normalization forms, overlong and double encoding, case-fold and locale collisions, and mixed-script or homoglyph identifiers. The input that passes the check in one form is the source, the security decision made on the wrong form is the sink, and the bypass or identity confusion that the later transform enables is the bug.

0
installs
▌
Auditing Guard Gaps · unboundcompute
Find the missing-check bug by comparing sibling functions that reach the same sink - one validates its input, its peer does not. Use on an authorized source target to surface broken access control, missing bounds checks, and skipped sanitization that linear file-reading hides; when you suspect one handler in a family forgot the check its siblings all perform. Covers finding a guarded anchor, enumerating structural peers, diffing guard-for-guard by what each actually enforces, and confirming the unguarded peer is reachable with attacker input.

0
installs
▌
Hunting Bug Variants · unboundcompute
Given one confirmed vulnerability, systematically find its siblings: the same defect shape repeated elsewhere in the codebase, and the parts of it the fix left uncovered. Use right after you confirm or read about a bug (your own finding, a CVE, a patch, a writeup) and want the other instances instead of stopping at one. Turns a single seed into a structural signature and sweeps the whole tree for same-shape code, copy-paste clones, sibling handlers, and incomplete fixes. Covers signature extraction, the variant sweep, and adjudicating each candidate.

0
installs
▌
Writing Vuln Reports · unboundcompute
Turn a confirmed finding into a clear, reproducible vulnerability report a maintainer or triager can act on without a back-and-forth. Use after a finding is confirmed (via the finding schema) and you need a writeup - a bug-bounty submission, a security advisory, an internal ticket, or a disclosure email. Covers the report structure that gets findings fixed, writing a reproduction that actually reproduces, justifying severity honestly, and the disclosure etiquette that keeps you in bounds.

0
installs
▌
Finding Crypto Misuse · unboundcompute
Find exploitable cryptographic misuse, not theoretical weakness: reused nonces (stream and counter/GCM keystream reuse, ECDSA private-key recovery from a repeated per-signature secret), padding oracles that decrypt ciphertext, hash length-extension on naive MAC constructions, predictable or reused IVs and keys, and a hash chosen for the wrong job. Use when reviewing code that encrypts, signs, authenticates, or hashes, or when a protocol rolls its own crypto. The finding is a concrete recovery or forgery, not "weak algorithm."

0
installs
▌
Mapping Attack Surface · unboundcompute
Map and prioritize the attack surface of an authorized black-box web target before testing it - enumerate hosts, endpoints, parameters, auth flows, and technologies, then order them by where bugs actually live. Use at the start of an in-scope engagement or bug-bounty target when you have a URL/app but no source, and need a systematic surface inventory instead of poking random endpoints; when you need to know what to test first. Enforces a scope gate and produces a prioritized surface inventory that feeds the vuln-class skills.

0
installs
▌
Finding Fail Open Flaws · unboundcompute
Find security controls that grant access when they should deny it: an authorization check that returns allow on error or timeout, an empty or wildcard allowlist that matches everything, a default-allow branch when input is missing or unrecognized, and a caught exception that swallows a denial and continues. Use when reviewing authentication, authorization, or any gate whose failure path matters, or when a check "passes" for reasons you have not confirmed. The dangerous default is allow; prove every gate denies by default.

0
installs
▌
Adjudicating Taint Paths · unboundcompute
Decide whether a whitebox lead is a real bug by tracing taint from an untrusted source to a dangerous sink and confirming every hop against live source. Use after a scanner, a candidate list, or your own reading surfaces a "this looks dangerous" sink (SQL exec, system/exec, file open, deserialize, template render, redirect target, memcpy) and you must decide whether attacker- controlled input actually reaches it - or kill the lead with evidence. Covers forward and reverse taint, witness paths, sanitizer analysis, and the evidence rules that separate a finding from a false positive.

0
installs
▌
Auditing Cicd Oidc Trust · unboundcompute
Audit continuous-integration pipelines for the trust they extend to untrusted input: workflows that run on incoming change requests from forks while holding repository secrets, steps that let attacker-controlled content reach a privileged command, and cloud role trust conditions that accept a pipeline's short-lived token too broadly. Covers secret and token exposure on fork-triggered runs, poisoned-pipeline execution, and over-broad trust on the identity claim a pipeline presents to a cloud account. Use when reviewing CI/CD configuration, pipeline identity, or the boundary between a build and the cloud it can reach. An exploitable token or command from untrusted input is the finding.

0
installs
▌
Detecting Race Conditions · unboundcompute
Find concurrency and time-of-check/time-of-use bugs - TOCTOU, unsynchronized shared state, check-then-act, and atomicity violations - by reasoning about what state is shared, what can interleave, and where a window opens between a check and its use. Use on an authorized source target when the risk is ordering, not a single tainted value; when reviewing multithreaded code, shared caches/counters, filesystem checks, or "verify then act" sequences (balance checks, auth-then-use, dedup guards). Confirms each as an interleaving witness and emits the shared finding schema.

0
installs
▌
Enumerating Snmp Exposure · unboundcompute
Enumerate network-management exposure through the simple network-management protocol: default and guessable community strings, weak or downgradeable versions, read views that leak interface tables, routing and neighbor data, running configuration, process and user lists and sometimes credentials, and writable objects that let you change device state. Covers guessable read and write community strings, version-one and version-two exposure where authentication is a shared string sent in the clear, weak version-three auth, and over-broad views that disclose or mutate more than management needs. Use when auditing network devices, printers, appliances, or hosts that answer management queries. The community string or weak credential is the source, the disclosed data or writable object is the sink.

0
installs
▌
Testing Request Smuggling · unboundcompute
Test whether a chain of HTTP servers disagrees about where one request ends and the next begins, letting an attacker smuggle a request past the front end into the back end. Covers front-end and back-end desync from conflicting length signals, connection-reuse poisoning, single-packet and timing detection, and adjacent boundary confusion where a proxy and origin parse framing differently. Use when reviewing a reverse proxy, load balancer, CDN, or any multi-hop HTTP path where two parsers sit in series. The bug is a disagreement between parsers, not one flaw.

0
installs
▌
Testing Web Cache Attacks · unboundcompute
Test how a caching layer between users and an application can be turned against it: cache poisoning (getting a harmful response stored and served to other users) and cache deception (tricking the cache into storing a victim's private response where the attacker can read it). Covers finding the cache key and unkeyed inputs, identifying cacheable responses, poisoning through unkeyed headers, and deceiving path-based caching into storing authenticated content. Use when reviewing a CDN, a reverse proxy, or any shared HTTP cache in front of an app.

0
installs
▌
Hunting Supply Chain Risks · unboundcompute
Hunt for the ways an attacker gets code into your build without touching your repo: dependency confusion (a public package shadowing an internal name), typosquatting and slopsquatting (a package named after a model's hallucination), poisoned pipeline execution (untrusted input running as a build step), and over-privileged or injectable CI. Use when reviewing a build pipeline, a dependency manifest, an internal package registry, or a CI/CD configuration. The app code can be clean while the artifact you ship is not.

0
installs
▌
Auditing Electron Ipc Trust · unboundcompute
Audit an Electron desktop app for untrusted renderer content that reaches a Node or operating-system capability, after the webPreferences and the preload bridge surface are resolved. Covers nodeIntegration enabled with contextIsolation off, a preload that exposes raw ipcRenderer or a generic invoke passthrough, an ipcMain handler that trusts renderer input as a path, command, or URL, remote or attacker-influenced content loaded through loadURL with navigation unlocked, shell.openExternal called on a renderer-controlled string, and a custom protocol or deeplink routed into a privileged action without validation. Use when reviewing webPreferences, the preload and contextBridge surface, IPC handlers, and remote-content loading, not renderer-side markup injection the client-side DOM skill owns. Untrusted content in a renderer is the source, a Node or operating-system capability is the sink, and input crossing the bridge without validation while isolation is off is the bug.

0
installs
▌
Evaluating Model Guardrails · unboundcompute
Systematically test whether a model's safety and policy guardrails hold under adversarial pressure, as a repeatable evaluation rather than a one-off trick. Covers building a policy-grounded probe set, multi-turn escalation, encoding and obfuscation bypasses, role and context reframing, instruction-hierarchy conflicts, and measuring bypass rate with reproducible graded outcomes. Use when reviewing a model deployment, a system prompt, or a content-safety layer, or before shipping an assistant that must refuse a defined set of requests. A rate, not an anecdote.

0
installs
▌
Reviewing AI Generated Code · unboundcompute
Security-review discipline for code a language model wrote or completed: the failure patterns that show up more often in generated code and the review method that catches them. Covers hallucinated and confusable dependencies, insecure defaults and missing validation carried from training data, propagated vulnerable patterns, over-broad or fabricated permissions, and plausible-looking code that does not do what it claims. Use when reviewing an AI-authored change, an assistant's suggestion, or a large generated diff. Fluent is not correct.

0
installs
▌
Testing Web Cache Deception · unboundcompute
Test web cache deception, where an attacker crafts a static-looking URL, using an added extension, a path delimiter, or a query variant, that maps to the same authenticated dynamic response while a shared cache, keying on the apparent extension or path, stores that private response and serves it to the attacker. Use when a shared cache sits in front of authenticated content and its rule for what is cacheable can disagree with what the origin treats as the same resource. Covers extension-based caching rules, path and delimiter confusion, and cache-key versus origin-routing mismatches. The crafted static-looking URL is the source, the shared cache that stores the authenticated response is the sink, and the victim's private response being cached and retrieved by the attacker is the bug.

0
installs
▌
Auditing Saml And Oidc Flows · unboundcompute
Audit federated single sign-on for the flaws that let an attacker forge or replay an identity: signature wrapping and signature stripping on signed assertions, unsigned or unverified tokens accepted, redirect_uri and audience manipulation, missing state and nonce allowing replay and cross-site request forgery, and identity confusion where one provider's assertion is honored for another account. Use when reviewing a SAML or OIDC integration, an identity-provider connection, or any login that trusts an external assertion. The verification step is the target.

0
installs
▌
Auditing The Lethal Trifecta · unboundcompute
Find where an AI agent becomes dangerous: the trust context in which access to private data, exposure to untrusted content, and an ability to send data out all coexist. Any two legs are usually safe; all three let planted content make the agent read secrets and exfiltrate them. Use when designing or reviewing a tool-using LLM agent, before granting it a new tool or data scope, or to judge whether a prompt injection is actually exploitable. Covers capability inventory, the three legs, kill-chain construction, and which leg to cut.

0
installs
▌
Detecting Memory Safety Bugs · unboundcompute
Find memory-safety bugs in C/C++ and other unmanaged code - use-after-free, double-free, out-of-bounds read/write, uninitialized use, and NULL deref - by reasoning about object lifetime and buffer bounds along real code paths. Use on an authorized source target when a candidate catalog does NOT model these temporal/lifetime classes (most don't), so a keyword or sink scan will miss them; when reviewing allocators, parsers, buffer handling, or refcounting. Pairs the lifetime/bounds reasoning with source→sink confirmation and the shared finding schema.

0
installs
▌
Extracting Nday From A Patch · unboundcompute
Turn a security patch or version diff into fresh findings: infer the fixed vulnerability from what the fix changed, reconstruct the pre-patch bug, then hunt the paths the fix did not cover and the same bug in code it never touched. Use when you have a fix commit, a vague advisory with a linked diff, a version bump, or a "security release" and want to know what it silently fixed and what it missed. Covers reading a fix as a treasure map, incomplete-fix analysis, and variant discovery in the same tree and its forks.

0
installs
▌
Hunting Business Logic Flaws · unboundcompute
Hunt for vulnerabilities that live in what an application is allowed to do, not in how it is coded: workflow steps that can be skipped or reordered, quantity/price/limit values that go negative or overflow a cap, state transitions that should be unreachable, replay and concurrency abuse, and privileged outcomes reached through a sequence of individually-valid requests. Use when reviewing checkout, transfers, redemption, quotas, or any rule the code enforces implicitly. These are the flaws static analysis and scanners structurally miss.

0
installs
▌
Hunting Os Command Injection · unboundcompute
Hunt OS command injection where untrusted input reaches a process-spawning API through a shell that interprets metacharacters. Covers a command string passed to a system or shell-exec call, a spawn that requests a shell, and indirect shells reached through wildcards, subshells, environment values, or an attacker-influenced PATH or IFS. The distinguishing fact is the shell: a direct exec with a fixed program and an argument vector does not interpret metacharacters and is not this bug, while any shell-composed string is. Allowlisting the program name does not help when arguments are interpolated into a shell. Use when input flows into a call that runs a command or spawns a process. The untrusted input is the source, the shell-interpreted command is the sink, and arbitrary command execution is the bug.

0
installs
▌
Auditing AI Agent Permissions · unboundcompute
Audit what an AI agent is actually allowed to do versus what its task needs. Covers excessive agency (tools, scopes, and autonomy beyond the job), missing human-in-the-loop gates on irreversible actions, over-broad credentials and their blast radius, sandbox and code-interpreter escape, unfiltered egress, and unbounded resource or spend (denial-of-wallet). Use when granting an agent a tool or scope, reviewing an agent's permission posture, or deciding which actions need approval. The model's restraint is not a control; permissions are.

0
installs
▌
Auditing Directory Sync Trust · unboundcompute
Audit bulk directory synchronization (LDAP, HR-system, IdP, or cross-directory feeds) between an external identity source and an application for trust misplaced in the sync feed: a sync that trusts a source attribute (group, department, an admin-like flag) to set local privilege or tenancy without validating it, a connector authenticated by a broad credential that can read and reshape the whole directory, a mapping that lets an external group name land on a privileged internal group, a sync that matches accounts by a spoofable key (email, external id) so an attacker record merges into an existing identity, and a source deletion that does not propagate so departed users linger. Use when an external directory feed drives account and privilege state and the application's trust in that feed is the boundary. The attacker-influenced source record is the source, the over-privileged, merged, or lingering internal account is the sink, and the unvalidated attribute mapping or spoofable match key is the bug.

0
installs
▌
Vetting Skills Before Install · unboundcompute
Vet an agent skill or MCP server before you install it, and reach a clear verdict: install, install with constraints, or deny. Combines an instruction-text audit, a declared-versus-used permission diff, and a bundled-code inspection for secret exfiltration (harvesting environment variables, credential files, or dotfiles and sending them out) and for obfuscation and install-time supply-chain risk (decode-then-execute, download-and-run on install, unpinned fetches). Pin the exact artifact you vet, audit each surface, and record the reason for the verdict. Use whenever adding a third-party skill, server, or marketplace entry to an agent. The verdict plus its evidence is the finding.

0
installs
▌
Auditing MCP Tool Integrations · unboundcompute
Red-team the tool layer of an AI agent: the tool definitions, metadata, and outputs that a model reads and trusts. Covers tool poisoning (instructions hidden in a tool's description), tool shadowing and name collisions, rug-pulls (definitions that change after approval), line jumping (metadata acting before any call), token and credential passthrough, and tool-output injection. Use when adding or reviewing a tool, an MCP server, or a tool-marketplace entry, or when auditing an agent's tool manifest. The model reads every tool description as input; treat all of it as untrusted instruction surface.

0
installs
▌
Auditing Ml Model Supply Chain · unboundcompute
Audit the machine-learning models you load as untrusted code, not just data. Covers deserialization RCE from unsafe checkpoint formats (a model file that runs code on load), poisoned or backdoored weights, tampered or trojaned models pulled from a public hub, name and version confusion for model artifacts, and skipped integrity verification. Use when adding a model, checkpoint, or weights file to a pipeline, reviewing where models are loaded, or vetting a third-party model. A model file is executable input until you prove otherwise.

0
installs
▌
Auditing Mobile Deeplink Trust · unboundcompute
Audit how a mobile app handles a deep link, app link, or custom-scheme URL, so an attacker-supplied URL cannot drive a sensitive action or reach a trusted WebView context. Covers a custom scheme any app can register and hijack, an app link whose domain association is unverified so the link is not exclusively the app's, a deep-link parameter that flows unvalidated into a sensitive action, an attacker-controlled URL loaded into a WebView, and a JavaScript bridge exposed to a WebView that can load untrusted content. Use when reviewing deep-link routing, URL handling, and WebView configuration, not the manifest export state of the component that receives the link (that is the component-exposure skill). The attacker-supplied URL is the source, a sensitive action or a trusted WebView bridge acting on it is the sink, and a link parameter trusted without validation is the bug.

0
installs
▌
Hunting Bugs With A Code Graph · unboundcompute
Hunt security bugs across a whole codebase by reasoning over its structure (call graph and dataflow) instead of grepping for keywords. Use when you have source access to an authorized target (your own code, an OSS project, or an in-scope engagement) and want systematic coverage of a bug taxonomy rather than a single hunch; when the question is "who calls this, what reaches this sink, which peer function is unguarded." Orients on an unfamiliar codebase, enumerates the full bug taxonomy before drilling in, and turns structural leads into decided findings.

0
installs
▌
Hunting Dynamic Linker Hijacks · unboundcompute
Hunt local privilege escalation and code execution through the dynamic loader: a preload environment variable honored across a privilege boundary, a writable directory on the runtime library search path, an embedded run-path that points at a writable or origin-relative location, and libraries loaded by an unqualified name. Covers preload variables that survive a privilege transition through a service manager or delegation rule, world- or group-writable library directories a privileged binary searches, run-path entries relative to a writable component, and dynamic loads of a short name. Use when auditing a privileged binary, service, or image for loader-based hijacking. The attacker-controlled library or variable is the source, the loader mapping it into the privileged process is the sink, and the unstripped or writable search path is the bug.

0
installs
▌
Auditing GRAPHQL Attack Surface · unboundcompute
Audit the attack surface a GraphQL API exposes that a plain endpoint does not: schema introspection left open, unbounded query depth and recursion, aliasing and field duplication that multiply cost, query batching that defeats rate limits and enables brute force, field-level authorization that a resolver skips even when the object check passed, and mutations reached without the guard their action needs. Covers the query and variables as the source, the resolver and the data or work it triggers as the sink, and the missing depth, cost, batch, or field guard as the bug. Use when reviewing a GraphQL schema, its resolvers, or a gateway that fronts one. Introspection and cost limits are one audit; per-field and per-mutation authorization is the other.

0
installs
▌
Auditing JWT Verification Trust · unboundcompute
Audit code that verifies a JSON Web Token for a signature or claims check that trusts token-supplied parameters, so an attacker can forge a token the server accepts, after the algorithm pinning and the key source are resolved. Covers an algorithm taken from the token header rather than pinned server-side, an RS256-to-HS256 key confusion where a public key is used as an HMAC secret, an accepted none algorithm or a verification call with signature checking off, a kid, jku, or x5u parameter sourcing a key from an untrusted location, audience, issuer, and expiry claims left unchecked, and an HMAC secret that is weak, guessable, or committed. Use when reviewing the verification call and its options in source, not the token-generation entropy the randomness skill owns or the OAuth flow the OIDC skill owns. A token with an attacker-chosen header or bytes is the source, a verification call that gates identity is the sink, and an unpinned algorithm or a token-sourced key is the bug.

0
installs
▌
Auditing Multi Tenant Isolation · unboundcompute
Audit whether every data operation is scoped to the caller's tenant, so a request in one tenant cannot read or write another's data. Covers a query or object lookup with the object identifier but no tenant predicate, a tenant taken from client-controlled input at the operation rather than the authenticated session, scoping applied on the list path but dropped on the detail, update, delete, or export path, a cache or storage key with no tenant segment, and a background job, report, or privileged connection that runs across tenants or bypasses the mandatory scope. Frames isolation as a systemic invariant, not a single-object reference bug, which a separate skill covers. Use when reviewing data access in a system that serves multiple tenants. The tenant used at the operation is the source, the tenant-scoped data operation is the sink, and a sink scoped by anything but the authenticated tenant is the bug.

0
installs
▌
Hunting Cicd Workflow Injection · unboundcompute
Hunt a CI/CD pipeline for attacker-controlled repository data that reaches a privileged execution context, after the trigger and the token scope are resolved. Covers an untrusted event field (an issue or pull-request title, a branch name, a commit message) interpolated directly into a run-step shell command, a pull_request_target or workflow_run job that checks out and builds the pull-request head with secrets in scope, a third-party action pinned to a mutable tag or branch rather than a commit digest, a cache a low-trust job writes and a privileged job restores and executes, a self-hosted runner reachable from fork pull requests, and an over-scoped pipeline token widening the blast radius. Use when reviewing workflow definitions, their triggers, and their token permissions, not the OIDC trust boundary the CI OIDC skill owns. Attacker-controlled repository data is the source, a privileged pipeline run step or checkout is the sink, and untrusted input reaching execution is the bug.

0
installs
▌
Hunting Ntlm Coercion And Relay · unboundcompute
Hunt authentication coercion and relay on a Windows network, where an attacker induces a privileged machine or account to authenticate to a host it controls and forwards that authentication to a service that does not bind or verify the channel, authenticating as the coerced identity because signing is not enforced and channel binding is absent. Use when services accept network authentication without mandatory signing or channel binding and a privileged host can be induced to authenticate outbound. Covers coercion triggers, relay to directory, certificate, and file services, missing signing, and absent channel binding. The coerced outbound authentication is the source, the relaying service accepting it is the sink, and acting as the coerced privileged identity is the bug.

0
installs
▌
Hunting Search Engine Injection · unboundcompute
Hunt injection into search and analytics engines such as Elasticsearch, OpenSearch, and Solr where untrusted input reaches a query DSL body, a query-string or Lucene query, a script field, or a stored scripting expression. Covers request data that becomes query structure (a filter clause, a field selector, an aggregation) rather than a bound term, a raw query-string parameter whose Lucene syntax the caller controls, and script injection through inline or stored scripts that run in the engine. Use when an application forwards user input into a search cluster as query JSON, a query string, or a script. The untrusted value that becomes query or script structure is the source, the search or script call is the sink, and the missing field allowlist or the enabled dynamic script is the bug.

0
installs
▌
Red Teaming Multi Agent Systems · unboundcompute
Test a system of multiple cooperating AI agents for attacks that exist only because agents message, spawn, and delegate to each other. Covers agent-to-agent injection (agent-in-the-middle), delegation abuse and recursive loops, orchestrator injection, confused-deputy across a trust boundary, identity spoofing between agents, capability collusion, and denial-of-wallet. Use when reviewing an orchestrator, a crew or swarm, agent-to-agent messaging, or any pipeline where one agent's output becomes another agent's input. Every internal edge where output becomes instruction is an injection channel.

0
installs
▌
Auditing Browser Extension Trust · unboundcompute
Audit a browser extension (Manifest V3) for a trust boundary another web page or extension can cross to reach a privileged capability, after the permission scope and the message-sender checks are resolved. Covers an externally_connectable or onMessageExternal handler that verifies an origin but not the calling script, a content-script-to-background message handler with no sender validation, host permissions broader than the extension needs, a web_accessible_resources page that acts on URL parameters, an injected content script writing page-controlled data to a DOM sink, and a weak or eval-permitting content-security policy. Use when reviewing the manifest, background and content scripts, and cross-context message passing, not the web-page DOM sink taxonomy the client-side DOM skill owns. An untrusted web origin or another extension is the source, a privileged extension API or DOM sink is the sink, and a message reaching it without a sender-and-origin check is the bug.

0
installs
▌
Auditing Move Resource Ownership · unboundcompute
Audit a Move smart contract (Aptos or Sui) for a public entry function or a passed object or resource that acts without verifying signer authority, ownership, or capability possession, after the function visibility and the ability set are resolved. Covers a public entry function with no signer-authority check, an object or resource whose ownership is not verified before it is acted on, a capability returned or stored so it can leak and escalate privilege, an ability (key, store, copy, drop) granted too broadly and enabling duplication, arithmetic that overflows without aborting, and an init or upgrade path leaving mutable authority. Use when reviewing module functions, their visibility, and the resource and ability model, not the EVM account-model or reentrancy checks their own skills own. Any signer reaching the function is the source, a state change acting on an unowned resource is the sink, and a missing ownership or authority assertion is the bug.

0
installs
▌
Auditing Scim Provisioning Trust · unboundcompute
Audit a SCIM 2.0 provisioning endpoint for trust misplaced in the identity provider that drives it: a provisioning API authenticated by a weak, shared, or long-lived bearer token anyone holding it can use to create users and grant groups, a handler that lets one tenant's client create or modify users in another tenant, a group or role pushed over SCIM that maps to more privilege than the source attribute should grant, a deprovisioning path that fails to disable a departed user so access lingers, and attribute updates (email, external id, admin flag) trusted without validation so an attacker reassigns an account. Use when an external identity source creates, updates, and deletes accounts over SCIM and the service provider's trust in that source is the boundary. The crafted or replayed SCIM request is the source, the unauthorized account, group, or lingering access is the sink, and the weak provisioning auth or unvalidated attribute mapping is the bug.

0
installs
▌
Hunting Container Escape Surface · unboundcompute
Hunt for the configuration that lets a workload break out of its container onto the node: a pod that runs privileged or adds dangerous capabilities, a host namespace shared into the container (host PID, network, or IPC), a writable host path or device mounted in, and a security context that disables the defenses that would otherwise keep a process inside its container. Covers Kubernetes pods and standalone containers where a compromised or hostile process inside the container tries to reach the node, the kubelet, or other pods. Use when workloads run with elevated security contexts, host mounts, or shared host namespaces. The container process is the source, the node or host resource it reaches is the sink, and the escape the security context permits is the bug.

0
installs
▌
Hunting HTTP Parameter Pollution · unboundcompute
Hunt HTTP parameter pollution, where the same parameter name appears more than once, or a parameter is shaped as an array, and two components in the request path disagree on how to resolve it. A validator, a gateway, or a filter reads one occurrence while the backend sink reads another, so a value that passes a check is not the value that is used, and a control is bypassed, an authorization decision is confused, or a payload is smuggled past a filter. First-versus-last-wins differentials, array-versus-scalar coercion, and a gateway that concatenates duplicates while the app splits them are the usual mechanisms. The bug exists only when two parsers differ, so proving the differential is the whole task. Use when duplicate or array-shaped parameters cross more than one parser. The duplicated parameter is the source, the sink that resolves it differently from an earlier check is the sink, and the parser disagreement is the bug.

0
installs
▌
Hunting Redos And Complexity Dos · unboundcompute
Hunt single-request denial of service from super-linear work: untrusted input reaching a backtracking regular expression, a quadratic or worse algorithm, or a hash-keyed structure with attacker-chosen keys, with no size or complexity guard between. Covers regular expressions with nested or ambiguous quantifiers that explode on a crafted non-matching string, accidental nested scans and unbounded parsers over attacker-sized input, repeated string building in a loop, and hash flooding where predictable unseeded keys turn constant-time lookups quadratic. Use when reviewing code where request-controlled strings, collections, or numbers reach an expensive operation and the cost can grow faster than the input. The input's size or content is the source, the super-linear operation is the sink, and the missing bound is the bug.

0
installs
▌
Hunting Reflected And Stored Xss · unboundcompute
Hunt reflected and stored cross-site scripting in server-rendered responses, where untrusted request or stored data is placed into an HTML response in a context whose encoding is missing or wrong, so the value becomes markup or script that runs in the victim's session. Covers the output context that decides the correct encoding, HTML body versus quoted or unquoted attribute versus inline script versus URL versus CSS, a template raw or safe marker that disables autoescaping, JSON embedded in a page, and the reflected versus stored delivery paths. Use when reviewing server-side templates or string-built HTML that include request or database data; DOM-based sinks are a separate skill. The untrusted data rendered into the page is the source, the HTML output context is the sink, and script execution in the victim's session is the bug.

0
installs
▌
Hunting Xxe And XML Parser Trust · unboundcompute
Hunt XML external entity injection and unsafe XML parser features where untrusted XML is parsed with document type definitions, external general or parameter entities, or XInclude enabled. Covers in-band file disclosure and server-side request forgery through external entities, blind out-of-band exfiltration through parameter entities, and denial of service through entity expansion. The XML often hides inside other formats: office documents, SVG images, SOAP calls, and identity assertions all carry a parser that may resolve entities. The single fact that decides the class is the parser configuration on the specific library and version in use. Use when a service parses XML from a request body, an upload, or a federated message. The untrusted XML is the source, the entity-resolving XML parser is the sink, and file disclosure, request forgery, or expansion denial of service is the bug.

0
installs
▌
Testing RAG And Memory Poisoning · unboundcompute
Test whether an attacker can plant content in the knowledge an AI agent later retrieves and trusts: a RAG index or vector store, an agent's persistent memory, or the search and web results it pulls at runtime. Covers poisoned documents that surface as authoritative context, memory entries that persist across sessions, retrieval-ranking abuse, and injected instructions that ride retrieved chunks. Use when reviewing a RAG pipeline, an agent with long-term memory, or any retrieval step feeding the model. The poison fires on an innocent query.

0
installs
▌
Auditing Idp Initiated Flow Trust · unboundcompute
Audit identity-provider-initiated single sign-on for trust placed in an unsolicited assertion the application never asked for: an IdP-initiated SAML response the service provider accepts with no matching request so there is no request state to bind it to, an unsolicited assertion an attacker captures and replays or delivers to a victim to log them into an attacker-chosen account, a RelayState value trusted as a redirect target so it becomes an open redirect, an assertion with no or a too-wide audience so it is accepted by a service provider it was not meant for, and a missing replay defense (no one-time-use, weak expiry) that lets one assertion be used more than once. Use when an application accepts a login assertion it did not request and the validation of that unsolicited assertion is the boundary. The unsolicited or replayed assertion is the source, the unintended authenticated session is the sink, and the missing request binding, audience, or replay defense is the bug.

0
installs
▌
Exploiting Ssrf To Cloud Metadata · unboundcompute
Adjudicate whether a server-side request-forgery primitive actually reaches high-value internal targets, especially a cloud instance metadata endpoint that hands out credentials. Covers proving the fetch is attacker-steered, reaching link-local and internal addresses, defeating allowlist and parser-based filters through DNS rebinding and URL confusion, retrieving instance credentials, and blind out-of-band confirmation. Use when a feature fetches a URL, host, or address the user can influence, or when triaging an SSRF lead for real impact.

0
installs
▌
Hunting Smart Contract Reentrancy · unboundcompute
Hunt a smart contract for state that is mutated after an external call, so an attacker re-enters before the update lands and acts on stale state. Covers a withdrawal or transfer that sends value before zeroing the balance, a call to an attacker-controlled contract or token that re-enters the same function, cross-function reentrancy where the callback re-enters a different function sharing the same state, a callback hook (a token receive hook, a fallback) that hands control to the attacker mid-update, and read-only reentrancy where a view another contract trusts returns mid-transaction state. Use when the fix would reorder effects before interactions or add a reentrancy guard, not add an authorization check (that is the access-control skill). The external call before the state update is the source, the re-entered function acting on stale state is the sink, and interaction-before-effects is the bug.

0
installs
▌
Hunting Unsafe Archive Extraction · unboundcompute
Hunt unsafe extraction of untrusted compressed archives: an entry's declared path escaping the destination directory (traversal or an absolute path), a symlink or hardlink entry that a later entry writes through to reach outside, decompression amplification where a small archive expands to exhaust disk or memory, and content or name confusion where an extracted file is later executed, served, or loaded. Covers import, restore, plugin-install, and upload features that unpack archives from users or remote sources, and the difference between checking a path and checking the path a symlink resolves to. Use when reviewing code that extracts an archive whose contents come from an untrusted source. The archive entry's path, link target, or declared size is the source, the filesystem write or allocation during extraction is the sink, and the missing containment check is the bug.

0
installs
▌
Reviewing Content Security Policy · unboundcompute
Review a content security policy as a script-injection defense and judge whether it would actually stop injected script, with the discipline that a weak policy is a real finding mainly where an injection sink it would otherwise block exists. Covers a script source that allows inline script with no neutralizing nonce or hash, that allows arbitrary hosts or data URLs, or that trusts a host serving attacker-usable script; a nonce that is static, reused, low-entropy, or reflected from input; a missing base-uri or object-src that defeats an otherwise strong nonce policy; and a report-only header shipped as the only policy. Use when reviewing a policy in a response header, a meta tag, or config, alongside the pages it protects. The policy is the control under test, injected script is the sink it must block, and a gap the injection reaches is the bug.

0
installs
▌
Auditing Break Glass Account Trust · unboundcompute
Audit emergency break-glass and privileged-access accounts for the ways their standing power outlives the emergency they exist for: a break-glass account with a static, shared, or never-rotated credential that is a permanent superuser login rather than a sealed last resort, an emergency account excluded from the MFA, conditional-access, or logging controls covering other admins so its use is easy and invisible, a just-in-time elevation that grants more than the task needs or is not revoked when the task ends, an emergency-access path with no approval, time bound, or alerting so it is used routinely, and a break-glass use that triggers no review afterward. Use when a standing emergency identity or an elevation path holds power beyond ordinary admins and the controls around when and how it is used are the boundary. The break-glass credential or elevation request is the source, the unbounded or unaudited privileged access is the sink, and the missing rotation, control coverage, or use-time alerting is the bug.

0
installs
▌
Auditing Declarative Authorization · unboundcompute
Audit authorization expressed as configuration or framework convention rather than inline code: row-level security and policy rules, framework before-action and middleware filters that must be attached to every protected route, serverless and gateway access rules, and object-ownership checks. Covers routes that skip the filter, policies with a permissive default, rules that check authentication but not ownership, and gaps between where the rule is declared and where the data is accessed. Use when reviewing role- or policy-driven access control. Coverage and correctness are separate checks.

0
installs
▌
Auditing Machine Identity Issuance · unboundcompute
Audit how a platform issues machine and workload identities (certificate authorities, workload-identity federation, service-mesh identity, attestation-based credentialing) for trust misplaced in the thing asking for one: a credential issued on a weak or forgeable proof (a self-asserted name, an unvalidated label, a reachable metadata endpoint) so forging the proof yields a real identity, an issuing authority not constrained to the names it may mint, a federation trust configured so broadly (a wildcard subject, unpinned issuer, missing audience) that an outside principal can assume it, a certificate with an over-long lifetime or no revocation, and an issuance path with no binding to a verified workload. Use when a platform decides what proof earns a machine identity and that is the boundary. The forgeable issuance proof or over-broad trust is the source, the illegitimately issued machine identity is the sink, and the weak attestation, unconstrained issuer, or over-broad federation trust is the bug.

0
installs
▌
Auditing Presigned Url Scope Abuse · unboundcompute
Audit presigned object-storage URLs for scope that grants more than the request intended: a signature that covers a broader key, prefix, or bucket than the user should reach, an overlong expiry, a method or content-type left unconstrained, or a signer identity whose permissions exceed the caller's. Covers presigned GET and PUT URLs for S3 and compatible stores, where the signed policy is the only boundary once the URL leaves the server, and where an attacker who edits the key, reuses the URL, or uploads a different object escapes the intended scope. Use when a service mints presigned URLs so clients read or write storage directly. The caller-influenced key or policy input is the source, the signing call is the sink, and the signed scope wider than the caller's entitlement is the bug.

0
installs

194 published skills · page 2 of 2