Claude Skills by UnboundCompute

Audit payment provider callbacks and settlement notifications for the trust that lets an attacker forge or alter a payment result: a callback whose signature is not verified so a spoofed success is accepted, an amount or currency taken from the callback or client rather than reconciled against the order the server created, a success notification not bound to a specific order so it can be replayed onto another order, and a settled status trusted without confirming it out of band with the provi...

Audit payment and checkout state machines for transitions an attacker can drive out of order or replay for value: an order marked paid before the charge is confirmed, a step that can be skipped or repeated so goods ship without settlement, a non-idempotent charge or fulfillment endpoint that double-processes on a retried or replayed request, and a refund or cancel that returns value while the underlying charge stays captured. Covers checkout, charge, fulfillment, and refund flows where money ...

Audit presigned object-storage URLs for scope that grants more than the request intended: a signature that covers a broader key, prefix, or bucket than the user should reach, an overlong expiry, a method or content-type left unconstrained, or a signer identity whose permissions exceed the caller's. Covers presigned GET and PUT URLs for S3 and compatible stores, where the signed policy is the only boundary once the URL leaves the server, and where an attacker who edits the key, reuses the URL,...

Audit security-sensitive values for weak randomness: a non-cryptographic generator, a predictable or constant seed, a reused nonce or initialization vector, or an output too short to resist guessing, feeding a value whose only defense is unpredictability. Covers session and authentication tokens, password-reset and verification links, cross-site-request tokens and one-time codes, and cryptographic nonces or initialization vectors, drawn from a statistical generator instead of a cryptographic ...

Audit object-storage ownership and per-object access for trust the bucket policy does not cover: an object uploaded by another account that keeps that uploader's ownership and ACL, a bucket where object ACLs still grant access despite a restrictive bucket policy, a cross-account write that lands an object the bucket owner cannot read or that carries a public grant, and a policy that scopes by prefix while an ACL on the object overrides it. Covers S3 and compatible stores where object ownershi...

Audit federated single sign-on for assertions a relying party should not trust: a SAML response whose signature is not verified over the right element so a wrapped or altered assertion passes, an OIDC ID token whose issuer, audience, or nonce is unchecked, a relying party that accepts an assertion for any user because the subject or email is trusted without binding, and a federation that honors an identity provider or signing key it should not. Covers SAML and OpenID Connect where a relying p...

Audit federated single sign-on for the flaws that let an attacker forge or replay an identity: signature wrapping and signature stripping on signed assertions, unsigned or unverified tokens accepted, redirect_uri and audience manipulation, missing state and nonce allowing replay and cross-site request forgery, and identity confusion where one provider's assertion is honored for another account. Use when reviewing a SAML or OIDC integration, an identity-provider connection, or any login that t...

Audit updater and bootloader code for a firmware trust boundary that lets an unsigned or downgraded image be flashed or booted. Covers an update image that reaches a flash write or a boot jump with no signature check between receipt and commit, a verification result that is ignored or inverted, an integrity hash mistaken for an authenticity signature, a signature checked over the wrong or partial bytes or over a different buffer than the one committed, a verification key kept in writable stor...

Audit whether an application actually records the security events an investigation would need, and whether the logs themselves leak or lie: a security decision (authentication, an authorization denial or sensitive grant, a credential or privilege change, access to sensitive data) that fires with no durable record, an audit entry missing the actor, target, or outcome, secrets or personal data flowing into a widely-readable log, and untrusted input written to a log without neutralizing line bre...

Audit event-driven function handlers that trust the event because it arrived from inside the platform: a handler that treats any delivered event as authentic without verifying its true source or integrity, event fields flowing untrusted into a database write, command, downstream call, or constructed path, a function reachable by several event types or actors that runs privileged logic for one that should not trigger it, and an over-broad execution identity that turns a single spoofed or injec...

Audit a service mesh for the trust it claims but does not enforce: a mesh in permissive mode that accepts plaintext alongside mutual TLS so an unauthenticated caller still gets through, an authorization policy that is absent, scoped too narrowly, or defaults to allow, a workload reachable outside the mesh that bypasses the sidecar entirely, and an identity check that trusts a header a caller can set. Covers service meshes where sidecars are supposed to enforce mutual TLS and per-service autho...

Audit how an application issues, rotates, and destroys session identifiers, so an attacker cannot fixate or outlive a session. Covers a session identifier not regenerated at login or privilege change, a logout that clears the client cookie but leaves the server session valid, a session that never expires or has no idle or absolute timeout, an identifier accepted from a URL or a header an attacker can seed, a session cookie missing the secure, http-only, or same-site attributes, and a cookie s...

Lint the natural-language instruction text of an agent skill or MCP server, not its code: the skill body, the frontmatter description, tool descriptions, and parameter text a model reads and obeys. Covers instructions hidden in comments or markup, invisible and look-alike Unicode, override phrases that countermand earlier instructions, concealment directives that tell the agent to hide an action from the user, and instructions that steer the agent to read secrets and send them out. Use when r...

Audit a smart contract for a privileged action any caller can reach, so an attacker invokes a function that should be restricted. Covers a state-changing or fund-moving function missing an authorization modifier, an ownership or role check that is wrong or bypassable, an unprotected initializer that lets an attacker seize ownership of a proxy or an uninitialized contract, a delegatecall to an attacker-supplied or upgradeable target that runs foreign code in this contract's context, a self-des...

Audit secure-shell trust hygiene, not cipher hardening: a forwarded authentication agent a remote host can abuse to log in as you elsewhere, client configuration or a proxy-command directive influenced by an untrusted source, host-key verification disabled or blind-accepted so a machine-in-the-middle succeeds, and authorized-key entries whose forced command can be escaped or whose source and forwarding are unrestricted. Covers agent-socket exposure on multi-user or untrusted hosts, config and...

Audit an AI application for confidential material bleeding out of the model context: a system prompt that carries secrets (API keys, internal URLs, business rules, hidden instructions) and can be coaxed out verbatim, retrieved documents or tool outputs from one user surfacing in another user's answer, conversation or memory from one session or tenant leaking into the next, and a debug or error path that echoes the raw prompt or context. Covers assistants, chat features, and agents where a sys...

Audit infrastructure-state storage and its backend for exposure and tampering: a state file holding plaintext secrets in a backend readable by too many principals, a state bucket or backend without encryption, versioning, or access scoping, a missing or unenforced state lock that allows concurrent corrupting writes, and a backend configuration that lets an attacker redirect state to a location they control. Covers Terraform and similar tools where the state file records real resource attribut...

Find where an AI agent becomes dangerous: the trust context in which access to private data, exposure to untrusted content, and an ability to send data out all coexist. Any two legs are usually safe; all three let planted content make the agent read secrets and exfiltrate them. Use when designing or reviewing a tool-using LLM agent, before granting it a new tool or data scope, or to judge whether a prompt injection is actually exploitable. Covers capability inventory, the three legs, kill-cha...

Audit a web application for trust placed in third-party scripts it loads into its own page: an external script tag with no Subresource Integrity hash so a compromised CDN or vendor serves altered code that runs with full page privileges, a tag manager or analytics loader that injects further scripts the site never reviews, a script served over a mutable URL or wildcard source that can be swapped, and a Content-Security- Policy that is missing or permissive enough to allow arbitrary external s...

Audit client code for transport security that is disabled or defeated, so an attacker on the network path can intercept a connection the client believes is protected. Covers verification switched off (a trust-all setting, a permissive flag, an environment override), a custom trust manager or callback that returns success unconditionally, a hostname check that is skipped or always passes, acceptance of an expired or self-signed certificate through a swallowed error, certificate pinning that is...

Audit the server side of passwordless authentication for ceremony-verification bugs that let an attacker-shaped response become an authenticated session. Covers a registration or authentication ceremony whose challenge is not bound to a server-issued single-use value, an origin or relying-party identifier that is never checked or checked by substring, a user-verification flag ignored when policy required it, attestation accepted when it was required, a signature counter regression that hides ...

Audit both directions of webhook trust: an inbound handler that acts on a payload without proving it authentic, and an outbound fetch of a caller-supplied URL that reaches internal targets. Covers inbound handlers with no signature check, a signature compared in non-constant time, a signature computed over a re-serialized body instead of the exact raw bytes, a verification result that is computed but never enforced, and no timestamp or replay defense; and outbound callback or fetch URLs valid...

Audit a WebSocket endpoint for trust established once at the handshake and never re-checked, so a cross-site page or a post-handshake message drives a privileged action, after the origin check and the credential source are resolved. Covers a missing or always-true origin check on the upgrade with ambient-cookie authentication, authentication at the handshake with no per-message authorization, a message treated as transport into a downstream injection sink, an unbounded frame or connection all...

Audit how a workload holds its secrets for the exposure that outlives the secret's intent: a secret passed as an environment variable that any process, crash dump, or child inherits and that debug endpoints echo, a secret volume mounted where a sidecar or a shared process can read it, a secret written into logs or an error, and a Kubernetes secret readable by more service accounts than the one workload that needs it. Covers containerized workloads where secrets reach the process through envir...

Find memory-safety bugs in C/C++ and other unmanaged code - use-after-free, double-free, out-of-bounds read/write, uninitialized use, and NULL deref - by reasoning about object lifetime and buffer bounds along real code paths. Use on an authorized source target when a candidate catalog does NOT model these temporal/lifetime classes (most don't), so a keyword or sink scan will miss them; when reviewing allocators, parsers, buffer handling, or refcounting. Pairs the lifetime/bounds reasoning wi...

Find concurrency and time-of-check/time-of-use bugs - TOCTOU, unsynchronized shared state, check-then-act, and atomicity violations - by reasoning about what state is shared, what can interleave, and where a window opens between a check and its use. Use on an authorized source target when the risk is ordering, not a single tainted value; when reviewing multithreaded code, shared caches/counters, filesystem checks, or "verify then act" sequences (balance checks, auth-then-use, dedup guards). C...

Enumerate network-management exposure through the simple network-management protocol: default and guessable community strings, weak or downgradeable versions, read views that leak interface tables, routing and neighbor data, running configuration, process and user lists and sometimes credentials, and writable objects that let you change device state. Covers guessable read and write community strings, version-one and version-two exposure where authentication is a shared string sent in the clea...

Systematically test whether a model's safety and policy guardrails hold under adversarial pressure, as a repeatable evaluation rather than a one-off trick. Covers building a policy-grounded probe set, multi-turn escalation, encoding and obfuscation bypasses, role and context reframing, instruction-hierarchy conflicts, and measuring bypass rate with reproducible graded outcomes. Use when reviewing a model deployment, a system prompt, or a content-safety layer, or before shipping an assistant t...

Adjudicate whether a server-side request-forgery primitive actually reaches high-value internal targets, especially a cloud instance metadata endpoint that hands out credentials. Covers proving the fetch is attacker-steered, reaching link-local and internal addresses, defeating allowlist and parser-based filters through DNS rebinding and URL confusion, retrieving instance credentials, and blind out-of-band confirmation. Use when a feature fetches a URL, host, or address the user can influence...

Turn a security patch or version diff into fresh findings: infer the fixed vulnerability from what the fix changed, reconstruct the pre-patch bug, then hunt the paths the fix did not cover and the same bug in code it never touched. Use when you have a fix commit, a vague advisory with a linked diff, a version bump, or a "security release" and want to know what it silently fixed and what it missed. Covers reading a fix as a treasure map, incomplete-fix analysis, and variant discovery in the sa...

Find exploitable cryptographic misuse, not theoretical weakness: reused nonces (stream and counter/GCM keystream reuse, ECDSA private-key recovery from a repeated per-signature secret), padding oracles that decrypt ciphertext, hash length-extension on naive MAC constructions, predictable or reused IVs and keys, and a hash chosen for the wrong job. Use when reviewing code that encrypts, signs, authenticates, or hashes, or when a protocol rolls its own crypto. The finding is a concrete recovery...

Find security controls that grant access when they should deny it: an authorization check that returns allow on error or timeout, an empty or wildcard allowlist that matches everything, a default-allow branch when input is missing or unrecognized, and a caught exception that swallows a denial and continues. Use when reviewing authentication, authorization, or any gate whose failure path matters, or when a check "passes" for reasons you have not confirmed. The dangerous default is allow; prove...

Hunt the SQL injection that first-order testing misses: blind injection where the response carries no error or data and the signal is a boolean difference or a timing delay, and second-order injection where input is stored safely on one request and later concatenated into a query on a different code path. Covers values that reach a query only after being read back from the database, a cache, or a log, and sinks that reveal nothing directly so confirmation depends on an inferential channel. Us...

Hunt broken object-level authorization (BOLA, also called IDOR): endpoints that accept a client-supplied object reference - a numeric id, UUID, key, slug, filename, or an id nested in a request body or token - and read or mutate that object without checking the authenticated caller is entitled to it. Covers direct references, enumerable and guessable ids, references buried in nested or batch payloads, second-order ids stored then trusted later, and ownership checks that run on one path but no...

Given one confirmed vulnerability, systematically find its siblings: the same defect shape repeated elsewhere in the codebase, and the parts of it the fix left uncovered. Use right after you confirm or read about a bug (your own finding, a CVE, a patch, a writeup) and want the other instances instead of stopping at one. Turns a single seed into a structural signature and sweeps the whole tree for same-shape code, copy-paste clones, sibling handlers, and incomplete fixes. Covers signature extr...

Hunt security bugs across a whole codebase by reasoning over its structure (call graph and dataflow) instead of grepping for keywords. Use when you have source access to an authorized target (your own code, an OSS project, or an in-scope engagement) and want systematic coverage of a bug taxonomy rather than a single hunch; when the question is "who calls this, what reaches this sink, which peer function is unguarded." Orients on an unfamiliar codebase, enumerates the full bug taxonomy before ...

Hunt for vulnerabilities that live in what an application is allowed to do, not in how it is coded: workflow steps that can be skipped or reordered, quantity/price/limit values that go negative or overflow a cap, state transitions that should be unreachable, replay and concurrency abuse, and privileged outcomes reached through a sequence of individually-valid requests. Use when reviewing checkout, transfers, redemption, quotas, or any rule the code enforces implicitly. These are the flaws sta...

Hunt a CI/CD pipeline for attacker-controlled repository data that reaches a privileged execution context, after the trigger and the token scope are resolved. Covers an untrusted event field (an issue or pull-request title, a branch name, a commit message) interpolated directly into a run-step shell command, a pull_request_target or workflow_run job that checks out and builds the pull-request head with secrets in scope, a third-party action pinned to a mutable tag or branch rather than a comm...

Hunt for ways attacker-influenced code or a tool call escapes the sandbox an AI application runs it in: a code-interpreter or tool runtime that executes model-generated code with network access, a writable host filesystem, or credentials it should never see, a sandbox that shares a kernel, a mount, or an environment variable with the host so the guest reaches out, a resource with no CPU, memory, time, or output bound so one run starves the host, and a tool whose arguments reach a shell or a p...

Hunt injection into database connection strings and JDBC or driver URLs where untrusted input sets the host, a driver property, or a URL parameter, turning a data connection into a request to an attacker server or an unsafe driver feature. Covers a tenant, hostname, or option taken from input and spliced into a connection URL, driver properties that enable local file reads, arbitrary command execution, or class loading, and multi-attribute connection strings where an extra property overrides ...

Hunt for the configuration that lets a workload break out of its container onto the node: a pod that runs privileged or adds dangerous capabilities, a host namespace shared into the container (host PID, network, or IPC), a writable host path or device mounted in, and a security context that disables the defenses that would otherwise keep a process inside its container. Covers Kubernetes pods and standalone containers where a compromised or hostile process inside the container tries to reach t...

Hunt a decentralized-finance protocol for a way to profit by moving a price or breaking an economic invariant, rather than by defeating an access check or re-entering. Covers a price read from a spot source an attacker can move within a transaction, a manipulable oracle or a single-source feed with no sanity bound, a swap or liquidation that trusts a pool ratio a flash loan can skew, rounding or fee-accounting that a repeated interaction drains, share or collateral math that lets a first or p...

Hunt server-side request forgery and DNS rebinding that turn a server into a proxy for the internal network: a URL or hostname a caller controls that the server fetches, a validation that checks the hostname once but connects later so a rebinding answer swaps it for an internal address, a redirect the fetcher follows into internal space, and a reached internal service (metadata endpoint, admin port, database) that trusts callers by network position. Covers server-side fetchers, webhooks, impo...

Hunt .NET deserialization where untrusted input reaches a formatter that resolves the type from the data itself: BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter or ObjectStateFormatter on ViewState, or Json.NET and similar with type-name handling enabled. Covers formatters that instantiate an attacker-named type and drive a gadget through a set accessor, a callback, or a converter to a command, a process start, or a file operation. Use when a service reads serialized ....

Hunt local privilege escalation and code execution through the dynamic loader: a preload environment variable honored across a privilege boundary, a writable directory on the runtime library search path, an embedded run-path that points at a writable or origin-relative location, and libraries loaded by an unqualified name. Covers preload variables that survive a privilege transition through a service manager or delegation rule, world- or group-writable library directories a privileged binary ...

Hunt expression-language injection where untrusted input reaches a server-side expression evaluator: Spring Expression Language, OGNL, MVEL, JEXL, a Jakarta or JSP EL context, or a rules engine that evaluates strings. Covers request data flowing into an expression compiled and evaluated at runtime, where the language exposes type access, method calls, or a runtime handle that reaches command execution. Use when the application evaluates expressions built from or influenced by untrusted input ...

Hunt the attack surface a firmware image ships by mistake: a secret baked into the binary, a debug or diagnostic interface left enabled, a network service exposed by default, or a privileged command or update path reachable with no authentication. Covers a private key, symmetric key, or backdoor credential compiled into the image and used for authentication, a serial or on-chip debug console that drops to a privileged shell without auth, a management or plaintext service bound to every interf...

Hunt injection through Kubernetes packaging templates and their values: an untrusted value rendered into a manifest without quoting so it injects YAML structure, a value that flows into a container command, an annotation, or an RBAC rule and grants more than intended, and a chart that renders privileged security context or host access from a caller-supplied value. Covers Helm-style templating where a values file or a user-supplied override is rendered into Kubernetes manifests, and where an u...

Hunt for request smuggling where two HTTP processors on the same path disagree about where one request ends and the next begins: a front end and back end that resolve conflicting Content-Length and Transfer-Encoding headers differently, a proxy that forwards a body the origin re-parses, a keep-alive connection where a smuggled prefix poisons the next user's request, and a rewrite or normalization difference that desyncs the stream. Covers chained HTTP/1.1 processors, proxies, load balancers, ...

Hunt privilege-escalation paths in cloud identity and access management: a low-privileged principal that chains role assumptions, policy rewrites, role-passing, and over-broad trust relationships to reach an administrative or data-access principal. Covers the identity-to-permission-to-resource graph, the known escalation primitives (passing a more privileged role to a service, rewriting a policy to a permissive version, assuming a role whose trust condition is too loose), and the boundary con...