Claude Skills by UnboundCompute

Hunt Java deserialization that turns an untrusted byte stream into code execution: attacker-controlled data reaching readObject, an ObjectInputStream, or a framework endpoint that deserializes, with a gadget on the classpath whose readObject or finalizer drives a property-oriented chain to a dangerous call. Covers native serialization, JNDI lookups reached through deserialized objects, and framework entry points that accept a serialized object over HTTP, a message queue, a cache, or a cookie....

Hunt for node-level Kubernetes endpoints that are reachable and under-authenticated: a kubelet API that allows anonymous or unauthenticated requests to list pods, read logs, or exec into containers, a read-only kubelet port exposing pod and node data, a node-local metadata or debug endpoint reachable from a pod, and a kubelet authorization mode that authenticates but does not restrict what a caller can do. Covers Kubernetes nodes where the kubelet and other node-local services expose control ...

Hunt LDAP injection and bind-trust flaws where untrusted input reaches a directory query or an authentication bind: a request value spliced into a search filter or a distinguished name without escaping, letting the caller alter the filter logic or the search base, and authentication flows that bind with attacker-influenced credentials in ways that permit anonymous or unauthenticated bind to pass as success. Covers filter metacharacter injection, DN injection that changes the subtree searched,...

Hunt mass assignment and broken object-property authorization: handlers that bind a client request payload straight onto a record or model and let the caller write fields it should never control - role, is_admin, owner_id, tenant, price, balance, verified, status, or another user's foreign key. Covers auto-binding and hydration that take the whole payload, blocklist filters that miss a field, nested and relation fields that reopen the hole, type juggling that flips a flag, and read paths that...

Hunt for value a validator or searcher can extract by controlling the order of transactions in a block: a swap or trade with no slippage bound that a sandwich attack front-runs and back-runs, an oracle update or liquidation whose profit depends on being sequenced first, an on-chain action that leaks its intent to the public mempool before it settles, and a protocol that assumes fair ordering when block producers choose it. Covers DeFi swaps, AMMs, lending liquidations, auctions, and any on-ch...

Hunt a mobile app for a real credential shipped in the binary or written to storage another party can read, scoped strictly to mobile-specific sinks. Covers a live secret embedded in the app package or its resources, sensitive data written to world-or-sandbox-readable storage without encryption, a secret placed outside the platform keystore where a weaker guard protects it, data cached or logged where another app or a device-level reader reaches it, and a backup or debug path that carries sen...

Hunt for gaps in how a service establishes and verifies the identity of the peer calling it: a mutual-TLS endpoint that requests a client certificate but does not require or verify it, verification that checks the certificate chains to a trusted authority but never checks which identity it names, a trust anchor broad enough that any certificate it issued is accepted as any service, and an identity derived from a spoofable attribute (a header, a source IP) instead of the verified certificate. ...

Hunt machine credentials that are live, over-privileged, and actually reachable, not just present. Covers non-human identities and secrets across code, configuration, and infrastructure definitions: API keys, service-account credentials, and long-lived tokens. Separates a secret that merely exists from one an attacker can reach and use, and adjudicates each by whether it is still valid, how much it grants, and whether an untrusted path leads to it. Use when reviewing secret exposure, machine ...

Hunt NoSQL injection where untrusted input becomes query structure rather than a bound value: a request body whose keys turn into query operators, a value that arrives as an object instead of a scalar, or input reaching a server-side JavaScript evaluation such as $where, a mapReduce function, or an aggregation expression. Covers document stores where a filter built from a request object lets the caller inject comparison operators, always-true conditions, or code, and key-value or wide-column ...

Hunt injection that survives an object-relational mapper or query builder: untrusted input reaching a raw-query escape hatch, an unparameterizable identifier (a column, table, or sort order), or a structured filter or update object whose keys become query operators or column references. Covers raw-query methods that take a string or fragment, sort and column selectors taken from the request, and operator injection where a request body passed as a filter turns a comparison always-true or refer...

Hunt PHP object injection where untrusted input reaches unserialize or a framework unserializer and a reachable class carries a magic method that fires during or after reconstruction. Covers native unserialize on request data, cookies, or cache entries, phar deserialization triggered by filesystem functions on an attacker-controlled path, and property-oriented programming chains through __wakeup, __destruct, __toString, and __call that reach a file write, a command, or an SQL sink. Use when a...

Hunt for ways a buyer can control the price the server charges: a price, quantity, or line total taken from the client request instead of recomputed server-side from a trusted catalog, a negative or overflowing quantity that drives the total down or wraps it, a discount or coupon that stacks, reuses past its limit, or applies to items it should not, and a total computed on the client and trusted at checkout. Covers e-commerce carts, checkout totals, and promotion engines where the amount char...

Hunt Python deserialization that executes attacker code: untrusted input reaching pickle.loads, an unsafe YAML load, marshal, jsonpickle, dill, or a numpy or pandas loader that unpickles, where the format supports arbitrary object construction through __reduce__ or a tag. Covers pickled data in requests, cookies, caches, message queues, and model or dataframe files, and YAML documents that instantiate arbitrary Python objects. Use when a service loads serialized Python objects it did not prod...

Hunt single-request denial of service from super-linear work: untrusted input reaching a backtracking regular expression, a quadratic or worse algorithm, or a hash-keyed structure with attacker-chosen keys, with no size or complexity guard between. Covers regular expressions with nested or ambiguous quantifiers that explode on a crafted non-matching string, accidental nested scans and unbounded parsers over attacker-sized input, repeated string building in a loop, and hash flooding where pred...

Hunt local privilege escalation through scheduled jobs and the paths privileged processes trust: periodic and timer jobs whose script, or a file or directory they read, is writable by a lower-privileged user; commands invoked by an unqualified name resolved through a writable search-path entry; and argument injection where a command expands a shell wildcard over a directory an attacker can write to, so a file named like an option (a leading-dash filename) becomes a command-line flag. Covers w...

Hunt injection into search and analytics engines such as Elasticsearch, OpenSearch, and Solr where untrusted input reaches a query DSL body, a query-string or Lucene query, a script field, or a stored scripting expression. Covers request data that becomes query structure (a filter clause, a field selector, an aggregation) rather than a bound term, a raw query-string parameter whose Lucene syntax the caller controls, and script injection through inline or stored scripts that run in the engine....

Hunt server-side prototype pollution in JavaScript and TypeScript backends where untrusted input sets a __proto__, constructor, or prototype key through a recursive merge, a deep clone, a path-based set, or a query or body parser, polluting Object.prototype so a later property read returns an attacker value. Covers the pollution primitive (the write that reaches the prototype) and the gadget (a downstream read of an unset property that changes control flow, a command, a template, or a query)....

Hunt local privilege escalation through setuid and setgid binaries and per-file capabilities: programs that run as a more privileged identity, or files granted a capability such as changing user id, overriding file permissions, raw disk or memory access, or loading kernel modules, that expose an exec, file-read, file-write, or library-load primitive an unprivileged caller can reach. Covers known dangerous tools left with the bit set, custom or bundled setuid programs that shell out or trust a...

Hunt for signed messages a contract or backend accepts more than once or in a context they were never meant for: an EIP-712 signature with no nonce so it replays, a signature missing chain id or verifying-contract in its domain separator so it replays across chains or deployments, a permit or meta-transaction reused after it was already consumed, a signature whose signed fields omit something the action depends on so a different action reuses it, and a signer recovery that accepts a malleable...

Hunt a smart contract for state that is mutated after an external call, so an attacker re-enters before the update lands and acts on stale state. Covers a withdrawal or transfer that sends value before zeroing the balance, a call to an attacker-controlled contract or token that re-enters the same function, cross-function reentrancy where the callback re-enters a different function sharing the same state, a callback hook (a token receive hook, a fallback) that hands control to the attacker mid...

Hunt DNS records that point at infrastructure the organization no longer controls, so an attacker can claim the target and serve content under a trusted name. Covers a CNAME or ALIAS to a decommissioned platform host that the provider lets anyone re-register, a dangling NS delegation whose nameserver or zone no longer exists in the account, a record that outlives its resource because infrastructure-as-code or a teardown pipeline deletes the resource but not the record, and a wildcard or uncla...

Hunt for the ways an attacker gets code into your build without touching your repo: dependency confusion (a public package shadowing an internal name), typosquatting and slopsquatting (a package named after a model's hallucination), poisoned pipeline execution (untrusted input running as a build step), and over-privileged or injectable CI. Use when reviewing a build pipeline, a dependency manifest, an internal package registry, or a CI/CD configuration. The app code can be clean while the art...

Hunt unsafe extraction of untrusted compressed archives: an entry's declared path escaping the destination directory (traversal or an absolute path), a symlink or hardlink entry that a later entry writes through to reach outside, decompression amplification where a small archive expands to exhaust disk or memory, and content or name confusion where an extracted file is later executed, served, or loaded. Covers import, restore, plugin-install, and upload features that unpack archives from user...

Hunt for dApp flows that trick a user's wallet into signing away its assets: an unlimited or unnecessary token approval a user grants to a contract that can then move all of their tokens, a signed permit or approve-for-all that authorizes spending far beyond the intended action, a blind-signing prompt that hides what is really being authorized, a malicious or spoofed spender or contract address the user is led to approve, and a transaction whose displayed intent differs from what it actually ...

Map and prioritize the attack surface of an authorized black-box web target before testing it - enumerate hosts, endpoints, parameters, auth flows, and technologies, then order them by where bugs actually live. Use at the start of an in-scope engagement or bug-bounty target when you have a URL/app but no source, and need a systematic surface inventory instead of poking random endpoints; when you need to know what to test first. Enforces a scope gate and produces a prioritized surface inventor...

Map what cloud identity a compromised pod can reach and what that identity can then do: a pod bound to a workload identity or role far broader than it needs, a node instance role reachable from any pod through the node metadata endpoint, a service-account token mounted into a pod that federates to cloud, and the chain from one pod's credential to another cloud resource or identity. Covers Kubernetes on cloud where pods obtain cloud credentials through workload identity federation, mounted tok...

Map service-account impersonation and token-generation paths that let a principal act as a more-privileged identity: a role granting impersonation or token creation on a service account, an actAs or token-creator permission that chains one identity into another, and a sequence of such grants that reaches a highly privileged account from a low-privileged start. Covers cloud service-account impersonation, short-lived-token generation, and the transitive graph where each impersonation grant is a...

Test a system of multiple cooperating AI agents for attacks that exist only because agents message, spawn, and delegate to each other. Covers agent-to-agent injection (agent-in-the-middle), delegation abuse and recursive loops, orchestrator injection, confused-deputy across a trust boundary, identity spoofing between agents, capability collusion, and denial-of-wallet. Use when reviewing an orchestrator, a crew or swarm, agent-to-agent messaging, or any pipeline where one agent's output become...

Security-review discipline for code a language model wrote or completed: the failure patterns that show up more often in generated code and the review method that catches them. Covers hallucinated and confusable dependencies, insecure defaults and missing validation carried from training data, propagated vulnerable patterns, over-broad or fabricated permissions, and plausible-looking code that does not do what it claims. Use when reviewing an AI-authored change, an assistant's suggestion, or ...

Review a content security policy as a script-injection defense and judge whether it would actually stop injected script, with the discipline that a weak policy is a real finding mainly where an injection sink it would otherwise block exists. Covers a script source that allows inline script with no neutralizing nonce or hash, that allows arbitrary hosts or data URLs, or that trusts a host serving attacker-usable script; a nonce that is static, reused, low-entropy, or reflected from input; a mi...

Stress detection-as-code rules the way an attacker who has read them would: a rule keyed on one literal spelling of an action that a casing, quoting, whitespace, path, flag-ordering, or encoding variant slips past, a left-anchored or misplaced-wildcard match defeated by added noise, an exclusion or allowlist keyed on a field the attacker sets, and a rule over telemetry the log source never actually emits. Covers matching the spelling instead of the behavior, anchor and wildcard placement, sel...

Review whether sensitive and expensive endpoints are rate-limited and whether the limit can be bypassed, as a coverage-and-keying problem rather than a taint flow. Covers a login, credential-reset, one-time-code verify, signup, token, payment, or expensive-query endpoint with no limit on any layer of its path, a limit keyed on a client-supplied identifier the caller can rotate, a counter held per process so it multiplies across instances, a throttle with no lockout or backoff that permits slo...

Review who can actually read a managed secret: a secrets-manager or vault access policy that grants read to a broader principal set than the secret's consumers, a resource policy and an identity policy that combine to admit an unintended reader, a wildcard on the secret name or path that sweeps in unrelated secrets, and a decryption grant on the underlying key that widens access beyond the store's own policy. Covers cloud secrets managers and vault-style stores where the effective read set is...

Test whether an AI agent obeys instructions hidden in the content it ingests, rather than only the user's. Enumerate every channel through which untrusted content reaches the model context (retrieved docs, fetched pages, uploaded files, emails, tool outputs, filenames, images and PDFs, other agents), plant channel-appropriate payloads, and measure whether they change the agent's actions. Use when reviewing any agent or LLM app that reads external content and can act. Covers channel enumeratio...

Test the vulnerabilities that live entirely in the browser, where the server is never the sink: DOM-based cross-site scripting from client-side sinks, DOM clobbering, prototype pollution that corrupts application logic, unsafe cross-window messaging, client-side path and open-redirect handling, and cross-origin information leaks. Use when reviewing a single-page app, heavy client-side JavaScript, a browser extension, or any code that reads attacker-influenceable input and writes it into the D...

Test what happens after the model speaks: whether an application trusts model output and passes it, unescaped, into a browser, a terminal, a shell, a database, or another system. Covers model-driven XSS and markup injection, data exfiltration through rendered markdown images and links, terminal and ANSI escape injection, invisible-unicode and ascii smuggling in output, and output used to build code, SQL, or shell commands. Use when reviewing any app that renders, executes, or forwards LLM out...

Test whether an attacker can plant content in the knowledge an AI agent later retrieves and trusts: a RAG index or vector store, an agent's persistent memory, or the search and web results it pulls at runtime. Covers poisoned documents that surface as authoritative context, memory entries that persist across sessions, retrieval-ranking abuse, and injected instructions that ride retrieved chunks. Use when reviewing a RAG pipeline, an agent with long-term memory, or any retrieval step feeding t...

Test whether a chain of HTTP servers disagrees about where one request ends and the next begins, letting an attacker smuggle a request past the front end into the back end. Covers front-end and back-end desync from conflicting length signals, connection-reuse poisoning, single-packet and timing detection, and adjacent boundary confusion where a proxy and origin parse framing differently. Use when reviewing a reverse proxy, load balancer, CDN, or any multi-hop HTTP path where two parsers sit i...

Test a mail setup for sender spoofing that survives authentication: SPF, DKIM, and DMARC records that exist but do not align or enforce, subdomains left unprotected, and the end-of-data desync known as SMTP smuggling, where an inbound and an outbound mail server disagree on where one message ends so a second message with a forged, auth-passing sender is smuggled in. Covers policy present but not enforced, alignment gaps between the envelope and header sender, missing subdomain policy, open re...

Test how a caching layer between users and an application can be turned against it: cache poisoning (getting a harmful response stored and served to other users) and cache deception (tricking the cache into storing a victim's private response where the attacker can read it). Covers finding the cache key and unkeyed inputs, identifying cacheable responses, poisoning through unkeyed headers, and deceiving path-based caching into storing authenticated content. Use when reviewing a CDN, a reverse...

Vet an agent skill or MCP server before you install it, and reach a clear verdict: install, install with constraints, or deny. Combines an instruction-text audit, a declared-versus-used permission diff, and a bundled-code inspection for secret exfiltration (harvesting environment variables, credential files, or dotfiles and sending them out) and for obfuscation and install-time supply-chain risk (decode-then-execute, download-and-run on install, unpinned fetches). Pin the exact artifact you v...

Turn a confirmed finding into a clear, reproducible vulnerability report a maintainer or triager can act on without a back-and-forth. Use after a finding is confirmed (via the finding schema) and you need a writeup - a bug-bounty submission, a security advisory, an internal ticket, or a disclosure email. Covers the report structure that gets findings fixed, writing a reproduction that actually reproduces, justifying severity honestly, and the disclosure etiquette that keeps you in bounds.