Menu
Skills in this repository
SkillsMP has collected 130 skills from UnboundCompute/security-agent-skills. Open a skill to review its source and details.
UnboundCompute/security-agent-skillsShowing 40 of 130 collected skills.
Audit event-driven function handlers that trust the event because it arrived from inside the platform: a handler that treats any delivered event as authentic without verifying its true source or integrity, event fields flowing untrusted into a database write,…
Hunt injection that survives an object-relational mapper or query builder: untrusted input reaching a raw-query escape hatch, an unparameterizable identifier (a column, table, or sort order), or a structured filter or update object whose keys become query…
Hunt single-request denial of service from super-linear work: untrusted input reaching a backtracking regular expression, a quadratic or worse algorithm, or a hash-keyed structure with attacker-chosen keys, with no size or complexity guard between. Covers…
Hunt unsafe extraction of untrusted compressed archives: an entry's declared path escaping the destination directory (traversal or an absolute path), a symlink or hardlink entry that a later entry writes through to reach outside, decompression amplification…
Stress detection-as-code rules the way an attacker who has read them would: a rule keyed on one literal spelling of an action that a casing, quoting, whitespace, path, flag-ordering, or encoding variant slips past, a left-anchored or misplaced-wildcard match…
Audit secure-shell trust hygiene, not cipher hardening: a forwarded authentication agent a remote host can abuse to log in as you elsewhere, client configuration or a proxy-command directive influenced by an untrusted source, host-key verification disabled or…
Enumerate network-management exposure through the simple network-management protocol: default and guessable community strings, weak or downgradeable versions, read views that leak interface tables, routing and neighbor data, running configuration, process and…
Hunt local privilege escalation and code execution through the dynamic loader: a preload environment variable honored across a privilege boundary, a writable directory on the runtime library search path, an embedded run-path that points at a writable or…
Hunt local privilege escalation through scheduled jobs and the paths privileged processes trust: periodic and timer jobs whose script, or a file or directory they read, is writable by a lower-privileged user; commands invoked by an unqualified name resolved…
Hunt local privilege escalation through setuid and setgid binaries and per-file capabilities: programs that run as a more privileged identity, or files granted a capability such as changing user id, overriding file permissions, raw disk or memory access, or…
Test a mail setup for sender spoofing that survives authentication: SPF, DKIM, and DMARC records that exist but do not align or enforce, subdomains left unprotected, and the end-of-data desync known as SMTP smuggling, where an inbound and an outbound mail…
Audit the attack surface a GraphQL API exposes that a plain endpoint does not: schema introspection left open, unbounded query depth and recursion, aliasing and field duplication that multiply cost, query batching that defeats rate limits and enables brute…
Hunt broken object-level authorization (BOLA, also called IDOR): endpoints that accept a client-supplied object reference - a numeric id, UUID, key, slug, filename, or an id nested in a request body or token - and read or mutate that object without checking…
Hunt mass assignment and broken object-property authorization: handlers that bind a client request payload straight onto a record or model and let the caller write fields it should never control - role, is_admin, owner_id, tenant, price, balance, verified,…
Find the consent gap in an agent skill or MCP server: the distance between the permissions and capabilities it declares and what its bundled code and instructions actually exercise. Covers over-broad grants a skill requests but never uses, capabilities it…
Lint the natural-language instruction text of an agent skill or MCP server, not its code: the skill body, the frontmatter description, tool descriptions, and parameter text a model reads and obeys. Covers instructions hidden in comments or markup, invisible…
Vet an agent skill or MCP server before you install it, and reach a clear verdict: install, install with constraints, or deny. Combines an instruction-text audit, a declared-versus-used permission diff, and a bundled-code inspection for secret exfiltration…
Turn a confirmed finding into a clear, reproducible vulnerability report a maintainer or triager can act on without a back-and-forth. Use after a finding is confirmed (via the finding schema) and you need a writeup - a bug-bounty submission, a security…
Audit continuous-integration pipelines for the trust they extend to untrusted input: workflows that run on incoming change requests from forks while holding repository secrets, steps that let attacker-controlled content reach a privileged command, and cloud…
Hunt privilege-escalation paths in cloud identity and access management: a low-privileged principal that chains role assumptions, policy rewrites, role-passing, and over-broad trust relationships to reach an administrative or data-access principal. Covers the…
Hunt machine credentials that are live, over-privileged, and actually reachable, not just present. Covers non-human identities and secrets across code, configuration, and infrastructure definitions: API keys, service-account credentials, and long-lived…
Audit authorization expressed as configuration or framework convention rather than inline code: row-level security and policy rules, framework before-action and middleware filters that must be attached to every protected route, serverless and gateway access…
Audit federated single sign-on for the flaws that let an attacker forge or replay an identity: signature wrapping and signature stripping on signed assertions, unsigned or unverified tokens accepted, redirect_uri and audience manipulation, missing state and…
Adjudicate whether a server-side request-forgery primitive actually reaches high-value internal targets, especially a cloud instance metadata endpoint that hands out credentials. Covers proving the fetch is attacker-steered, reaching link-local and internal…
Find exploitable cryptographic misuse, not theoretical weakness: reused nonces (stream and counter/GCM keystream reuse, ECDSA private-key recovery from a repeated per-signature secret), padding oracles that decrypt ciphertext, hash length-extension on naive…
Find security controls that grant access when they should deny it: an authorization check that returns allow on error or timeout, an empty or wildcard allowlist that matches everything, a default-allow branch when input is missing or unrecognized, and a…
Test the vulnerabilities that live entirely in the browser, where the server is never the sink: DOM-based cross-site scripting from client-side sinks, DOM clobbering, prototype pollution that corrupts application logic, unsafe cross-window messaging,…
Test whether a chain of HTTP servers disagrees about where one request ends and the next begins, letting an attacker smuggle a request past the front end into the back end. Covers front-end and back-end desync from conflicting length signals, connection-reuse…
Audit the machine-learning models you load as untrusted code, not just data. Covers deserialization RCE from unsafe checkpoint formats (a model file that runs code on load), poisoned or backdoored weights, tampered or trojaned models pulled from a public hub,…
Systematically test whether a model's safety and policy guardrails hold under adversarial pressure, as a repeatable evaluation rather than a one-off trick. Covers building a policy-grounded probe set, multi-turn escalation, encoding and obfuscation bypasses,…
Security-review discipline for code a language model wrote or completed: the failure patterns that show up more often in generated code and the review method that catches them. Covers hallucinated and confusable dependencies, insecure defaults and missing…
Test how a caching layer between users and an application can be turned against it: cache poisoning (getting a harmful response stored and served to other users) and cache deception (tricking the cache into storing a victim's private response where the…
Audit what an AI agent is actually allowed to do versus what its task needs. Covers excessive agency (tools, scopes, and autonomy beyond the job), missing human-in-the-loop gates on irreversible actions, over-broad credentials and their blast radius, sandbox…
Hunt for vulnerabilities that live in what an application is allowed to do, not in how it is coded: workflow steps that can be skipped or reordered, quantity/price/limit values that go negative or overflow a cap, state transitions that should be unreachable,…
Hunt for the ways an attacker gets code into your build without touching your repo: dependency confusion (a public package shadowing an internal name), typosquatting and slopsquatting (a package named after a model's hallucination), poisoned pipeline…
Test a system of multiple cooperating AI agents for attacks that exist only because agents message, spawn, and delegate to each other. Covers agent-to-agent injection (agent-in-the-middle), delegation abuse and recursive loops, orchestrator injection,…
Test what happens after the model speaks: whether an application trusts model output and passes it, unescaped, into a browser, a terminal, a shell, a database, or another system. Covers model-driven XSS and markup injection, data exfiltration through rendered…
Test whether an attacker can plant content in the knowledge an AI agent later retrieves and trusts: a RAG index or vector store, an agent's persistent memory, or the search and web results it pulls at runtime. Covers poisoned documents that surface as…
Red-team the tool layer of an AI agent: the tool definitions, metadata, and outputs that a model reads and trusts. Covers tool poisoning (instructions hidden in a tool's description), tool shadowing and name collisions, rug-pulls (definitions that change…
Find where an AI agent becomes dangerous: the trust context in which access to private data, exposure to untrusted content, and an ability to send data out all coexist. Any two legs are usually safe; all three let planted content make the agent read secrets…