oos-check

name	oos-check
description	Pre-check if a Bug Bounty finding is Out-of-Scope. Auto-triggered at Phase 0 (full scan) and Phase 1 (per-finding). Matches "OOS", "out of scope", "exclusion check"
user-invocable	true
argument-hint	<target-dir> [finding-type]
allowed-tools	["Read","Grep","Glob","Bash","WebFetch"]

OOS (Out-of-Scope) Pre-Check

CRITICAL RULES (NEVER VIOLATE)

1. BLOCK → immediately remove finding from vulnerability_candidates.md
2. WARN → do NOT proceed without bypass reframing strategy
3. Phase 0 = full program OOS scan, Phase 1 = per-finding scan — never skip

OOS misses account for 22% of all failures — CapyFi (oracle staleness), AXIS (D-Bus) were both explicitly listed in program brief.

Input

• $ARGUMENTS: <target-dir> (e.g., targets/keeper) + optional [finding-type] (e.g., oracle-staleness)
• If no finding-type: full program OOS scan

Procedure

Step 1: Load Program Rules

Read targets/<target>/program_rules_summary.md

• Extract OOS items from "Exclusion List" section
• Extract known issues from "Known Issues" section

Step 2: Common Exclusion Pattern Matching

Load OOS pattern DB (scripts/oos_patterns.json) and cross-match with finding-type:

!cat /home/rootk1m/01_CYAI_Lab/01_Projects/Terminator/.claude/skills/oos-check/scripts/oos_patterns.json 2>/dev/null || echo "pattern DB not found"

Step 3: Platform OOS Verification

• Immunefi: immunefi.com/common-vulnerabilities-to-exclude/ default exclusion list
• H1/Bugcrowd: program policy page "Out of Scope" items

Step 4: Verdict

Result	Condition	Action
PASS	No OOS pattern matched	Phase 1 proceed OK
WARN	Partial match (bypass possible)	Alert analyst + bypass reframing required
BLOCK	Clear OOS match	Auto-exclude finding. Analysis forbidden

Step 5: Output

[OOS-CHECK] Target: <target>
[OOS-CHECK] Finding type: <type or "full scan">
[OOS-CHECK] Program exclusions matched: <count>
[OOS-CHECK] Common pattern matched: <count>
[OOS-CHECK] Result: PASS / WARN(<reason>) / BLOCK(<reason>)

Few-Shot Examples

PASS — IDOR in user API

Finding: GET /api/users/{id} returns other users' PII without authorization check
Program OOS: "Rate limiting, clickjacking, self-XSS"
Pattern match: None
→ PASS (IDOR not in any exclusion list)

BLOCK — Oracle staleness on Immunefi

Finding: Chainlink oracle has no staleness check, stale price could cause bad liquidation
Program OOS: Immunefi common exclusion "Incorrect data supplied by third party oracles"
Pattern match: "oracle-staleness" → Immunefi default exclusion
→ BLOCK (oracle staleness is auto-OOS on Immunefi unless manipulation via flash loan)

WARN — D-Bus authorization bypass

Finding: D-Bus method call bypasses polkit authorization check
Program OOS: "Local access bugs OOS unless vertical privilege escalation to root"
Pattern match: "dbus-local" → partial (root escalation chain could bypass)
→ WARN (need root escalation chain to reframe as in-scope)

Lessons Learned (this skill exists to catch these)

• CapyFi: oracle staleness → Immunefi common exclusion. OOS rejection
• AXIS: D-Bus auth bypass → "local access OOS unless root escalation" in brief
• Kiln DeFi: offset=0 vault → code path inactive = latent bug = OOS
• stake.link: sandwich attack → "third party oracle data" OOS by default
• DEXX/HackenProof: rate limiting + account pre-takeover = OOS (platform-specific)

REMINDER: BLOCK = remove from candidates immediately. WARN = no progress without bypass reframing.