Use this skill to audit application code for access control weaknesses, including authentication boundary issues, function-level authorization flaws, object-level authorization flaws, business-context authorization gaps, client-side-only enforcement, inconsistent permission checks across routes, methods, and layers, and framework-specific access-control sink candidates in Java, Android, C++, C#, Python, and PHP applications.
Use this skill to audit application code for business logic abuse risks, including broken state transitions, workflow bypass, idempotency failures, replay issues, rate or quota abuse, accounting and value integrity flaws, beneficiary mismatches, and inconsistent business-rule enforcement across routes, jobs, and integrations.
Use this skill to audit business logic abuse risks with graph-database and taint-tracking friendly candidate sink inventories, including payment, authentication, rate/quota, workflow, promotion, resource-consumption, and third-party integration scenarios in Java, Android, C++, C#, Python, and PHP applications.
Use this skill to audit Java, Android, C#/.NET, C++, Python, and PHP application code for unsafe deserialization risks, including untrusted input reaching deserialization sinks, unsafe object restoration, dangerous magic or lifecycle method triggers, framework or library misuse, integrity boundary failures, and inconsistent deserialization controls across routes, jobs, IPC, RPC, mobile components, and data-processing layers.
Use this skill to audit Java, Android, C#/.NET, C++, Python, and PHP application code for path traversal, arbitrary file read/write/delete/overwrite, unsafe file path handling, archive extraction traversal, local resource inclusion, and inconsistent path validation across routes, jobs, IPC, RPC, mobile components, and file-processing layers.
Use this skill to audit Java, Android, C#/.NET, C++, Python, and PHP application code for command injection, unsafe process execution, shell injection, argument or option injection, dangerous eval or expression execution, interpreter abuse, dynamic code loading, external-tool misuse, and inconsistent execution controls across routes, jobs, IPC, RPC, mobile components, and helper layers.
Use this skill to audit Java, Android, C#/.NET, C++, Python, and PHP application code for SQL injection risks, including unsafe query construction, raw SQL execution, ORM/query-builder misuse, stored procedure misuse, structural SQL control, second-order SQL injection, and inconsistent input handling across routes, jobs, IPC, RPC, mobile components, and data-access layers.
Use this skill to audit Java, Android, C#/.NET, C++, Python, and PHP application code for server-side request forgery risks, including attacker-controlled request targets, unsafe URL construction, internal network reachability, metadata access, redirect or DNS-based bypasses, protocol misuse, cloud metadata access, and inconsistent outbound-request controls across routes, jobs, IPC, RPC, mobile components, and helper layers.