claude-code-ai-development-workflow

Tests an authorized Active Directory domain for Kerberos-abuse paths: Kerberoasting (TGS for SPN accounts → offline crack), AS-REP roasting (accounts without pre-auth), and enumeration/proof of unconstrained, constrained (S4U), and resource-based constrained delegation (RBCD) plus shadow-credentials (msDS-KeyCredentialLink) candidates. Consumes ad-recon-hunter's ad-quickwins.md. Use after ad-recon-hunter once internal_pentest is approved and domain credentials are available. Cracking and any impersonation proof are gated. Maps findings to CWE-287/CWE-522/CWE-284 and MITRE T1558. Internal pentest only - requires .claude/security-scope.yaml internal_pentest: approved and credentials from ad_credentials_vault_path. Grounded in redteam-ad-ops.

Enumerates an authorized internal Active Directory environment: network-service sweep (SMB/LDAP/MSSQL/SNMP), null/guest session harvesting, BloodHound graph collection, and low-noise LDAP queries for users, computers, SPNs, delegation flags, password-not-required accounts, GPP cpassword in SYSVOL, and LAPS-readable hosts. Produces an AD inventory and a prioritized quick-win list that feeds ad-kerberos-hunter. Use as the FIRST internal/AD skill once internal_pentest is approved and engagement credentials (or an anonymous foothold) are available. Maps findings to CWE-200/CWE-522/CWE-284. Internal pentest only - requires .claude/security-scope.yaml internal_pentest: approved and credentials from ad_credentials_vault_path. Grounded in redteam-ad-ops.

Maps the attack surface of REST / GraphQL / gRPC APIs - OSINT for specs and endpoints, subdomain enumeration, active service fingerprinting, OpenAPI / Swagger / GraphQL-schema discovery, and hidden-parameter fuzzing. Use before any API-class hunter skill (bola-bfla-hunter, mass-assignment-hunter, owasp-api-top10-tester, jwt-hunter, graphql-hunter); they depend on its API_INVENTORY.md output. Run AFTER web-recon-passive and in parallel with or after web-recon-active. Produces API_INVENTORY.md with endpoints, methods, parameters, auth models, and versioning. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Consolidates outputs from web-recon-passive, web-recon-active, and api-recon into a single prioritized attack-surface picture - merging PASSIVE_RECON.md, ATTACK_SURFACE.md, API_INVENTORY.md, and AUTH_FLOWS.md into a deduplicated inventory ranked by risk (high-impact features, new/changed code, legacy /v1 endpoints, business-logic-rich flows). Use at the end of the recon phase to produce a single decision document that the orchestrator uses to select which class-specific hunters to run in what order. Passive-active hybrid - mostly reads prior outputs, adds minimal targeted probes for priority fingerprinting. Produces CONSOLIDATED_ATTACK_SURFACE.md with prioritization rationale. Defensive testing only.

Tests authentication subsystems for username enumeration, weak / absent lockout, multi-stage bypass (skipping MFA / security-questions stage), JWT signature integrity (dispatching to jwt-hunter), alternative-channel weakness (web vs mobile vs API), default-credential probing, and cleartext credential transmission. Use when login / password-reset / MFA flows are in scope; after `web-recon-active` maps the auth surface; or when the orchestrator's phase-0 plan prioritizes authentication hardening. Produces findings with CWE-287 / CWE-307 / CWE-522 mapping and layered auth hardening. Defensive testing only, against assets listed in .claude/security-scope.yaml - service_affecting: true.

Passively maps every authentication flow in the target - primary login, MFA, password reset, account registration, alternative channels (mobile API, SSO), and token issuance points - without running active attack probes. Produces AUTH_FLOWS.md with state diagrams, endpoint inventory, token-issuance timing, multi-stage sequences, and alternative-channel deltas. Consumed by auth-flaw-hunter (for attack planning), jwt-hunter (for token handoff), oauth-oidc-hunter (for OAuth-specific flows), and session-flaw-hunter (for session-layer testing). Use as a foundational T4 skill before any authentication-class hunter. Passive profile - observation only.

Audits AWS IAM posture for over-privileged roles, exposed long-lived access keys, SSRF-reachable IMDS credential leaks, dangling DNS records pointing at decommissioned AWS resources, and API responses leaking internal ARNs. Use when the target runs on AWS and the assessment scope includes cloud-account review; when SSRF has been confirmed by another skill; or when the orchestrator's recon surfaces AWS-style resource names. Produces findings with CWE-732 / CWE-918 mapping, IAM-policy JSON evidence, and least-privilege remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml - READ-ONLY AWS API calls only.

Tests APIs for Broken Object-Level Authorization (API1:2023 BOLA - cross-user resource access by ID manipulation) and Broken Function-Level Authorization (API5:2023 BFLA - non-admin users reaching admin-only endpoints via URL guessing or HTTP-method swap). Complements idor-hunter for web apps; this is the API-specific sister skill with API-class methodology and OWASP API Top 10 mapping. Use when `api-recon` surfaced resource-ID parameters and multi-role endpoints; when the orchestrator identifies administrative paths; or when two test accounts at different privilege levels are available. Produces findings with CWE-639 / CWE-285 mapping and authorization-middleware remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Tests application-specific logic for workflow bypasses (skipping steps), data-validation gaps (negative prices, oversized quantities, unit confusion), hidden-field tampering, function-usage abuse (coupon reuse, free-trial re-registration), and trust-boundary pivots. Use when the target has complex multi-step workflows (checkout, account recovery, approval chains), parameters with real-world meaning (prices, quantities, dates), or state-carrying hidden fields. This class is unique to each app - requires understanding of intended business rules. Produces findings with CWE-840 / CWE-841 mapping and server-side-authoritative-validation remediation.

Tests web caches for poisoning (unkeyed-header injection turning a benign header into cached malicious content for all visitors) and HTTP request smuggling (CL.TE / TE.CL desync between front-end proxy and back-end origin, smuggling a hidden request). Highly disruptive - only runs on staging with explicit `service_affecting: approved` AND `cache_smuggling_testing: approved`. Use when the target sits behind a CDN / load balancer, X-Cache / Age / CF-Cache-Status headers are present, or when the orchestrator identifies proxied architecture. Produces findings with CWE-444 / CWE-524 mapping and header-cache-key + HTTP/2 + strict-parsing remediation. Defensive testing only - POISONED-CACHE CLEANUP REQUIRED.

Tests sensitive state-changing pages for clickjacking / UI-redress weaknesses by auditing frame-protection headers, cookie attributes, and pre-fillable URL parameters. Use when a web app has destructive or account-modifying actions (password change, transfer, delete) that complete with a single click; when X-Frame-Options / CSP frame-ancestors are missing or permissive; or when the orchestrator needs to confirm whether a finding can be exploited without a secondary confirmation. Produces findings with CWE-1021 mapping, a local framing PoC, and developer-facing header/cookie remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Tests inputs that reach OS shell / process-launching APIs for command injection - metacharacter-based separator injection (`;`, `|`, `&&`, backtick, `$()`), blind time-based / OOB injection, shell-escape bypass (`\;ls`), output redirection (write to web root), and filename-parameter vectors. Use when the target has admin / diagnostic features (ping, nslookup, disk utility, log viewer), file-processing endpoints that accept paths, or HTTP headers (Referer / User-Agent) that logs process. Produces findings with CWE-78 mapping, harmless-PoC evidence, and parameterized-API remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml - HARMLESS PROBES ONLY.

Audits container / Kubernetes / OpenShift deployments for privileged pods, permissive SecurityContexts (runAsRoot, allowPrivilegeEscalation, hostPath mounts, hostNetwork, hostPID), missing NetworkPolicies, missing resource limits, lax RBAC (cluster-admin bindings), and Dockerfile patterns that leak creds or use moving-tag base images. Uses AWS CLI read verbs for EKS / ECS inventory; reads Dockerfile / K8s YAML from already-cloned repos; does NOT kubectl apply or describe live pods (delegate to operator). Use when the target runs containers (EKS / ECS / OpenShift / self-hosted K8s); or when `gitlab-cicd-hunter` / `secrets-in-code-hunter` surface container configs. Produces findings with CWE-732 / CWE-276 mapping and NetworkPolicy + SecurityContext + RBAC-hardening remediation.

Audits CORS response headers for overly permissive policies - arbitrary-origin reflection with `Access-Control-Allow-Credentials: true`, subdomain confusion (`Origin: www.target.com.attacker.com` reflected), `null` origin acceptance, and permissive `Access-Control-Allow-Methods` exposing destructive verbs. Analyzes traffic already captured by `api-recon` and `web-recon-active` (passive) plus a small number of targeted Origin-header probes. Use when API responses include CORS headers; when cross-domain calls are visible in browser dev tools; or when the orchestrator needs an explicit CORS check. Produces findings with CWE-346 / CWE-942 mapping and strict-allowlist + no-credentials-with-wildcard remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Offline password / hash cracking during an authorized engagement using hashcat and John the Ripper. Identifies hash types (hashid/hashcat --identify), runs wordlist + rule + mask attacks against hashes already captured by other skills (ad-kerberos AS-REP/TGS, jwt HS256 secrets, dumped SAM/NTDS/shadow, recovered archives), and reports cracked/uncracked with the password-policy weakness it proves. Offline only - never online brute force. The shared cracking utility the AD and JWT hunters depend on. Requires .claude/security-scope.yaml red_team_ops.offline_cracking: approved. Hashes/plaintext stay in the engagement vault. Grounded in redteam-ops.

Audits observed cryptographic artifacts (TLS configuration evidence from prior scans, encrypted cookies / tokens, JWT algorithm choices, padding-oracle candidates) for weak primitives, missing authenticated encryption, hardcoded key patterns in recon data, bit-flipping susceptibility, and unencrypted transmission of sensitive data. Passive-only - this skill analyzes artifacts other skills captured rather than actively scanning. Use after web-recon-active / api-recon have collected response headers and cookies; or after secrets-in-code-hunter surfaces key-like strings. Produces findings with CWE-327 / CWE-319 / CWE-326 mapping and cipher / protocol hardening remediation.

Tests state-changing endpoints for Cross-Site Request Forgery by auditing for anti-CSRF tokens, SameSite cookie protection, method-swapping bypasses, Referer/Origin header enforcement, and token-to-session binding. Use when authenticated endpoints modify state (password change, transfer, delete, permission changes) and the request is not obviously API-fetch-only; when session cookies lack SameSite protection; or when the orchestrator's inventory surfaces POST/PUT/PATCH/DELETE endpoints without visible tokens. Produces findings with CWE-352 mapping, auto-submit HTML PoCs, and token/cookie remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Tests inputs that reach deserialization functions (PHP `unserialize`, Java `readObject`, Python `pickle.loads`, Ruby `Marshal.load`, YAML `yaml.load` without safe loader) for insecure deserialization - field tampering for privilege escalation, gadget-chain RCE via known library-sink properties (ysoserial / phpggc), and signature-bypass via HMAC-less payloads. Use when cookies / POST bodies / URL params contain large Base64 / hex blobs with language-specific headers (`rO0` for Java, `O:` for PHP, `\x80\x04` for Python pickle). Produces findings with CWE-502 mapping, tampered-blob evidence, and JSON-only + class-allowlist remediation. Defensive testing only - HARMLESS PROBES ONLY, post-RCE halt.

Triages an acquired disk image (read-only, hash-verified copy) during an authorized incident using The Sleuth Kit and plaso. Recovers the partition/filesystem layout, deleted files, and key host-forensic artifacts - Windows $MFT/$UsnJrnl, registry hives (Amcache/Shimcache/Run keys), Prefetch, scheduled tasks, services, WMI persistence, browser history, LNK/jumplists; Linux cron/systemd, auth logs, shell history, SSH authorized_keys - and builds a filesystem timeline. Surfaces persistence, execution, and anti-forensics evidence mapped to MITRE ATT&CK. Use when a disk image exists in Detection & Analysis. Requires .claude/security-scope.yaml dfir_scope.incident_response: approved and evidence from dfir_scope.evidence_store_path. Read-only on evidence copies; no containment. Grounded in incident-response.

Tests client-side JavaScript for DOM-based XSS by tracing user-controllable sources (location, document.URL, postMessage, hash) through dangerous sinks (eval, innerHTML, document.write). Use when the target is a SPA or uses heavy client-side rendering; when URL fragments or postMessage control on-page behavior; or when the orchestrator's recon identifies sink-heavy endpoints. Produces findings with CWE-79 mapping, fragment-based PoCs, and framework-specific remediation (textContent, CSP, origin-checked postMessage). Defensive testing only, against assets listed in .claude/security-scope.yaml.

Audits API response bodies and client-side code for sensitive fields returned to the client that shouldn't be exposed - hashed passwords, internal IDs, admin flags, PII beyond what the UI needs, stack traces in errors, hardcoded secrets in JavaScript bundles, and 'debug' parameters that reveal extra state. Covers OWASP API3:2019 / API3:2023 BOPLA (read-side). Use after `api-recon` captures full response shapes; when the UI renders only a subset of the JSON that's returned; or when error pages reveal technical detail. Produces findings with CWE-213 / CWE-200 mapping and server-side-filtering / schema-validation remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Validates that a suspected vulnerability is actually exploitable, to prove impact for the client - using vetted public PoCs (Exploit-DB/searchsploit) and controlled local exploit development with pwntools/gdb+pwndbg/ropper/one_gadget against an authorized target or a lab replica. Confirms with the least-damage proof (version echo, id/whoami, single canary read) and STOPS; never runs destructive or DoS exploits, never weaponizes for persistence. Consumes candidates from network-pentest-hunter, reverse-engineering-hunter, and the web hunters. Requires .claude/security-scope.yaml red_team_ops.exploit_validation: approved. Prefers a lab replica over production. Grounded in redteam-ops.

Audits GitLab repositories and CI/CD pipelines for exposed secrets in commit history / issues / MRs, insecure `.gitlab-ci.yml` patterns (hardcoded vars, privileged runners, Docker-socket mounts), webhook SSRF, reachable `.git/` directories, and `.bash_history` leaks on misconfigured hosts. Use when the target organization uses GitLab for SCM and/or CI/CD; after `web-recon-passive` surfaces repo references; or when the orchestrator identifies `gitlab.*` subdomains. Produces findings with CWE-798 / CWE-522 / CWE-918 mapping and pipeline-hardening remediation. Defensive testing only, READ-ONLY GitLab API calls.

Tests GraphQL endpoints for enabled production introspection, BOLA via guessable relay/global IDs, deeply-nested DoS, query batching bypass, injection in query arguments (SQLi / command injection through GraphQL resolvers), custom-scalar validation gaps, and field-level authorization flaws. Use when the target exposes /graphql, /graphiql, /playground, /v1/graphql, /query endpoints; or when response bodies have top-level `data` or `errors` keys; or when the orchestrator's recon confirmed GraphQL use. Produces findings with CWE-200 / CWE-639 / CWE-400 / CWE-89 mapping, introspection-driven schema evidence, and per-vector remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Local privilege-escalation assessment on an authorized host where you already have a foothold (operator-provided shell/session). Runs and interprets enumeration - linpeas/LinEnum/pspy/linux-exploit-suggester on Linux; winPEAS/Seatbelt/PowerUp on Windows - and maps findings to concrete escalation paths via GTFOBins (sudo/SUID) and LOLBAS, plus writable services/cron/systemd/scheduled-tasks, kernel-exploit candidates, secrets in files/history, and token/capability abuse. Proves escalation with the least-damage check (id/whoami as root/SYSTEM) and stops. The post-exploitation companion to network-pentest-hunter and the AD chain. Requires .claude/security-scope.yaml red_team_ops.host_privesc: approved and the host in scope. Grounded in redteam-ops.

Systematic testing for Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. Use when auditing endpoints that expose resource identifiers in URLs, body parameters, headers, or cookies; when a multi-tenant app grants object access based on request-supplied IDs; or when the orchestrator identifies object-ID parameters during API recon. Produces findings with CWE-639 mapping, per-endpoint PoC request pairs, and developer-facing remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Reference skill for digital forensics and incident response (DFIR). Provides the NIST SP 800-61 incident lifecycle (Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident), the SANS PICERL phases, evidence-handling and chain-of-custody rigor (NIST SP 800-86), a triage decision tree, an IOC / MITRE ATT&CK mapping model, and tool maps for memory / disk / log / network forensics. Load this skill before or during any incident to ground the executable memory-forensics-hunter, disk-triage-hunter, and log-timeline-hunter skills. Knowledge only - no execution; the responder runs the tools against evidence copies.

Tests JSON Web Tokens for `alg: none` acceptance, missing signature validation, HS256 secret cracking, RS256-to-HS256 algorithm confusion, claim tampering (role/uid escalation), post-logout / post-password-change token validity, and `kid` / `jku` / `x5u` injection. Use when the target uses JWTs for auth (strings starting with `ey` in Authorization headers, cookies, or bodies); when issued tokens contain cleartext roles or identifiers; or when tokens persist after logout. Produces findings with CWE-327 / CWE-347 / CWE-287 mapping, tampered-token PoCs, and library-configuration remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Automated red-teaming of the organization's OWN LLM / inference endpoints using garak and PyRIT. Runs probe batteries for prompt injection, jailbreak / guardrail bypass, harmful-content generation, training-data / system-prompt leakage, and insecure output handling, then normalizes the scanner output into the canonical finding schema mapped to the OWASP LLM Top 10 (LLM01 Prompt Injection, LLM02 Insecure Output, LLM06 Sensitive Info Disclosure, LLM07 System-Prompt Leakage). Complements (does not overlap) the manual /redteam-ai command and security-analyst OBLITERATUS work by adding automated, repeatable scanning. Use when an in-scope endpoint embeds or exposes an LLM. Requires .claude/security-scope.yaml with the target listed under llm_endpoints and llm_redteam: approved. Defensive testing of your own endpoints only.

Analyzes acquired logs during an authorized incident - Windows Event Logs (EVTX, incl. Sysmon) via Chainsaw/Hayabusa with Sigma rules, Linux auth/syslog/audit, and network logs/PCAP via tshark/Zeek - to reconstruct the attack timeline and detect logon anomalies, credential attacks, lateral movement, service/task install, and C2 beaconing. Correlates into a single UTC timeline and maps events to MITRE ATT&CK (T1110, T1021, T1059, T1543, T1071). Use when log/EVTX/PCAP evidence exists in Detection & Analysis. Requires .claude/security-scope.yaml dfir_scope.incident_response: approved and evidence from dfir_scope.evidence_store_path. Read-only on evidence copies; no containment. Grounded in incident-response.

Tests APIs for Mass Assignment (blind property injection, role escalation via `admin:true` / `isAdmin:1`, financial manipulation via `credit:9999`, `balance:N`), HTTP Parameter Pollution (duplicate query / body params), and method-swap-with-mass-assignment variants. Use when the target has REST APIs with object creation / update endpoints; when OpenAPI specs hint at properties not in the UI; or when `api-recon` surfaced hidden parameters via Arjun. Produces findings with CWE-915 / CWE-235 mapping, before/after object-state evidence, and DTO-based remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Analyzes an acquired RAM image (read-only, hash-verified copy) with Volatility 3 during an authorized incident: enumerates running/hidden processes and parent-child anomalies, detects code injection (malfind), lists network connections, loaded DLLs/drivers/services, command lines, registry-in-memory, and cached credentials, and extracts IOCs + suspicious binaries for triage. Maps confirmed activity to MITRE ATT&CK (T1055, T1003, T1543, T1071). Use early in Detection & Analysis when a memory image exists. Requires .claude/security-scope.yaml dfir_scope.incident_response: approved and evidence from dfir_scope.evidence_store_path. Read-only on evidence copies; performs no containment. Grounded in incident-response.

Static security assessment of an authorized Android APK using MobSF (static engine), mobsfscan, and apkleaks. Covers hardcoded secrets / API keys, insecure data storage, exported components (activities / services / receivers / providers) and intent surface, weak crypto, cleartext traffic / network-security-config gaps, dangerous permissions, debuggable / backup-allowed flags, and embedded endpoint URLs. Net-new category - your stack has no mobile coverage. Static-only by default; dynamic instrumentation (Frida / emulator) is out of scope. Use when an Android client app is in scope. Requires .claude/security-scope.yaml with mobile_testing: approved and the artifact under mobile_artifacts. Maps findings to the OWASP MASVS / Mobile Top 10 and CWE-312/CWE-798/CWE-926. Defensive testing only.

Performs authorized network / infrastructure penetration testing of non-web services (external or internal): full nmap/rustscan/masscan port + version + NSE discovery, per-service enumeration (SMB/NFS/SNMP/FTP/RDP/SSH/SMTP/databases/mail), default- and weak-credential checks, and version-to-CVE matching via searchsploit with least-damage exploit validation. Complements the web hunters (non-HTTP services) and redteam-ad-ops (this is broader infra, not AD-specific). Use when infra/hosts/services are in scope for a pentest. Produces findings with CWE/ATT&CK mapping and proof-of-impact evidence. Requires .claude/security-scope.yaml red_team_ops.network_pentest: approved and the target in assets. Grounded in redteam-ops.

Tests OAuth 2.0 / OpenID Connect flows for redirect-URI validation weaknesses (exact match vs substring / subdomain confusion), open-redirect chaining, missing / predictable `state` (CSRF on account linking), authorization-code reuse, implicit-flow fallback, `response_type` tampering, and redirect-URI parameter pollution. Use when the target integrates 'Login with X' SSO, has OAuth-protected APIs, exposes `/.well-known/openid-configuration`, or uses bearer tokens. Produces findings with CWE-601 / CWE-352 / CWE-346 mapping, complete flow evidence (authorize → callback → token exchange), and PKCE / strict-match remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Reference skill for security-focused phases (/security, /pentest, /redteam-ai, /harden). Provides OWASP Top 10 checklist, STRIDE threat model, common attack patterns, and exploit classification standards. Load this skill when performing any security audit or generating security-related code reviews.

Tests URL-redirect parameters for arbitrary-destination redirects via simple external URLs, protocol-relative bypasses (`//attacker`), path-prefix tricks (`/https://attacker`), userinfo confusion (`target@attacker`), fragment/encoding bypasses, Referer-based redirects, and `javascript:` pseudo-protocol in href sinks. Use when parameters named `url`, `redirect`, `next`, `return`, `destination`, `goto`, `rUrl`, `cancelUrl` appear in the inventory; when login / logout / deep-link flows accept user-supplied redirect targets; or when chained with OAuth (`oauth-oidc-hunter`). Produces findings with CWE-601 mapping, redirect-chain evidence, and allowlist + user-warning remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Runs a full OWASP API Security Top 10 coverage sweep against a target - dispatches to class-specific hunters (bola-bfla-hunter, auth-flaw-hunter, excessive-data-exposure-hunter, rate-limit-hunter, mass-assignment-hunter, sqli-hunter, command-injection-hunter, jwt-hunter) for each Top-10 item, then produces a consolidated API-Top-10 coverage matrix showing which items were tested, what was found, and which items need follow-up. Use as the 'API sweep' entry point when the orchestrator wants broad-but-shallow coverage, or as the pre-deploy final check. Produces .claude/planning/{issue}/API_TOP10_COVERAGE.md alongside any downstream findings. Defensive testing only, against assets listed in .claude/security-scope.yaml.

Tests file-reference inputs for directory traversal (`../../etc/passwd`), Local File Inclusion (read server source / config), and Remote File Inclusion (RFI → RCE if PHP `allow_url_include` or similar is enabled). Covers encoding bypasses (`%2e%2e%2f`, double-encoding, null-byte), filter-recursive bypass (`....//`), Unicode, and protocol wrappers (`file://`, `php://filter`). Use when parameters like `file=`, `page=`, `template=`, `item=`, `path=`, `doc=`, `download=` appear in the inventory; when features handle file uploads / downloads / user themes; or when the orchestrator identifies file-oriented features. Produces findings with CWE-22 / CWE-98 mapping and allowlist + canonicalization remediation. Defensive testing only - HARMLESS PROBES (read-only files), post-RCE halt if RFI triggers code execution.

Tests APIs and sensitive features for missing or weak rate limiting - credential-stuffing resistance, MFA code brute-force, SMS / email amplification, oversized-payload resource exhaustion, and IP / session rotation evasion. Use when the target has login / password-reset / MFA / signup / SMS-trigger endpoints and `api-recon`'s auth inventory shows no `X-RateLimit-*` response headers; when the orchestrator identifies high-cost operations; or when cross-referencing a `auth-flaw-hunter` lockout finding. Produces findings with CWE-307 / CWE-770 / CWE-400 mapping and throttle / captcha / resource-limit remediation. Defensive testing only, against assets listed in .claude/security-scope.yaml - service_affecting: true.