blitzstrike 1.0.62 → 1.0.65

package/CHANGELOG.md

@@ -5,6 +5,56 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.65] — 2026-09-13
+
+### Fixed — breadth-scanner false positives (live MCP verification)
+
+Found via an LLM-driven verification run (agent → `blitz_scan`/`eagle_eye2`):
+
+- **Sink tokens in comments/strings no longer reported.** `scanFile`/
+  `traceFunction`/`grepInFunctions` now match against a comment- and
+  string-literal-stripped view of the source (positions + line numbers
+  preserved). A `// use extract($_REQUEST)` comment or a
+  `"https://…/system("` string is not a sink.
+- Rebuilt `dist/` so the fix ships in the published bundle (a long-running MCP
+  server must be restarted to pick up new `dist/` code — skills load fresh from
+  `skills/`, but compiled engine code is loaded once at startup).
+
+## [1.0.64] — 2026-09-13
+
+### Added — agent-native skills (LLM-driven orchestration doctrine)
+
+Six skills that teach the LLM agent how to drive Blitz Strike's deterministic
+tools end-to-end (the "LLM is the brain, Blitz Strike is the hands" model):
+
+- `bs-orchestrate-engagement` — the full cycle: scope → recon → analyze →
+  verify → review → report, no-babysitting.
+- `bs-scope-gate` — hard scope/authorization gate before any live action.
+- `bs-source-audit` — drive taint + route-confusion + complex-bugs analyzers.
+- `bs-verify-finding` — marker + negative-control live verification.
+- `bs-adversarial-review` — the ten §15 questions + confidence + dedup.
+- `bs-write-report` — submission-ready report (root cause, CVSS, remediation).
+
+Plus `docs/ARCHITECTURE-AUDIT.md` — the Mission Control → LLM-driven toolbelt
+classification (TOOL / SKILL / REDUNDANT).
+
+## [1.0.63] — 2026-09-13
+
+### Added — complex-bug detection (`src/complex-bugs.ts`)
+
+Three "hard" vulnerability classes beyond source→sink taint:
+
+- **Deserialization → POP gadget chain** — `unserialize()` of attacker-controlled
+  data when a magic method (`__destruct`/`__wakeup`/`__toString`/`__invoke`/`__call`)
+  is present in the file (object injection → RCE pivot).
+- **Type juggling** — loose comparison (`==`/`!=`) of user input against a
+  hash/secret (PHP `0e…` collision auth bypass); strict `===` is ignored.
+- **Mass assignment** — `extract()` of request data without `EXTR_SKIP`, or
+  `parse_str()` of user input (variable injection).
+
+Wired into the `@source` agent as `vulnerability` graph nodes. Added a
+`php-complex` fixture to the enterprise benchmark.
+
 ## [1.0.62] — 2026-09-13
 
 ### Added — route-confusion & dispatch-abuse detection

package/bench/enterprise/php-complex/plugin.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Plugin helper (simplified) with multiple complex-bug patterns.
+ */
+
+// 1. Deserialization → object injection (magic method present)
+function restore_session($payload) {
+    $data = $_POST['data'];
+    $obj  = unserialize($data);
+    return $obj;
+}
+
+class CacheManager {
+    public function __destruct() {
+        // Magic method — a POP gadget can pivot object injection to RCE here.
+        system("rm -rf /tmp/cache");
+    }
+}
+
+// 2. Type juggling — loose comparison of user input against a hash
+function verify_signature() {
+    $sig    = $_GET['sig'];
+    $secret = get_option('signing_secret');
+    if ($sig == $secret) {          // <-- loose == , 0e... collision bypass
+        return true;
+    }
+    return false;
+}
+
+// 3. Mass assignment — extract() of request data without EXTR_SKIP
+function bootstrap_options() {
+    extract($_REQUEST);             // <-- variable injection
+    return $admin;                  // $admin is attacker-controlled
+}

package/dist/index.js

@@ -6944,6 +6944,65 @@ function lineno(text, pos) {
   }
   return n;
 }
+function stripComments(text) {
+  const out = text.split("");
+  const n = text.length;
+  let i = 0;
+  while (i < n) {
+    const c = text[i];
+    const nc = text[i + 1];
+    if (c === "'" || c === '"') {
+      const q = c;
+      out[i] = " ";
+      i++;
+      while (i < n && text[i] !== q) {
+        if (text[i] === "\\") {
+          out[i] = " ";
+          i++;
+          if (i < n)
+            out[i] = " ";
+          i++;
+          continue;
+        }
+        if (text[i] !== `
+`)
+          out[i] = " ";
+        i++;
+      }
+      if (i < n)
+        out[i] = " ";
+      i++;
+      continue;
+    }
+    if (c === "/" && nc === "/" || c === "#") {
+      while (i < n && text[i] !== `
+`) {
+        out[i] = " ";
+        i++;
+      }
+      continue;
+    }
+    if (c === "/" && nc === "*") {
+      out[i] = " ";
+      out[i + 1] = " ";
+      i += 2;
+      while (i < n && !(text[i] === "*" && text[i + 1] === "/")) {
+        if (text[i] !== `
+`)
+          out[i] = " ";
+        i++;
+      }
+      if (i < n) {
+        out[i] = " ";
+        out[i + 1] = " ";
+        i += 2;
+      }
+      continue;
+    }
+    i++;
+  }
+  return out.join("");
+}
 function iterSourceFiles(root, maxFiles = 5000) {
   const out = [];
   const walk = (dir) => {
@@ -7005,23 +7064,24 @@ function scanFile(path) {
   } catch {
     return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
   }
+  const code = stripComments(text);
   const endpoints = [];
   for (const hook of NOPRIV_HOOKS) {
     const re = new RegExp(escapeRegExp(hook), "g");
     let m;
-    while ((m = re.exec(text)) !== null) {
-      endpoints.push({ hook, line: lineno(text, m.index) });
+    while ((m = re.exec(code)) !== null) {
+      endpoints.push({ hook, line: lineno(code, m.index) });
     }
   }
   const sinks = [];
   for (const [sink, bugclass] of Object.entries(SINKS)) {
     const re = new RegExp(escapeRegExp(sink), "g");
     let m;
-    while ((m = re.exec(text)) !== null) {
-      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
+    while ((m = re.exec(code)) !== null) {
+      sinks.push({ sink, class: bugclass, line: lineno(code, m.index) });
     }
   }
-  const gates = AUTH_GATES.filter((g) => text.includes(g));
+  const gates = AUTH_GATES.filter((g) => code.includes(g));
   const lines = text.split(`
 `).length;
   return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
@@ -7042,22 +7102,23 @@ function traceFunction(path, symbol) {
       continue;
     const [start, end] = bounds;
     const body = text.slice(start, end);
+    const bodyCode = stripComments(body);
     const bodyStartLine = lineno(text, start);
     const bodyEndLine = lineno(text, end);
     const innerSinks = [];
     for (const [sink, bugclass] of Object.entries(SINKS)) {
       const re = new RegExp(escapeRegExp(sink), "g");
       let sm;
-      while ((sm = re.exec(body)) !== null) {
+      while ((sm = re.exec(bodyCode)) !== null) {
         innerSinks.push({
           sink,
           class: bugclass,
-          line: bodyStartLine + body.slice(0, sm.index).split(`
+          line: bodyStartLine + bodyCode.slice(0, sm.index).split(`
 `).length - 1
         });
       }
     }
-    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
+    const innerGates = AUTH_GATES.filter((g) => bodyCode.includes(g));
     results.push({
       line: bodyStartLine,
       line_end: bodyEndLine,
@@ -7085,11 +7146,12 @@ function grepInFunctions(root, sink, maxHits = 50) {
     } catch {
       continue;
     }
+    const code = stripComments(text);
     const re = new RegExp(escapeRegExp(sink), "g");
     let m;
-    while ((m = re.exec(text)) !== null) {
-      const line = lineno(text, m.index);
-      const head = text.slice(0, m.index);
+    while ((m = re.exec(code)) !== null) {
+      const line = lineno(code, m.index);
+      const head = code.slice(0, m.index);
       const funcRe = /function\s+&?\w+\s*\(/g;
       const funcs = [];
       let fm;
@@ -7098,10 +7160,10 @@ function grepInFunctions(root, sink, maxHits = 50) {
       if (funcs.length === 0)
         continue;
       const fstart = funcs[funcs.length - 1].index;
-      const bounds = findFunctionBounds(text, fstart);
+      const bounds = findFunctionBounds(code, fstart);
       if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
         continue;
-      const body = text.slice(bounds[0], bounds[1]);
+      const body = code.slice(bounds[0], bounds[1]);
       const gates = AUTH_GATES.filter((g) => body.includes(g));
       hits.push({
         file: p,
@@ -37186,7 +37248,7 @@ function detectRouteConfusion(code, file) {
 }
 var SOURCE_TOKENS, DYNAMIC_DISPATCH_RE, DYNAMIC_METHOD_RE, BATCH_LOOP_RE, ROUTE_MATCH_RE, NORMALIZERS;
 var init_route_confusion = __esm(() => {
-  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
+  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
   DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
   DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
   BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
@@ -37194,6 +37256,124 @@ var init_route_confusion = __esm(() => {
   NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
 });
 
+// src/complex-bugs.ts
+function lines2(code) {
+  return code.split(`
+`);
+}
+function lineNo2(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function detectDeserialization(code, file, out) {
+  if (!MAGIC_METHODS.test(code))
+    return;
+  const ls = lines2(code);
+  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "deserialization",
+      category: "Deserialization → POP gadget chain",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+    });
+  }
+}
+function detectTypeJuggling(code, file, out) {
+  const ls = lines2(code);
+  const re = /(?<![=!<>])(==|!=)(?!=)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    const hasSource = SOURCE_TOKENS2.test(l) || SOURCE_TOKENS2.test(scope);
+    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
+    if (!hasSource || !hasHash)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "type_juggling",
+      category: "Type juggling (loose comparison)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
+    });
+  }
+}
+function detectMassAssignment(code, file, out) {
+  const ls = lines2(code);
+  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
+  let m;
+  while ((m = extractRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
+    });
+  }
+  const parseRe = /\bparse_str\s*\(/g;
+  while ((m = parseRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "`parse_str()` of user input into the symbol table — variable injection."
+    });
+  }
+}
+function detectComplexBugs(code, file) {
+  const out = [];
+  detectDeserialization(code, file, out);
+  detectTypeJuggling(code, file, out);
+  detectMassAssignment(code, file, out);
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+var SOURCE_TOKENS2, MAGIC_METHODS;
+var init_complex_bugs = __esm(() => {
+  SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data)|getParameter\(|req\.(query|body|params)/;
+  MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
+});
+
 // src/agents.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 function emptyGraph() {
@@ -37218,6 +37398,7 @@ var init_agents = __esm(() => {
   init_eagle2();
   init_universal_taint();
   init_route_confusion();
+  init_complex_bugs();
   init_adapters();
   init_active();
   init_strike();
@@ -37324,6 +37505,21 @@ var init_agents = __esm(() => {
           graph = upsertNode(graph, nodeId, "route", { file: f, line: rc.line, type: rc.type, hypothesis: hyp.id });
           graph = addEdge2(graph, tid, nodeId, "routes_to");
         }
+        for (const cb of detectComplexBugs(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: cb.category,
+            target: `${f}:${cb.line}`,
+            evidence: cb.detail,
+            confidence: cb.severity === "high" ? 0.7 : 0.55,
+            required_validation: "confirm the payload reaches the sink and is exploitable",
+            potential_impact: cb.type
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `complex:${f}:${cb.line}:${cb.type}`;
+          graph = upsertNode(graph, nodeId, "vulnerability", { file: f, line: cb.line, type: cb.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "vulnerable_to");
+        }
       }
       return { ok: true, output: { files: files.length, findings }, hypotheses, graph };
     }
@@ -38267,6 +38463,13 @@ var init_enterprise_benchmark = __esm(() => {
       expected_vulns: 1,
       expected_sinks: ["Route confusion"],
       safe_tokens: []
+    },
+    {
+      id: "php-complex",
+      dir: join17(ROOT10, "php-complex"),
+      expected_vulns: 4,
+      expected_sinks: ["Deserialization", "Type juggling", "Mass assignment"],
+      safe_tokens: []
     }
   ];
 });

package/docs/ARCHITECTURE-AUDIT.md

@@ -0,0 +1,88 @@
+# Architecture Audit — Mission Control → LLM-Driven Toolbelt
+
+Step 1 of the OMOP-alignment refactor. Every Mission Control component is
+classified into one of:
+
+- **TOOL** — a deterministic check the LLM calls via MCP (produces a result the
+  LLM reasons over).
+- **SKILL** — "how to run the pentest" doctrine/knowledge the LLM loads
+  (becomes `SKILL.md`).
+- **DATA** — static knowledge (patterns/chains/correlations) kept as-is.
+- **REDUNDANT** — deterministic orchestration that duplicates what the LLM
+  already does; remove or fold into a TOOL/SKILL.
+
+The guiding principle: **the LLM is the brain; Blitz Strike is the deterministic
+hands + knowledge + guardrails.** A deterministic "self-driving loop" that tries
+to BE the brain is the anti-pattern being removed.
+
+---
+
+## src/mission/ — classification
+
+| File | Component | Verdict | Why |
+|------|-----------|---------|-----|
+| `types.ts` | shared types (Mission/Task/Hypothesis/Budget/Graph) | **DATA** | Type contracts. Reshape `Mission`→`Engagement` later, but keep as the shared layer. |
+| `state.ts` | `createMission`/`save`/`load`/`list`/`delete` | **TOOL** | Persistence is useful — repurpose as *engagement/finding state* the LLM drives, not an "autonomous mission" blob. |
+| `taskgraph.ts` | `schedule`/`nextBatch`/`allResolved` | **REDUNDANT** | Task scheduling is the LLM's plan-agent job. |
+| `graph.ts` | Security Graph (nodes/edges/stats/merge) | **TOOL** | The finding-relationship graph is genuinely useful for the LLM to track + query. |
+| `hypothesis.ts` | Hypothesis Engine (make/validate/reject/merge) | **TOOL** | Core moat — evidence-first `observation→hypothesis→validated→rejected` lifecycle. LLM calls these per finding. |
+| `control.ts` | `runMission` loop + `buildInitialTasks` + `replan` | **REDUNDANT** | The self-driving scheduler loop — the LLM drives this instead. |
+| `control.ts` | `scopeAllowed` | **TOOL** | Scope guardrail (keep + expose as a check the LLM MUST call before live actions). |
+| `planner.ts` | `ATTACK_BRANCHES` + escalation graph | **SKILL** | Knowledge: which attack branches/escapes exist. Becomes `SKILL.md` + data. |
+| `planner.ts` | `planNextActions` (ranking) | **TOOL** | Deterministic confidence×value−risk ranking the LLM can use as a hint. |
+| `coverage.ts` | `computeCoverage`/`coverageGaps` | **TOOL** | LLM calls to find un-covered dimensions. `COVERAGE_DIMENSIONS` → **SKILL**. |
+| `recovery.ts` | `diagnoseError`/`recoveryDecision` | **TOOL** | LLM calls on failure to pick retry/alternative. `AGENT_ALTERNATIVES` → **SKILL**. |
+| `memory.ts` | `persistMissionMemory`/`recallForTarget` | **TOOL** | Cross-session memory (keep — the LLM's long-term finding store). |
+| `reviewer.ts` | `reviewFinding`/`reviewValidated` (10 questions) | **TOOL** | Adversarial reviewer — key moat. LLM calls before CONFIRMING a finding. |
+| `router.ts` | `routeTask`/`AGENT_TIER` | **REDUNDANT** | Model routing is the LLM platform's own job (or a small TOOL hint). |
+| `budget.ts` | `budgetStatus`/`budgetOverrun`/`consumeTasks` | **TOOL** | LLM calls to check budget. The "terminate on overrun" auto-decision is **REDUNDANT**. |
+| `termination.ts` | `evaluateTermination`/`applyTermination` | **REDUNDANT** | The LLM decides when to stop; the 7 reasons → **SKILL** doctrine. |
+| `benchmark.ts` + `enterprise-benchmark.ts` | benchmark runners | **DATA/QA** | Keep — not runtime brain; QA harness. |
+| `cli.ts` | `mission` CLI subcommands | **REDUNDANT** | Deterministic-brain CLI. Optional standalone fallback; LLM drives via MCP. |
+| `mcp.ts` | `registerMissionTools` (mission_start/status/…) | **REDUNDANT** | Replace with skill/tool MCP tools (the LLM drives granular tools). |
+
+## src/agents.ts — 13 agents
+
+Each agent is a deterministic executor = orchestration (REDUNDANT) + detection
+calls (TOOL). The agent's *responsibility + tool list* becomes a **SKILL**.
+
+| Agent | Repurpose as SKILL | Kept as TOOL |
+|-------|--------------------|--------------|
+| `commander` | orchestration doctrine (plan → delegate → verify → report) | — (LLM is the commander) |
+| `recon` | passive recon doctrine | `activeScan`/`live_recon` (already MCP tools) |
+| `web` | live web-attack doctrine | `strike_verify`/`browser_validate` |
+| `api` | API recon/authz doctrine | `api` detection tools |
+| `source` | source-audit doctrine | `analyzeDataFlow2` + `detectRouteConfusion` + `detectComplexBugs` |
+| `auth` | auth-gap doctrine | auth detection |
+| `analysis` | multi-language taint doctrine | `analyzeTaintUniversal` |
+| `validator` | verification doctrine (marker + negative) | `strikeVerify` |
+| `reviewer` | adversarial-review doctrine | `reviewFinding` (TOOL above) |
+| `reporter` | report-writing doctrine | report generator |
+| `browser` | browser-session doctrine | `browser-agent.ts` (session ops) |
+| `mobile` | mobile RE doctrine | mobile analysis |
+| `cloud` | cloud-enum doctrine | cloud tools |
+
+## src/browser-agent.ts
+
+Session-based browser automation → **TOOL** (LLM calls `browser_agent` op).
+Keep as-is.
+
+## src/server.ts (69 MCP tools)
+
+**KEEP** — the deterministic analysis/verification/evidence tools are the moat.
+Add `instructions` + `next_steps` per tool for LLM ergonomics.
+
+---
+
+## Net outcome
+
+- **Keep as TOOL (moat):** taint engine, universal taint, route-confusion,
+  complex-bugs, strike_verify, hypothesis engine, security graph, adversarial
+  reviewer, coverage, recovery, budget-status, memory, scope gate, browser agent.
+- **Become SKILL:** 13 agent doctrines, reviewer 10-questions, coverage
+  dimensions, attack branches, escalation graph, termination reasons, recovery
+  alternatives.
+- **Remove (REDUNDANT):** `runMission` loop, task scheduler, replan, model
+  router, termination auto-decision, `mission` CLI, `registerMissionTools`.
+
+The deterministic analysis stays; the deterministic *orchestration* goes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.62",
+  "version": "1.0.65",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-adversarial-review.md

@@ -0,0 +1,42 @@
+---
+name: adversarial-review
+description: Use before confirming a verified finding as real. Run the ten adversarial questions, score confidence, dedup shared-root findings, and reject anything that does not survive. This is the anti-hallucination gate between "hypothesis" and "confirmed finding".
+---
+
+# Adversarial review (anti-hallucination gate)
+
+"A hypothesis is not a finding. AI reasoning is not evidence. Severity is not
+confidence." Before any finding is confirmed, attack it from every angle.
+
+## The ten questions (§15)
+
+For each finding, answer these with evidence — not vibes:
+
+1. Is the vulnerable code actually **reachable**?
+2. Is **authentication** required (and did we account for it)?
+3. Is **authorization** enforced elsewhere (would the attacker be blocked)?
+4. Is there **middleware/WAF/sanitizer** protection?
+5. Is the input actually **attacker-controlled**?
+6. Is the **sink** reachable from that input?
+7. Is the observed behavior just **caching** (ETag/304)?
+8. Is the exploit **reproducible** (marker confirmed, not one-off)?
+9. Does the **negative control** remain inert?
+10. Is the **impact** accurately classified (CWE/CVSS, not inflated)?
+
+## Verdict
+
+- Any **fail** → REJECTED. Drop it, do not soften it.
+- Fewer than 3 clear **passes** → NEEDS_MORE_EVIDENCE. Go back to `verify-finding`.
+- 3+ passes, 0 fails → CONFIRMED.
+
+## Scoring + dedup
+
+- `confidence_score` — deterministic weighted confidence (evidence, verification,
+  reachability). Do not invent a confidence number.
+- `dedup_findings` — collapse findings that share a root cause before reporting.
+- `finding_transition` — advance only via the strict lifecycle.
+
+## Why
+
+A false positive costs the user their reputation. Rejecting a real bug is
+recoverable (it stays in memory); reporting a fake one is not.

package/skills/bs-orchestrate-engagement.md

@@ -0,0 +1,42 @@
+---
+name: orchestrate-engagement
+description: Use when the user asks for a full security engagement ("fullscan", "audit this", "pentest this", "scan my target") or any end-to-end assessment. You are the orchestrator — Blitz Strike provides the deterministic analysis and verification tools you drive. Run recon → analyze → verify → review → report without babysitting.
+---
+
+# Orchestrate an engagement (no-babysitting)
+
+You are the brain. Blitz Strike is the hands. Drive the full cycle with the
+deterministic MCP tools; never guess a finding — produce it from tool output.
+
+## The cycle
+
+1. **Scope gate (always first).** Call `scope_check` before any live action.
+   A target outside scope or without authorization → refuse, record, stop.
+   Static source paths on disk are always in-scope; live URLs require an
+   explicit scope.
+
+2. **Recon (passive-first).** For a live target: `live_recon` (fingerprint, WAF,
+   endpoints, tech). For a source tree: `blitz_scan` (entry points + sinks),
+   `detect_framework`, `list_attack_vectors`.
+
+3. **Analyze.** Source → `source-audit` skill (taint + route-confusion +
+   complex-bugs). Live → `active_scan` / `enrich_scan`. Consult `tech_correlation`
+   / `cve_correlation` / `nvd_lookup` to map tech → known weakness classes.
+
+4. **Verify.** Every hypothesis must pass `verify-finding` before it is a finding.
+   "Detection is not proof."
+
+5. **Review.** Every verified finding passes `adversarial-review` before it is
+   confirmed. "A hypothesis is not a finding."
+
+6. **Report.** Emit `generate_report` + `cvss_score` + `write-report`.
+
+## Rules
+
+- One hypothesis per finding; `finding_create` + `finding_transition` for the
+  strict lifecycle (candidate → confirmed → rejected).
+- `dedup_findings` before reporting — collapse shared-root duplicates.
+- Persist hard-won knowledge with `remember`; recall it with `memory_lookup`
+  before re-discovering the same target/pattern.
+- You are the orchestrator — do not try to reimplement planning in prose; pick
+  tools, act, and let tool output drive the next step.

package/skills/bs-scope-gate.md

@@ -0,0 +1,32 @@
+---
+name: scope-gate
+description: Use BEFORE any live action against a target (recon, scanning, exploitation, verification). Enforce scope and authorization boundaries — never touch a target outside the declared scope, and never run live actions against a target the user has not authorized.
+---
+
+# Scope gate
+
+Scope is non-negotiable and cannot be bypassed. Before any live HTTP request,
+port scan, or exploitation step, resolve the boundary deterministically.
+
+## Procedure
+
+1. Call `scope_check` with the target. It returns in-scope / out-of-scope / needs-authorization.
+
+2. **Local source paths** are always in-scope (static analysis of code on disk).
+   Live URLs, IPs, and domains require an explicit, user-declared scope.
+
+3. If `scope_check` says out-of-scope or authorization is missing → **refuse and
+   record.** Do not probe, do not "just check one thing," do not find a bypass.
+
+## Red lines
+
+- Malicious / third-party infrastructure ("cari pelaku") → hold, static analysis
+  + takedown only. Never live-probe.
+- Authorized research targets → live action is fine, but only within the scope
+  the user declared.
+- A finding that depends on out-of-scope action is not a finding — drop it.
+
+## Why
+
+"Scope cannot be bypassed." A tool that ignores scope is worse than a tool that
+misses a bug. The gate is a hard invariant, not a suggestion.

package/skills/bs-source-audit.md

@@ -0,0 +1,50 @@
+---
+name: source-audit
+description: Use when auditing source code (PHP/JS/Python/Java/etc.) for vulnerabilities — static source→sink taint, route confusion/dispatch abuse, deserialization, type juggling, and mass assignment. This is Blitz Strike's deterministic static-analysis moat, distinct from live/dynamic testing.
+---
+
+# Source audit (deterministic static analysis)
+
+Drive Blitz Strike's static analyzers over a source tree and turn each hit into a
+hypothesis. Do not hand-guess; let the tools produce the source→sink evidence.
+
+## Workflow
+
+1. **Map the tree.** `blitz_scan <root>` — entry points (nopriv hooks, REST
+   routes, controllers) + sink inventory per file. `detect_framework` per file
+   to know what conventions apply.
+
+2. **Trace data flow.** For each source→sink candidate:
+   - `taint_file` / `taint_scan` — variable-level taint tracking per file.
+   - `eagle_eye2` — whole-program interprocedural taint (PHP, method-call aware).
+   - `trace_data_flow` — classify sources vs sinks across a file.
+   - `variant_analysis` — group data-flow candidates by shared root cause.
+
+3. **Escalate.** `enrich_scan` — match detected sinks to escalation chains
+   (SQLi → RCE, upload → shell, LFI → RCE). `list_chains` to see the full
+   escalation taxonomy. `tech_correlation` for framework-specific weaknesses.
+
+4. **Deep/complex classes.** Beyond plain taint, look for:
+   - **Route confusion** — `call_user_func`, `$obj->$method()`, batch/proxy
+     forwarding, dynamic include, route match without normalization.
+   - **Deserialization → POP chain** — `unserialize` + `__destruct`/`__wakeup`/
+     `__toString` present.
+   - **Type juggling** — loose `==`/`!=` of user input vs hash/secret.
+   - **Mass assignment** — `extract()` without EXTR_SKIP, `parse_str()` of input.
+
+5. **Correlate.** `cve_correlation` + `nvd_lookup` for the framework/pattern to
+   confirm the weakness class is real and known.
+
+## Pitfalls
+
+- A sink is not a finding — a sink **reached by attacker-controlled input** is a
+  hypothesis. Check the source provenance before reporting.
+- Framework accessors are sources too (`$request->input()`, `request.GET`,
+  `@RequestParam`), not just `$_GET`.
+- Parameterized queries, integer casts (`intval`/`absint`/`(int)`), and ORM calls
+  are neutralizers — do not flag a sink that is actually sanitized.
+
+## Output
+
+Every confirmed sink → `finding_create` with the source→sink chain as evidence,
+then `finding_transition` candidate → validated after `verify-finding`.

package/skills/bs-verify-finding.md

@@ -0,0 +1,38 @@
+---
+name: verify-finding
+description: Use when you have a hypothesis and need to prove it is a real, exploitable finding before reporting it. Live verification with a marker + negative control — never report an unverified hypothesis as a finding.
+---
+
+# Verify a finding (marker + negative control)
+
+"Detection is not proof." A static hit or a scan match is a hypothesis until it
+is live-verified with a distinguishable marker and an inert negative control.
+
+## Procedure
+
+1. **Pick the right verifier.**
+   - Live HTTP → `strike_verify` (sends a payload, checks for a unique marker).
+   - Browser/DOM (XSS, auth flows) → `browser_validate`.
+
+2. **Marker, not echo.** Use a unique, nonce-like marker (`blitzstrike-<rand>`)
+   that cannot be a benign echo. If the response reflects it, that is the signal.
+
+3. **Negative control.** Send a payload that is structurally similar but MUST NOT
+   trigger (a wrong param, a harmless value). If the control ALSO reflects the
+   marker, it is a `false_positive` — the app echoes everything, not exploitable.
+
+4. **Interpret.**
+   - Marker reflected + control inert → `verdict=confirmed`, attach evidence.
+   - Marker reflected + control also reflected → `false_positive`, reject.
+   - Nothing → retry once, then `NEEDS_MORE_EVIDENCE`.
+
+5. **Record.** `finding_attach_evidence` (redacted, SHA-256 tagged) +
+   `finding_transition` to validated/rejected. Use `redact` on any secret before
+   it is persisted.
+
+## Pitfalls
+
+- Never verify by "looks right" — the marker/control pair is the only proof.
+- A blind RCE without a callback channel: tunnel the callback (public tunnel,
+  no local IP) and observe it arrive — that is the proof.
+- Keep evidence redacted; raw secrets must never be persisted.

package/skills/bs-write-report.md

@@ -0,0 +1,33 @@
+---
+name: write-report
+description: Use when finalizing confirmed findings into a submission-ready report (bug bounty, pentest deliverable, or audit). Produce a report with root cause, reproduction, CVSS, impact, and remediation — indistinguishable from a top-tier human hunter.
+---
+
+# Write the report
+
+Turn confirmed findings into a submission-ready deliverable. A triager should
+not be able to tell an agent wrote it.
+
+## Structure per finding
+
+1. **Title + summary** — one line, precise, no clickbait.
+2. **Root cause** — the exact code path (source → sink), not a generic description.
+3. **Reproduction steps** — exact request(s) + the marker/control proof from
+   `verify-finding`.
+4. **Impact** — what an attacker actually gains (data, RCE, account takeover).
+5. **CVSS** — `cvss_score` with the correct vector string; do not inflate.
+6. **Remediation** — concrete, implementable, framework-appropriate.
+
+## Tools
+
+- `generate_report` — deterministic markdown/JSON report from the findings.
+- `cvss_score` — deterministic CVSS v3.1 vector.
+- `redact` — strip passwords/keys/tokens/cookies before any output.
+- `finding_attach_evidence` — link the redacted, SHA-256-tagged evidence.
+
+## Rules
+
+- Only CONFIRMED findings (passed `adversarial-review`) go in the report.
+- No false-positive spam, no "low-hanging fruit" filler.
+- Never include raw secrets, API keys, or live session tokens.
+- Group by root cause; a report full of duplicates reads as noise.