rtexit-method 0.1.0 → 0.1.1

package/packaged-assets/.agents/skills/rt-exploit-file-upload/payloads/README.md

@@ -0,0 +1,4 @@
+# File Upload Test Files
+
+Store harmless test files here for authorized upload validation. Avoid executable payloads in the framework repository.
+

package/packaged-assets/.agents/skills/rt-exploit-file-upload/workflow.md

@@ -0,0 +1,68 @@
+# Workflow - rt-exploit-file-upload
+
+## Purpose
+
+This workflow standardizes how $skill is executed inside RTExit. It is designed for authorized engagements, evidence-first documentation, and consistent handoff into reporting.
+
+## Authorization Gate
+
+Before execution, confirm:
+
+- SEAD exists and explicitly covers the target asset or activity.
+- Rules of Engagement define allowed techniques, rate limits, and stop conditions.
+- The operator knows the evidence handling rules.
+- Any active or sensitive validation has client approval.
+
+If any item is unclear, pause and invoke 
+
+## Required Inputs
+
+| Input | Source | Notes |
+|---|---|---|
+| Engagement reference | _rtexit/config.toml or SEAD | Used in output names. |
+| Target asset(s) | Scope document | Must be explicitly approved. |
+| Operator name | Config/user context | Used in timeline entries. |
+| Evidence directory | _rtexit-output/docs/evidence/ | Store logs, screenshots, and artifacts. |
+| Finding tracker | _rtexit-output/docs/findings/ | Create/update findings when confirmed. |
+
+## Execution Steps
+
+1. Load current engagement configuration.
+2. Read scope, exclusions, and current findings.
+3. Build a small test plan for this skill with target, expected control, and evidence type.
+4. Run the lowest-risk validation first.
+5. Capture baseline behavior before proof behavior.
+6. Record exact timestamp, account/role used, and affected asset.
+7. Stop when evidence is sufficient; avoid unnecessary data access.
+8. Create or update findings through the RTExit finding tracker.
+9. Map remediation owner and recommended timeline.
+10. Add a timeline entry and evidence chain entry.
+
+## Evidence Requirements
+
+| Evidence | Required? | Notes |
+|---|---|---|
+| Command or action summary | Yes | Redact secrets and tokens. |
+| Screenshot or transcript | If useful | Store under evidence folder. |
+| Request/response pair | For web/API | Redact cookies and bearer tokens. |
+| Config excerpt | For cloud/infra | Include only relevant lines. |
+| Business impact note | Yes | Explain why it matters. |
+
+## Autodoc Commands
+
+`ash
+python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-file-upload --phase auto --cmd "workflow execution" --output "summary"
+python _rtexit/scripts/finding_tracker.py list
+`
+
+## Completion Criteria
+
+- Scope and authorization are referenced.
+- Evidence is stored and redacted.
+- Findings are added or explicitly marked as not found.
+- Remediation guidance is actionable.
+- Timeline and chain of custody are updated where applicable.
+
+## Handoff
+
+Send confirmed findings to 

package/packaged-assets/.agents/skills/rt-exploit-firebase/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: rt-exploit-firebase
+description: "Authorized Firebase security assessment skill for Firestore, Realtime Database, Storage, Authentication, Cloud Functions, API key exposure context, App Check, and remediation."
+---
+
+# rt-exploit-firebase - Firebase Security Assessment
+
+## Overview
+
+Firebase risk usually comes from permissive security rules, weak role modeling, exposed storage, callable functions, missing App Check, or misunderstanding API keys. This skill reviews Firebase posture without treating every API key as automatically critical.
+
+## Prerequisites
+
+- Firebase project IDs and apps in scope.
+- Test accounts for each role.
+- Approved test collections/buckets.
+- Rules export or console access if provided.
+- Agreement on data sampling limits.
+
+## Assessment Areas
+
+| Service | Key Checks |
+|---|---|
+| Authentication | Sign-up policy, providers, email verification, custom claims. |
+| Firestore | Rules, document ownership, collection group access, query constraints. |
+| Realtime Database | Read/write rules, validation rules, anonymous access. |
+| Storage | Object permissions, metadata exposure, direct download URLs. |
+| Cloud Functions | Callable auth checks, secrets, CORS, rate limits. |
+| App Check | Enforcement for app/API abuse reduction. |
+| API Keys | Restrictions, quota, and actual abuse path. |
+
+## Workflow
+
+1. Identify project ID, app IDs, and exposed endpoints.
+2. Review security rules against role model.
+3. Validate only with test documents and accounts.
+4. Check storage object permissions and signed URL patterns.
+5. Review cloud function auth boundaries.
+6. Map misconfigurations to business data exposure.
+
+## Evidence
+
+Capture rules excerpts, test account role, test document path, expected result, observed result, and redacted screenshots. Avoid reading production user data.
+
+## Remediation
+
+- Deny by default.
+- Enforce owner/role checks in rules.
+- Add rules unit tests.
+- Enable App Check for abuse-sensitive apps.
+- Restrict API keys where appropriate.
+- Move privileged logic to trusted server/cloud functions.
+- Monitor suspicious reads/writes and quota spikes.
+