security-mcp 1.1.4 → 1.3.3

package/skills/pentest-social/SKILL.md

@@ -23,6 +23,15 @@ Model realistic social engineering threats and insider risk scenarios based on t
 team, secrets, and access patterns found in this project. Write mitigations that reduce
 the blast radius of human compromise.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `secrets`, `ci-pipeline`, and `auth-deep.ts`) is your access map, not your ceiling — read it to learn what a compromised human actually controls. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** turn a `secrets`/`ci-pipeline` finding into a human-factor kill chain — an engineer whose token unlocks the CI secret store can, via one spear-phish, reach prod deploy creds and the customer datastore; map the blast radius of each named role across every surface the suite touches.
+- **Semantic / effective-state analysis:** decide whether MFA, least-privilege, secret scoping, and offboarding are *effectively* enforced for real humans, not just configured — a break-glass account with a shared password or a PAT that outlives the contractor is the actual exploit.
+- **External corroboration:** WebSearch/WebFetch for OSINT on the project and team (public repos, leaked creds, social profiles) and current phishing/insider-threat TTPs (MITRE ATT&CK Initial Access).
+- **Apply & prove:** write the mitigation inline (tighter CI secret scope, MFA enforcement, allowlist logging), re-run the relevant `src/gate/checks/` modules as a regression floor, then re-audit the blast radius. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 1. **OSINT on the project (authorized pre-engagement reconnaissance):**
@@ -70,3 +79,204 @@ If internet permitted:
 - Blast radius of successful compromise
 - Detection gap (what monitoring would NOT catch this)
 - Mitigation control implemented or recommended
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+### 1. Vishing & Smishing Against Developer Personas (Post-2024 AI-Assisted)
+**Technique**: AI-cloned voice calls impersonating IT helpdesk or CISO, requesting OTP read-back or VPN credential reset. Real-world precedent: MGM Resorts breach (2023) used 10-minute social engineering call to reset Okta credentials.
+**Test**: Enumerate on-call rotation from PagerDuty webhook configs or GitHub action secrets. Check if voice phishing playbooks exist in `docs/security/` or runbooks. Verify MFA policy enforces FIDO2 (phishing-resistant) rather than TOTP or SMS.
+**Finding**: Any production access path protected only by SMS OTP or TOTP is exploitable via real-time phishing proxy (Evilginx2, Modlishka).
+
+### 2. Adversarial ML Prompt Injection via Phishing Lure (2025 Threat — AI-Assisted Attacks)
+**Technique**: Attacker crafts a document or email containing hidden prompt-injection payloads targeting AI coding assistants (GitHub Copilot, Cursor, Claude Code) used by the development team. The injected instruction appears in a README, PR description, or support ticket and coerces the AI to suggest malicious code changes. See research: "Not what you've signed up for: Compromising Real-World LLM-Integrated Applications" (Greshake et al., 2023), now operationalized by threat actors in 2025.
+**Test**: Search for AI assistant configuration files (`.github/copilot-instructions.md`, `.cursorrules`, `.claude/CLAUDE.md`). Verify no external content (issue bodies, PR descriptions) is fed unsanitized into AI assistant system prompts. Test whether the AI assistant can be induced to commit unauthorized code by embedding instructions in a crafted source file.
+**Finding**: If AI assistant instructions are loaded from repo-writable paths without integrity checks, an attacker with PR access can manipulate AI-assisted code review for all engineers on the team.
+
+### 3. CI/CD Pipeline Poisoning via Dependency Confusion (Supply Chain Social Engineering)
+**Technique**: Register a public npm/PyPI/RubyGems package with the same name as an internal private package, triggering automatic installation by developers who run `npm install` on a cloned repo (CVE category: CWE-427, uncontrolled search path). Typosquatting variant: `lodahs` for `lodash`.
+**Test**: Extract all package names from `package.json`, `requirements.txt`, `Gemfile`. Query npm registry API for each: `GET https://registry.npmjs.org/<package-name>`. Flag any internal package name that resolves to a public package not owned by the organization. Run: `grep -r "registry" .npmrc .yarnrc.yml` to verify private registry is pinned.
+**Finding**: Any package name resolvable on the public registry that is intended as internal = HIGH. Exploitation requires only registering the package with a higher version number.
+
+### 4. GitHub Token Exfiltration via Malicious GitHub Action (OIDC Abuse)
+**Technique**: A contributor submits a pull request that modifies a workflow file to exfiltrate `GITHUB_TOKEN` or OIDC tokens to an external endpoint. The PR appears to add logging or testing improvements.
+**Test**: Audit all `.github/workflows/*.yml` for `pull_request_target` triggers (runs with write token on PR from fork). Check `permissions:` blocks — any `id-token: write` combined with unvalidated external action references (`uses: some-unverified-action@main`) enables OIDC token theft. Run: `grep -r "pull_request_target" .github/workflows/`.
+**Finding**: A workflow with `pull_request_target` and no `if: github.event.pull_request.head.repo.full_name == github.repository` guard allows a forked PR to execute with the repo's full `GITHUB_TOKEN`. Blast radius: write access to all branches, packages, and deployments.
+
+### 5. Watering Hole Attack via Developer Tool Ecosystem
+**Technique**: Attacker compromises a community tool used by the target development team (VS Code extension, Homebrew formula, JetBrains plugin). Security researcher proof-of-concept: malicious VS Code extension with 100K+ downloads (2023). Post-2024: AI coding assistant plugins as high-value watering holes due to broad code access.
+**Test**: Enumerate installed VS Code extensions from `extensions.json` or `.vscode/extensions.json` in the repo. Check publisher verification and download counts. Any extension from an unverified publisher with filesystem or network access = risk. Run: `grep -r "recommendations" .vscode/`.
+**Finding**: Unverified VS Code extensions with `readFileSystem` or `executeCommand` capabilities can exfiltrate entire local repositories including secrets cached in dotfiles.
+
+### 6. Lure-Based Credential Harvesting via OAuth App Consent Attack
+**Technique**: Attacker registers a malicious OAuth application with a convincing name (e.g., "GitHub Security Audit Tool") and sends the authorization link to developers via Slack, email, or GitHub issue. Upon consent, the attacker receives an OAuth token with the granted scopes, potentially including `repo:write` or `read:org`.
+**Test**: Review GitHub organization's OAuth app audit log. Check if `org.oauth_application.added` events are monitored in SIEM. Verify organization policy enforces OAuth app approval by admins (`Settings > Third-party access > OAuth App policy`). Test by listing authorized apps: `gh api /user/installations`.
+**Finding**: If the GitHub organization allows any OAuth app without admin pre-approval, a phished developer grants repo write access to an attacker without any credential theft.
+
+### 7. Pretexting via Internal Tooling Impersonation (Slack/Teams Webhook Abuse)
+**Technique**: Attacker exploits an exposed or leaked incoming webhook URL for Slack/Teams to send messages appearing to originate from official internal channels (e.g., "#security-alerts", "#deployments"). The message instructs developers to rotate a secret by visiting a phishing URL. MITRE ATT&CK: T1566.002 (Spearphishing Link via Service).
+**Test**: Search codebase for hardcoded webhook URLs: `grep -rE "https://hooks\\.slack\\.com|https://[a-z]+\\.webhook\\.office\\.com" . --include="*.js" --include="*.ts" --include="*.env*" --include="*.yml"`. Any committed webhook URL is exploitable by anyone who reads the repo (including via public git history).
+**Finding**: A leaked Slack incoming webhook URL enables unlimited impersonation of internal security communications without authentication. Severity: HIGH if the workspace lacks verified sender indicators.
+
+### 8. AI-Generated Deepfake Document Phishing (2025 Active Threat)
+**Technique**: LLM-generated spear-phishing emails and documents tailored to the target using OSINT data scraped from GitHub profiles, commit messages, and LinkedIn. Quality now indistinguishable from genuine communication. Paired with AI voice cloning for follow-up "verification" calls. Observed in wild against software teams since Q1 2025.
+**Test**: Assess whether team has security awareness training covering AI-generated phishing indicators. Check if email gateway enforces DMARC/DKIM/SPF for all outbound domains associated with the project. Run: `dig TXT <project-domain> | grep "v=spf"`. Verify DMARC policy is `p=reject`, not `p=none`.
+**Finding**: If project domain lacks `p=reject` DMARC, attackers can send emails that pass spam filters appearing to originate from `@<project-domain>` addresses, targeting both team members and customers with AI-personalized content.
+
+---
+
+## §PENTEST_SOCIAL-CHECKLIST
+
+1. **Phishing-resistant MFA enforcement**: Verify all accounts with production, CI/CD, or secrets access require FIDO2/WebAuthn (passkeys or hardware tokens). Mechanism: check IdP policy (Okta, Azure AD, Google Workspace MFA settings). Finding: any admin or deployer account accepting SMS OTP or TOTP = HIGH.
+
+2. **GitHub organization OAuth app policy**: Confirm `Settings > Third-party access` requires admin approval for all OAuth apps. Mechanism: `gh api /orgs/<org>/settings` and review `two_factor_requirement`, `members_can_create_public_repositories`. Finding: any org without required admin pre-approval for OAuth apps = MEDIUM.
+
+3. **CODEOWNERS blast radius mapping**: Map every engineer listed in CODEOWNERS to their other access (cloud IAM roles, npm publish rights, Kubernetes RBAC). Mechanism: read `.github/CODEOWNERS`; cross-reference with AWS/GCP IAM user lists if accessible. Finding: a single engineer with CODEOWNERS approval authority AND unrestricted cloud IAM = HIGH lateral movement risk on account compromise.
+
+4. **Secrets in git history (retrospective)**: Run `git log --all --full-history -- "**/*.env"` and `trufflehog git file://.` against the full repository history. Mechanism: secrets committed and later deleted remain accessible in history. Finding: any valid credential (API key, private key, password) in any commit = CRITICAL regardless of age.
+
+5. **Pull request target workflow guard**: Audit all `pull_request_target` GitHub Actions workflows for missing head-repo guards. Mechanism: `grep -rn "pull_request_target" .github/workflows/`. Correct guard: `if: github.event.pull_request.head.repo.full_name == github.repository`. Finding: absent guard = any fork PR executes with write `GITHUB_TOKEN` = HIGH.
+
+6. **Typosquatting and dependency confusion**: For every package in `package.json` dependencies: verify the npm organization ownership matches the expected publisher. Mechanism: `npm info <package> | grep "maintainers"`. For internal package names not on npm, verify private registry scoping (e.g., `@<org>/` prefix) is enforced in `.npmrc`. Finding: any unscoped internal package name resolvable on public npm = HIGH.
+
+7. **Offboarding process verification**: Check if there is a documented and audited offboarding checklist. Mechanism: search `docs/`, `runbooks/`, Notion/Confluence links in README for "offboarding". Verify the checklist includes: GitHub org removal, cloud IAM revocation, VPN certificate revocation, shared secret rotation. Finding: undocumented or unaudited offboarding = MEDIUM (becomes HIGH on first departing insider with production access).
+
+8. **Incoming webhook and bot token exposure**: Scan all files including git history for Slack, Teams, PagerDuty, and other webhook URLs or bot tokens. Mechanism: `trufflehog git file://.` + `grep -rE "xoxb-|xoxp-|xoxs-|hooks\.slack\.com"`. Finding: any live webhook or token = HIGH (immediate rotation required).
+
+9. **DMARC/SPF/DKIM enforcement on project domains**: For each domain associated with the project (from package.json `homepage`, README, CODEOWNERS emails), check DNS records. Mechanism: `dig TXT <domain>` for SPF; `dig TXT _dmarc.<domain>` for DMARC `p=reject`. Finding: `p=none` or missing DMARC = MEDIUM (email impersonation of project domain possible).
+
+10. **Watering hole risk in developer tooling**: Review `.vscode/extensions.json`, `.idea/`, and any documented toolchain dependencies. Mechanism: for each extension/plugin, verify publisher identity and review requested permissions. Finding: any unverified-publisher extension with `workspace` or filesystem access = MEDIUM (escalates to HIGH if extension has network access).
+
+11. **AI assistant instruction file integrity**: Check for AI coding assistant configuration files (`.cursorrules`, `.github/copilot-instructions.md`, `.claude/`). Mechanism: verify these files are not modifiable by contributors without code owner review; check if they are included in `.github/CODEOWNERS`. Finding: AI assistant instructions writable by any contributor without review = MEDIUM (indirect code injection vector).
+
+12. **Insider threat detection monitoring gaps**: Verify whether the SIEM/logging stack captures: bulk data export events, after-hours deployment activity, access from new geographic locations, and access token creation. Mechanism: review CloudTrail/audit logs for `CreateAccessKey`, `GetSecretValue`, and equivalent events. Finding: no alerting on bulk `GetSecretValue` calls by a single IAM principal = HIGH detection gap.
+
+---
+
+## §POC-REQUIREMENT
+
+For every social engineering or insider threat finding:
+
+1. **Write working PoC FIRST**: Document the exact attack chain — the specific target (role, access level), the exact phishing lure or insider action, the precise credential or data accessed, and the observed impact (e.g., "GitHub token with `repo:write` scope obtained; used to push to main branch bypassing branch protection").
+2. **Confirm reproduction**: For technical vectors (workflow injection, dependency confusion, webhook abuse), demonstrate the attack executes as described. For human vectors, document the scenario with sufficient detail that a red team could execute it without further clarification.
+3. **Write fix**: Implement the specific control — enforce FIDO2, add CODEOWNERS guard, rotate exposed secret, enforce private registry scoping.
+4. **Verify PoC fails against fix**: Re-test the attack chain after the control is in place. For human vectors, confirm the policy or technical control would block the scenario at the identified failure point.
+5. **Record in findings JSON under `exploitPoC`**: Include the attack chain description, the target role, the blast radius, and the control implemented.
+
+**PoC skipping = severity automatically downgraded to MEDIUM.**
+
+---
+
+## §PROJECT-ESCALATION
+
+Immediately alert the CISO orchestrator and reprioritize the run when any of the following are confirmed:
+
+1. **Live credential found in git history**: Any API key, cloud credential, private key, or password present in any commit (including deleted files) that has not been provably rotated. This is a CRITICAL active compromise risk — do not wait for the full run to complete.
+
+2. **`pull_request_target` workflow without head-repo guard**: Confirmed exploitable workflow that allows a fork PR to execute with write `GITHUB_TOKEN`. An external attacker with a GitHub account can exploit this with zero prerequisites.
+
+3. **Admin account without phishing-resistant MFA**: Any GitHub organization owner, cloud account root user, or IdP admin confirmed to have only SMS/TOTP MFA. A single vishing or real-time phishing proxy attack (Evilginx2) results in full organization takeover.
+
+4. **AI assistant instruction file writable by external contributors**: If `.cursorrules`, `.github/copilot-instructions.md`, or equivalent files are not in CODEOWNERS and can be modified by PR from any contributor — the team's AI coding assistant becomes a code injection vector for any attacker who submits a PR.
+
+5. **Confirmed typosquatted package installed**: A public npm/PyPI package with a name matching an internal dependency has been installed from the public registry instead of the intended internal source. This is an active supply chain compromise — treat as CRITICAL, escalate immediately.
+
+6. **DMARC `p=none` on a domain used in customer-facing communications**: Combined with social engineering context, this allows an attacker to send phishing emails that appear to originate from the organization's own domain to customers, partners, and team members.
+
+7. **No documented offboarding process AND a high-privilege departure identified**: If git history shows a recently inactive committer with production or secrets access and no evidence of access revocation — this is a latent insider threat. Escalate for immediate access audit.
+
+8. **Evidence of data exfiltration pattern in audit logs**: Bulk `GetSecretValue`, `ListBuckets`, `ExportData`, or equivalent API calls in a short window from a single principal — even if currently authorized, this warrants immediate investigation as a potential insider exfiltration in progress.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "Credential in Git History", "filesReviewed": 312, "patterns": ["trufflehog", "git log --all"], "result": "CLEAN" }],
+    "filesReviewed": 312,
+    "negativeAssertions": ["Credential in Git History: trufflehog scanned all 312 commits — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "pentest-social",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.

package/skills/pentest-team/SKILL.md

@@ -25,6 +25,15 @@ SKILL.md §9 is the minimum. You go beyond it.
 Every finding includes: CVSS v4, CWE, ATT&CK technique ID, step-by-step PoC chain,
 and a "blast radius" statement: what data can be accessed, modified, or destroyed.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `api.ts`, `auth-deep.ts`, `injection-deep.ts`, `infra.ts`, `k8s.ts`) is your deterministic floor, not your ceiling. As team LEAD you read the Phase-1 threat-model.json as the access map and attack every surface; treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** chain an exposure across modules — an IDOR found by `api.ts` + a missing tenant check in `database`-layer code + an over-scoped CI secret from `ci-pipeline` becomes a full account-takeover-to-infra-pivot kill chain no single check sees.
+- **Semantic / effective-state analysis:** weigh each individual finding against the modeled adversary's goal and the runtime's effective trust boundaries; a "low" auth gap is critical when it sits on the path to the crown-jewel data flow.
+- **External corroboration:** WebSearch/WebFetch for current CVEs/advisories, CISA KEV entries, and exploit PoCs matching the project's stack and dependency versions.
+- **Apply & prove:** write the remediation inline at the true root cause, re-run the relevant `src/gate/checks/` modules (plus burp/nuclei/sqlmap/scoutsuite as the surface dictates) as a regression floor, then re-audit the whole chain. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## ACTIVATION PROTOCOL
 
 1. Call `orchestration.update_agent_status(agentRunId, "pentest-team", "running")`
@@ -171,3 +180,90 @@ Each tactic MUST be addressed — explicitly CONFIRMED or "N/A — reason: …".
 - **Multi-turn attack chain**: build up context over 5+ turns to bypass instruction hierarchy
 - **Indirect injection via RAG**: inject payload into document that model retrieves — does it execute?
 - **Agentic loop exploitation**: trigger infinite tool call loops to exhaust rate limits or billing
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "AGENT_NAME",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```

package/skills/pentest-web-api/SKILL.md

@@ -23,6 +23,15 @@ Execute full OWASP Testing Guide methodology against all endpoints found in the
 Every finding is exploited end-to-end with a concrete PoC. No theoretical vulnerabilities —
 only confirmed exploitable issues with real impact.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `api` + `web-nextjs` + `injection-deep` + `auth-deep` + `graphql` detection modules (`src/gate/checks/api.ts`, `src/gate/checks/web-nextjs.ts`, `src/gate/checks/injection-deep.ts`, `src/gate/checks/auth-deep.ts`, `src/gate/checks/graphql.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** chain an IDOR across endpoints — an object ID leaked by one `api.ts` route + a missing ownership check on a second route + a GraphQL field (`graphql.ts`) that exposes the same record becomes full horizontal/vertical privesc; follow user input through a Next.js server action into the DB query to confirm injection reaches the sink.
+- **Semantic / effective-state analysis:** decide whether authZ is enforced per-object (BOLA/BFLA) and not just per-route, whether GraphQL depth/cost limits and introspection controls are *effectively* on, and whether the `auth-deep` session check actually gates the mutation — middleware that authenticates but never authorizes is the bug.
+- **External corroboration:** WebSearch/WebFetch for current OWASP API Top 10 / Testing Guide updates and CVEs for the framework, GraphQL server, and Next.js version in use.
+- **Apply & prove:** write the authZ/validation fix inline, re-run the `api`/`web-nextjs`/`injection-deep`/`auth-deep`/`graphql` checks (plus burp/sqlmap against the live endpoints and a GraphQL introspection/depth probe) as a regression floor, then re-audit the chain. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 1. Read `threat-model.json` and all Phase 1 appsec findings as the engagement brief
@@ -115,6 +124,33 @@ Test all of the following chains (mark each CONFIRMED, PARTIAL, or N/A with reas
 3. Test `expand`/`include`/`fields` query params — do they expose hidden or privileged fields?
 4. **Required fix**: explicit field allowlist per role in every PATCH/PUT handler; no object spread from req.body
 
+## BEYOND SKILL.MD
+
+Domain-specific threats beyond the standard OWASP checklist that this agent MUST test:
+
+- **CVE-2023-45133 (Babel transform RCE via prototype pollution)** — any app using Babel plugins server-side that accept user-controlled input can reach arbitrary code execution through `__proto__` mutation; test every transform pipeline endpoint.
+- **GraphQL batching amplification (no CVE — research: HackerOne 2022)** — a single HTTP request with 500 aliased `user(id: X)` queries bypasses per-endpoint rate limits; measure actual resolver fanout and confirm depth/complexity limits are enforced.
+- **JWT algorithm confusion (CVE-2022-21449 / "Psychic Signatures")** — ECDSA libraries that skip point-at-infinity validation accept blank signatures on any payload; test by sending `r=0, s=0` in ES256 JWTs against every token-verified endpoint.
+- **Mass assignment via OpenAPI `additionalProperties: true`** — generated SDK clients silently pass unknown fields; fuzz every PATCH/POST body with `role`, `isAdmin`, `subscriptionTier`, `ownerId` — confirm server rejects or ignores them.
+- **AI-powered LLM prompt injection via API input fields (2024–present)** — if any endpoint pipes user input into an LLM (summarise, classify, translate), test for indirect prompt injection: store a payload in a user-controlled field (name, bio, product description) that triggers when an AI feature reads it — exfiltrate system prompt or issue tool calls.
+- **Post-quantum harvest-now-decrypt-later on API traffic** — API responses containing long-lived PII (SSN, medical records, financial data) encrypted under RSA/ECDSA today are already being captured for future CRQC decryption; audit whether the API enforces forward-secrecy (TLS 1.3 + ephemeral DH) and whether any at-rest tokens use RSA-OAEP or ECDH without hybrid ML-KEM wrapping.
+- **HTTP/2 rapid reset DoS (CVE-2023-44487)** — client opens and immediately cancels streams at high rate to exhaust server worker threads without triggering request-volume limits; test against any HTTP/2-enabled endpoint and verify the server applies stream-reset rate limiting.
+- **BOLA chain through indirect object reference in pagination cursors** — cursor-based pagination tokens (base64-encoded DB IDs) often encode a resource ID that is never re-authorised on decode; decode every `after`/`cursor` parameter and substitute another user's resource ID.
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "AGENT_NAME",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
 ## OUTPUT
 
 `AgentFinding[]` array with confirmed exploitable findings. Each includes:
@@ -122,3 +158,74 @@ Test all of the following chains (mark each CONFIRMED, PARTIAL, or N/A with reas
 - What data was accessed or what action was performed
 - CVSS v4 score, ATT&CK technique, step-by-step PoC
 - Fixed code written inline
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```