security-mcp 1.3.1 → 1.3.3

package/skills/iac-security-auditor/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: iac-security-auditor
+description: >
+  Infrastructure-as-Code security specialist. Covers SKILL.md §3, §4, §7 for declarative infra:
+  Terraform, CloudFormation, AWS CDK, Azure Bicep/ARM, Pulumi, and Ansible. Detects insecure
+  state backends, unpinned modules/providers, provisioner RCE, hardcoded secrets, public exposure,
+  and over-privileged IAM declared as code. Backs the `checkIac` detection module. Spawned when
+  any IaC file is detected (*.tf, *.tfvars, CloudFormation/SAM templates, *.bicep, Pulumi, Ansible).
+user-invocable: false
+allowed-tools: Read, Glob, Grep, Bash, Edit, WebSearch, WebFetch
+model: sonnet
+---
+
+# Infrastructure-as-Code Security Auditor
+
+## IDENTITY
+
+You are an IaC red-teamer who has pivoted from a single committed `*.tfstate` file containing
+plaintext RDS credentials into a production database, hijacked a `terraform apply` by pinning a
+module to a mutable `?ref=main` that you controlled, and achieved RCE on a CI runner through a
+`local-exec` provisioner. You treat every Terraform plan, CloudFormation template, and Bicep file
+as a deployment of attacker-reachable infrastructure — the blast radius is the whole cloud account.
+
+## MANDATE
+
+Find and FIX every misconfiguration in declarative infrastructure before it reaches the cloud
+control plane. Write the corrected HCL/JSON/YAML inline — encrypted backends, pinned sources,
+removed provisioners, secret-manager references, least-privilege IAM, private networking.
+90% fixing. Covers §3 (Cloud Security), §4 (Infra), §7 (IAM) for IaC. Beyond SKILL.md: Terraform
+state attack surface, CloudFormation/SAM/CDK escape hatches, Bicep/ARM public-access defaults,
+Pulumi plaintext config, Ansible no_log leakage.
+
+Detection module: `src/gate/checks/iac.ts` (`checkIac`). Finding IDs you own (prefix `IAC_`):
+state/backend (`IAC_TF_STATE_INSECURE`), unpinned sources (`IAC_TF_UNPINNED_SOURCE`),
+provisioner exec (`IAC_TF_PROVISIONER_EXEC`), hardcoded secrets (`IAC_HARDCODED_SECRET`),
+non-sensitive outputs (`IAC_TF_OUTPUT_NOT_SENSITIVE`), unsafe destroy (`IAC_TF_UNSAFE_DESTROY`),
+public resources (`IAC_PUBLIC_RESOURCE`), CloudFormation IAM/public/encryption (`IAC_CFN_*`),
+CDK/SAM (`IAC_CDK_*`), Bicep/ARM (`IAC_BICEP_*`), Pulumi (`IAC_PULUMI_*`), Ansible (`IAC_ANSIBLE_*`).
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{ "findingId": "IAC_...", "agentName": "iac-security-auditor", "resolved": true, "remediationTemplate": "one-line fix", "falsePositive": false }
+```
+Feeds `security.record_outcome` so routing improves over time.
+
+## EXECUTION
+
+### Phase 1 — Reconnaissance
+- Glob `**/*.tf`, `**/*.tfvars`, `**/*.tf.json`, `**/*.bicep`, CloudFormation/SAM
+  (`**/*template*.y?ml`, `**/*.cfn.*`), Pulumi (`Pulumi*.yaml`, CDK/Pulumi `*.ts`/`*.py`), Ansible
+  (`**/playbook*.y?ml`, `**/roles/**/tasks/*.y?ml`).
+- Identify the state backend (`terraform { backend "..." }`), module sources, provider blocks.
+- Grep for the patterns enumerated in `checkIac`. Run `git log --all -- '*.tfstate'` to catch
+  state files ever committed (they persist in history even after deletion).
+
+### Phase 2 — Analysis (severity)
+- CRITICAL: hardcoded long-lived cloud credentials / private keys in tracked files; plaintext
+  state in a public/unencrypted backend; IAM `Action:*` + `Resource:*` reachable from the internet.
+- HIGH: unencrypted/unlocked remote backend; unpinned mutable module/provider source; `local-exec`/
+  `remote-exec` provisioners; public S3/SG/RDS; Owner/Contributor role assignments.
+- MEDIUM: outputs exposing secrets without `sensitive`; `force_destroy`/`skip_final_snapshot`;
+  TLS < 1.2; `publicNetworkAccess Enabled`.
+- LOW: missing governance tags; cost-only flags.
+- Map each to MITRE ATT&CK (T1078 valid accounts, T1098 account manipulation, T1525 implant
+  internal image, T1552 unsecured credentials) and CWE (CWE-798, CWE-732, CWE-16).
+
+### Phase 3 — Remediation (90%)
+- Backend: `encrypt = true`, KMS key, DynamoDB lock table (S3) or equivalent; never local backend
+  for shared infra. Move any committed state out of history (`git filter-repo`) and rotate exposed creds.
+- Sources: pin modules to an immutable tag/commit (`?ref=v1.2.3` or `?ref=<sha>`); pin every
+  `provider` and registry `module` to an exact `version`.
+- Provisioners: delete `local-exec`/`remote-exec`; use native resources, `cloud-init`, or
+  config-management with signed artifacts.
+- Secrets: replace literals with `aws_secretsmanager_secret`/`google_secret_manager_secret_version`/
+  `azurerm_key_vault_secret` / Vault data sources; mark sensitive outputs `sensitive = true`.
+- IAM: enumerate explicit actions/resources; replace wildcards and built-in Owner/Editor/Contributor
+  with purpose-scoped custom roles; remove `iam:PassRole` wildcards.
+- Networking: private subnets, no `0.0.0.0/0` ingress, `PubliclyAccessible = false`,
+  `block_public_acls = true`, `allowBlobPublicAccess false`, `supportsHttpsTrafficOnly true`.
+- CloudFormation/CDK: `NoEcho: true` on secret params, `DeletionPolicy: Retain` + encryption on
+  stateful resources, `AuthType` ≠ `NONE` on Lambda URLs, scope resource policies off `Principal:*`.
+
+### Phase 4 — Verification
+- Re-run the gate (`checkIac`) and confirm the finding clears.
+- `terraform validate` + `tflint` + `checkov -d .` / `cfn-lint` / `cfn_nag` / `bicep build` as
+  available. Confirm `terraform plan` shows the resource is private/encrypted.
+- Add a regression fixture under `fixtures/iac-insecure/` only if introducing a new pattern.
+
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `checkIac` regex module is your deterministic floor, not your ceiling. Treat its finding IDs
+as the minimum; then go past what single-line pattern matching can ever see, and APPLY the fix
+(Edit the files) rather than only advising:
+
+- **Cross-resource & data-flow reasoning the regex can't do:** trace a `var`/`local`/module output
+  through to where it lands — a "private" SG that references a `cidr_blocks = var.allowed` whose
+  default is `0.0.0.0/0`; an S3 bucket made public three modules away; a secret read in one file and
+  written to a plaintext output in another. Parse whole HCL/JSON/Bicep trees, not lines.
+- **Effective-permission computation:** expand IAM policy documents (including `NotAction`,
+  condition keys, `iam:PassRole` targets, AssumeRole trust) to the real privilege set and flag
+  privilege-escalation paths (e.g. `iam:CreatePolicyVersion`, `lambda:UpdateFunctionCode` on a
+  privileged role) that no wildcard check catches.
+- **Plan/state analysis:** when safe, run `terraform plan -out` and inspect the JSON plan for
+  resources that will be created public/unencrypted even though the source "looks" fine due to
+  variable indirection; scan committed/remote state for secret values.
+- **Provider/module CVE & freshness:** use WebSearch/WebFetch to check the pinned provider/module
+  version against known advisories and the latest secure release; flag abandoned or
+  typosquatted module sources.
+- **Apply the fix:** Edit the offending file with the corrected block, add the missing companion
+  resource (encryption config, public-access block, `metadata_options`), pin the source, replace
+  the literal with a secret-manager data source, and mark sensitive outputs. Re-run `checkIac`
+  plus `tflint`/`checkov`/`trivy config` as a regression floor, then re-audit semantically. Emit a
+  learning signal per fix. If a fix is genuinely ambiguous (would change intended public access),
+  state the trade-off and the recommended secure default rather than silently skipping it.
+
+## STACK-AWARE PATTERNS
+- **AWS detected:** S3 public-access block, IMDSv2 (`http_tokens = "required"`), KMS CMK, CloudTrail
+  multi-region + log-file validation, GuardDuty/Security Hub enablement.
+- **GCP detected:** no `allUsers`/`allAuthenticatedUsers` bindings, CMEK, VPC-SC, Shielded VMs, OS Login.
+- **Azure detected:** `publicNetworkAccess Disabled`, `minimumTlsVersion 1.2`, Managed Identity over
+  keys, no Owner role assignments, Defender for Cloud.
+- **Kubernetes/Helm in repo:** hand off pod/RBAC specifics to `k8s-container-escaper`; keep IaC scope
+  on the cloud resources that provision the cluster (node IAM, public API endpoint, control-plane logs).

package/skills/iam-privesc-graph-builder/SKILL.md

@@ -35,6 +35,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `infra` + `iac` detection modules (`src/gate/checks/infra.ts`, `src/gate/checks/iac.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a single `iam:PassRole` statement is benign in isolation; it is CRITICAL only when another file grants `ec2:RunInstances` (or `lambda:CreateFunction`, or `cloudformation:CreateStack` to a `cfn-exec-role`) to the same identity — these modules flag each line, but only graph traversal across all policy files reveals the 2-hop path to admin.
+- **Semantic / effective-state analysis:** actually build the IAM privesc graph — follow `sts:AssumeRole` chains across account boundaries, resolve OIDC wildcard `sub` claims (fork/branch overmatch), model dormant `SetDefaultPolicyVersion` flips and cross-cloud WIF (GCP→AWS) edges. Compute effective reachable privilege, not the literal action string.
+- **External corroboration:** WebSearch/WebFetch for Rhino Security Labs' privesc technique list and current AWS/GCP IAM condition-key and managed-policy changes that widen existing grants.
+- **Apply & prove:** write the least-privilege fix inline (scope wildcards, constrain `PassRole` resource ARNs, attach permission boundaries, tighten OIDC `sub`), re-run the `infra`/`iac` checks plus `tfsec`/`checkov` and a `pmapper analysis --privesc` (or `cloudsplaining`) graph pass as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/incident-responder/SKILL.md

@@ -35,6 +35,15 @@ On every finding resolved, emit:
 ```
 This feeds `security.record_outcome` so the routing engine improves over time.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `runtime.ts`, `secrets.ts`, and `ci-pipeline.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum incident surface, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** correlate a `secrets.ts` leaked-credential hit with the `runtime.ts` egress allowlist and the `ci-pipeline.ts` build logs to reconstruct the full kill-chain — a single rotated key in one file is meaningless if the same value is reused in three other services or baked into a cached CI artifact.
+- **Semantic / effective-state analysis:** a kill-switch may exist in `src/lib/kill-switch.ts` yet be read once at startup into a module constant, so the *effective* runtime state is "always on" — prove the toggle actually fires under live traffic, don't trust the literal presence of the guard.
+- **External corroboration:** WebSearch/WebFetch current CISA KEV entries, vendor advisories, and breach-notification SLA changes (GDPR Art.33 72h, EU AI Act Art.73) for the detected stack before declaring containment complete.
+- **Apply & prove:** write the playbook, rotation script, and kill-switch wiring inline, re-run the `src/gate/checks/` suite plus `cosign verify-blob` / Volatility3 memory-dump scans as a regression floor, then re-audit for surviving persistence (OAuth grants, cron, Lambda). Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. fail-closed kill switch causing a planned outage) against the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/injection-specialist/SKILL.md

@@ -22,6 +22,15 @@ Find and fix every injection vulnerability in the codebase.
 Three-layer defense on every route: input validation → sanitization → parameterized query/safe API.
 Cover §13 input validation and §17 file handling completely.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `injection-deep.ts` detection module (`src/gate/checks/injection-deep.ts`) — SQL/NoSQL/command/SSTI/path/JSON — is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** trace a tainted `req.body` field through a Zod parse, into a service-layer helper, and only there into a `prisma.$queryRawUnsafe()` sink three files away — the regex sees a "validated" input at the route and a "constant" query at the sink and misses the join. Confirm second-order paths where input is stored, then later read into a query in an admin context.
+- **Semantic / effective-state analysis:** a tagged-template `$queryRaw` is parameterized, but the same call with a string built by `+` is not; an allowlist that compares against a user-supplied `req.query.table` is still injection. Judge the *effective* parameterization, not the API name.
+- **External corroboration:** WebSearch/WebFetch current CVEs/advisories for the detected ORM/template engine (e.g. Prisma, Handlebars, gRPC metadata injection) and confirm version ranges before scoring.
+- **Apply & prove:** rewrite to parameterized/allowlisted form inline, then re-run `src/gate/checks/injection-deep.ts` plus `semgrep --config p/sql-injection` and a `sqlmap`/Burp polyglot pass as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. strict allowlist breaking a legitimate dynamic-column feature) against the secure default.
+
 ## EXECUTION
 
 1. Enumerate all routes and endpoints

package/skills/ios-security-auditor/SKILL.md

@@ -21,6 +21,15 @@ way developers accidentally undermine it.
 Audit all iOS security controls against OWASP MASVS. Write Swift/ObjC fixes inline.
 Only activated if iOS or cross-platform mobile is detected.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-ios` detection module (`src/gate/checks/mobile-ios.ts`) is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a token written to the Keychain in `AuthStore.swift` with a correct `kSecAttrAccessible` value is still exposed if a different file copies it into `UserDefaults` or a `WKScriptMessageHandler` reply — follow the value across files, not just the `SecItemAdd` call site.
+- **Semantic / effective-state analysis:** an `apple-app-site-association` with `"paths": ["*"]`, or a pinning delegate that validates only the hostname and not the SPKI hash, *looks* present but is effectively bypassable. Judge the real trust decision (e.g. `LAContext.evaluatePolicy` result actually gating the sensitive action) over the literal presence of an API call.
+- **External corroboration:** WebSearch/WebFetch current iOS CVEs and advisories (NSPredicate injection on iOS < 16.3.2, ATS bypasses, Apple Intelligence/Core ML prompt-injection notes) for the targeted SDK and OS range.
+- **Apply & prove:** write the Swift/ObjC fix inline, then re-run `src/gate/checks/mobile-ios.ts` plus a `mobsf` static scan and a `frida`/`objection` runtime check (`ios sslpinning disable`, IMP-integrity probe near biometric eval) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. `ThisDeviceOnly` Keychain breaking multi-device restore) against the secure default.
+
 ## EXECUTION
 
 1. **Data Storage (MASVS-STORAGE):**

package/skills/k8s-container-escaper/SKILL.md

@@ -23,6 +23,28 @@ Find every container and Kubernetes misconfiguration that enables container esca
 cluster compromise, or lateral movement. Write fixed manifests inline.
 Covers §4 (Container and Kubernetes Security) fully.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `checkKubernetes` detection module (`src/gate/checks/k8s.ts`, 70 K8S_* checks — RBAC escalation,
+pod-escape, host namespaces, apiserver/kubelet/etcd flags, admission, supply-chain) is your
+deterministic floor, NOT your ceiling. Treat its finding IDs as the minimum, then go past what
+single-manifest pattern matching can ever see — and APPLY the fix (Edit the manifests), not just
+advise:
+
+- **Cross-manifest & cluster-graph reasoning:** resolve a Pod's ServiceAccount → its (Cluster)RoleBindings
+  → the effective verb/resource set, and decide whether an RCE in that pod reaches `cluster-admin`.
+  Per-manifest regex cannot compute this transitive closure; you must. Trace `valueFrom`/`projected`
+  token audiences across files; correlate a `hostPath` mount with what actually runs on the node.
+- **Effective-privilege & escape-chain synthesis:** combine capabilities + namespaces + seccomp/apparmor
+  + mounts + kernel version into a concrete escape path (the CVE chains and PoC requirement below),
+  rather than flagging each primitive in isolation.
+- **Live-state & freshness:** when a cluster is reachable, confirm with `kubectl`/`kubectl auth can-i`
+  and audit logs (drift the YAML hides); use WebSearch/WebFetch for the CIS Benchmark and CVEs of the
+  detected version.
+- **Apply the fix and prove it:** write the corrected manifest/RBAC/policy, re-run `checkKubernetes`
+  plus `kubeconform`/OPA/Kyverno as a regression floor, then re-audit semantically and satisfy the
+  §ZERO-MISS-MANDATE and §POC-REQUIREMENT. Emit the LEARNING SIGNAL per fix.
+
 ## EXECUTION
 
 1. Scan all Kubernetes manifests, Helm charts, Docker Compose, and Dockerfiles

package/skills/key-management-lifecycle-analyst/SKILL.md

@@ -22,6 +22,15 @@ Find every key management gap: hardcoded keys, unrotated keys, over-scoped keys,
 key hierarchy, and post-quantum readiness. Write secrets manager configurations and rotation
 scripts inline.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `crypto.ts` detection module (`src/gate/checks/crypto.ts`) — keys/TLS/algorithms — is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a `JWT_SECRET` flagged in one `.env` is only the start — trace the same value across `docker-compose.yml`, k8s `Secret` manifests, CI env vars, and git history, since a "rotated" key reused elsewhere defeats rotation entirely. Confirm DEK/KEK separation by following the key material from generation through every use site, not just the declaration.
+- **Semantic / effective-state analysis:** a key in AWS Secrets Manager with a rotation Lambda *configured* but a `kid`-less JWT verifier still trusts old tokens forever; an HSM-backed key whose policy has `Principal: "*"` is effectively public. Judge the effective blast radius and rotation behavior, not the presence of a secrets-manager reference.
+- **External corroboration:** WebSearch/WebFetch current NIST PQC status (FIPS 203/204/205), NIST 800-57, and CVEs for the detected crypto libraries (e.g. Psychic Signatures CVE-2022-21449, XZ CVE-2024-3094) before scoring long-lived keys.
+- **Apply & prove:** write the secrets-manager reference, rotation script, and HKDF hierarchy inline, then re-run `src/gate/checks/crypto.ts` plus `trufflehog --only-verified` and `gitleaks` as a regression floor, then re-audit git history. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. short DEK cache TTL increasing KMS call cost) against the secure default.
+
 ## EXECUTION
 
 1. **Hardcoded key detection (CRITICAL for any match):**

package/skills/kill-switch-engineer/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `ai-governance.ts` and `runtime.ts` detection modules (`src/gate/checks/ai-governance.ts`, `src/gate/checks/runtime.ts`) — AI kill-switch/egress controls — are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a kill switch defined in `src/lib/kill-switch.ts` is incomplete if the corresponding inbound webhook handler in another file keeps processing `payment.succeeded` events, or if an LLM/egress call in a third file has no `assertNotKilled("AI_INFERENCE")` guard. Build the coverage map across write paths, read paths, webhooks, and AI egress — not per file.
+- **Semantic / effective-state analysis:** `const KILLED = process.env.KILL_X === "true"` evaluated at import means the toggle has zero runtime effect; a switch stored as an ArgoCD-managed ConfigMap is silently reverted on the next sync. Prove the switch actually changes behavior live and survives GitOps reconciliation, rather than trusting its literal presence.
+- **External corroboration:** WebSearch/WebFetch current advisories for the flag SDK (LaunchDarkly/Unleash supply-chain/default-on behavior) and regulatory emergency-stop mandates (EU AI Act Art. 65, NIS 2) before scoring.
+- **Apply & prove:** wire the runtime-evaluated guard and fail-closed default inline, then re-run `src/gate/checks/ai-governance.ts` and `src/gate/checks/runtime.ts` plus a `hey`/`wrk` timing-oracle test (killed vs live p50 delta) and an egress-block staging test as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. defaulting to killed on flag-service outage causing a self-inflicted outage) against the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/linddun-privacy-analyst/SKILL.md

@@ -35,6 +35,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `dlp.ts` detection module (`src/gate/checks/dlp.ts`) — PII/privacy — is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a `dlp.ts` hit on an `email` field at the model is only one node — follow that PII through the analytics SDK init, the async worker queue, the BigQuery/Elasticsearch export, and the ML training snapshot, because a right-to-erasure DELETE in the primary DB leaves PII alive in every downstream store the per-file scan never visits. Likewise, no single field triggers a quasi-identifier (ZIP+DOB+gender) re-identification finding; reason over the *combination* across the schema.
+- **Semantic / effective-state analysis:** consent may be "checked" in synchronous code yet read from a stale Redis snapshot by an already-enqueued job, so the *effective* state violates GDPR Art.7(3). Judge whether the worker re-reads live consent, not whether a consent check literally exists.
+- **External corroboration:** WebSearch/WebFetch current LINDDUN guidance, GDPR/CCPA/HIPAA enforcement actions (e.g. Meta Pixel HIPAA breach), and EU AI Act Annex III profiling classifications for the detected processing.
+- **Apply & prove:** implement data minimization, downstream erasure propagation, and server-side tagging inline, then re-run `src/gate/checks/dlp.ts` plus a `playwright` synthetic-PII URL replay (intercept third-party beacons) and a `presidio` PII sweep over logs as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. dropping IP retention weakening fraud detection) against the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/logic-race-fuzzer/SKILL.md

@@ -21,6 +21,15 @@ production under load. You think in terms of interleavings, not happy paths.
 Find race conditions, business logic flaws, and arithmetic vulnerabilities.
 90% fixing — implement distributed locks, atomic operations, and idempotency keys directly.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `business-logic.ts` detection module (`src/gate/checks/business-logic.ts`) — logic/race/TOCTOU — is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a `findUnique` balance read in one handler and an `update` in a helper file are a double-spend only when you model them as a non-atomic read-modify-write spanning the `await` gap between them — the per-line scan sees two innocuous ORM calls. Trace shared state (balance, inventory, quota, idempotency key namespace) across every concurrent path that touches the same resource ID.
+- **Semantic / effective-state analysis:** a `$transaction()` that wraps the read but not the write, or a Redis `INCR`/`EXPIRE` pair not inside a Lua script, is *effectively* unguarded; `quantity * unitPrice` in native JS `number` silently overflows. Judge the real atomicity and arithmetic safety, not the presence of a transaction call.
+- **External corroboration:** WebSearch/WebFetch current advisories (e.g. CVE-2023-23916 async-gap class, e-commerce integer-overflow exploits) and OWASP API6:2023 mass-assignment guidance for the detected ORM/queue.
+- **Apply & prove:** add `SELECT FOR UPDATE`/serializable transactions, atomic Lua, allowlist schemas, and BigInt/Decimal money inline, then re-run `src/gate/checks/business-logic.ts` plus a concurrency hammer (`ab -n 200 -c 50`, `race-the-web`, or `wrk2`) confirming final state matches the summed responses, as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. row locking reducing throughput) against the secure default.
+
 ## EXECUTION
 
 1. Identify all multi-step flows with shared state (balance operations, inventory, quotas)

package/skills/mobile-api-network-attacker/SKILL.md

@@ -22,6 +22,15 @@ from the web API — often with different, weaker controls.
 Find mobile-specific API security issues: hardcoded credentials, missing versioning,
 certificate pinning bypass vectors, and GraphQL/REST endpoint exposure gaps.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-android.ts`, `mobile-ios.ts`, and `api.ts` detection modules (`src/gate/checks/mobile-android.ts`, `src/gate/checks/mobile-ios.ts`, `src/gate/checks/api.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a hardcoded key flagged in `BuildConfig.java` becomes a full account-takeover only when you join it to the `api.ts` endpoint it authenticates and confirm that endpoint lacks device attestation — and a mobile-only route may enforce weaker auth than its web twin, visible only by comparing the two route definitions across files. Trace token storage (Keychain/EncryptedSharedPreferences) through to its transmission header and the server's validation.
+- **Semantic / effective-state analysis:** certificate pinning that compares the full cert (not the SPKI hash) breaks on renewal and is often disabled in practice; OAuth on a custom URI scheme without PKCE S256 is *effectively* interceptable. Judge the real trust decision and whether the `/token` endpoint actually requires `code_verifier`, not the presence of a pinning block.
+- **External corroboration:** WebSearch/WebFetch current advisories for the mobile stack (OAuth URI-scheme hijack CVE-2019-9700 class, Firebase rules misconfig, GraphQL introspection exposure) and the targeted SDK versions.
+- **Apply & prove:** apply the config/code fix inline, then re-run `src/gate/checks/mobile-android.ts`/`mobile-ios.ts`/`api.ts` plus a `mobsf` scan, a `frida`/`objection` pinning-bypass attempt against a `mitmproxy`/Burp MitM, and an introspection probe (`{ __schema { types { name } } }`) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. strict pinning complicating cert rotation) against the secure default.
+
 ## EXECUTION
 
 1. **Hardcoded secrets in mobile code:**

package/skills/mobile-binary-hardener/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-android.ts` and `mobile-ios.ts` detection modules (`src/gate/checks/mobile-android.ts`, `src/gate/checks/mobile-ios.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** `minifyEnabled = true` in `build.gradle` is negated by a `-keep class com.example.**` wildcard in a consumer `proguard-rules.pro` three modules away, and a stripped native binary still leaks symbols if an unstripped `.so`/`dSYM` is bundled in the artifact rather than uploaded separately. Cross-reference build config, ProGuard rules, the actual APK/IPA contents, and the dependency tree — not one file.
+- **Semantic / effective-state analysis:** a ProGuard-obfuscated class is *effectively* recoverable by an LLM-augmented decompiler; an OTA/CodePush update path that fetches over HTTPS but skips bundle signature verification is effectively unsigned dynamic code loading. Judge the real reverse-engineering and tamper resistance, not the literal `minifyEnabled` flag.
+- **External corroboration:** WebSearch/WebFetch current advisories (Frida-gadget-in-SDK reports, malicious AAR/Gradle plugin campaigns like ShadowSDK, ML-DSA code-signing migration, EU CRA SBOM mandate) for the detected toolchain.
+- **Apply & prove:** harden the release config, ProGuard rules, and signature-verification path inline, then re-run `src/gate/checks/mobile-android.ts`/`mobile-ios.ts` plus a `mobsf` static scan, `apktool d` + `apksigner verify --print-certs`, `readelf -S`/`strings` Frida-gadget sweep over every `.so`, and a `frida` attach attempt as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. aggressive obfuscation breaking reflection-based libraries) against the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/mobile-security-specialist/SKILL.md

@@ -24,6 +24,15 @@ SKILL.md §1 OWASP MASVS is the minimum. You go beyond it.
 90% fixing — you write Swift/Kotlin/React Native code fixes directly.
 Every finding maps to MASVS control ID, OWASP MSTG test case, CWE, and CVSSv4.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-ios` + `mobile-android` detection modules (`src/gate/checks/mobile-ios.ts`, `src/gate/checks/mobile-android.ts`) are your deterministic floor, not your ceiling. As LEAD over both platforms, treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** trace a secret read from `Info.plist`/`AndroidManifest.xml` through a `Keychain`/`Keystore` call into a network helper to prove the credential actually leaves the device unprotected; correlate an exported `<activity>`/custom URL scheme with the deep-link handler that trusts its params.
+- **Semantic / effective-state analysis:** decide whether `allowBackup`, `usesCleartextTraffic`, `NSAppTransportSecurity` exceptions, jailbreak/root checks, or certificate pinning are *effectively* enforced at runtime, not merely declared — a pin that is set but never wired into the `URLSession`/`OkHttp` chain is still a bypass.
+- **External corroboration:** WebSearch/WebFetch for current CVEs/advisories and the latest OWASP MASVS/MASTG revision for the iOS/Android SDK versions in the project.
+- **Apply & prove:** write the Swift/Kotlin/RN fix inline, re-run the `mobile-ios`/`mobile-android` checks (plus MobSF static+dynamic on the built IPA/APK) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. pinning vs. cert-rotation ops) with the secure default.
+
 ## ACTIVATION PROTOCOL
 
 1. Call `orchestration.update_agent_status(agentRunId, "mobile-security-specialist", "running")`

package/skills/mobile-webview-auditor/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-android` + `mobile-ios` (WebView surfaces) and `web-nextjs` detection modules (`src/gate/checks/mobile-android.ts`, `src/gate/checks/mobile-ios.ts`, `src/gate/checks/web-nextjs.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** follow a `addJavascriptInterface`/`WKScriptMessageHandler` bridge from its registration into the JS that calls it, then into the native method it invokes, to prove a loaded page can drive native code; correlate a permissive `loadUrl`/`WKWebView` origin with the CSP/`allowsArbitraryLoads` policy served by the Next.js backend.
+- **Semantic / effective-state analysis:** decide whether `setJavaScriptEnabled`, `setAllowFileAccess`, `allowUniversalAccessFromFileURLs`, `shouldOverrideUrlLoading`, and the served CSP combine to *effectively* sandbox untrusted content, not merely look configured — an exposed bridge gated only by a client-side origin string is still XSS-to-native.
+- **External corroboration:** WebSearch/WebFetch for current WebView/WKWebView CVEs and OWASP MASVS-PLATFORM / MASTG WebView test guidance for the SDK versions in use.
+- **Apply & prove:** write the Kotlin/Swift/JS/Next.js fix inline, re-run the `mobile-android`/`mobile-ios`/`web-nextjs` checks (plus MobSF on the build artifact) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/model-extraction-attacker/SKILL.md

@@ -22,6 +22,15 @@ Find API abuse vectors: rate limiting gaps, key scoping issues, token cost ampli
 and model capability leakage. Implement rate limiting and access controls.
 Covers §15 ATLAS AML.T0040 (Inference API Abuse).
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `ai-redteam` + `ai` detection modules (`src/gate/checks/ai-redteam.ts`, `src/gate/checks/ai.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** trace an inference endpoint from its route handler through the auth middleware to the model client to prove an unauthenticated/over-scoped caller can issue unbounded queries; model the full extraction flow — high-volume probing → logit/confidence leakage → surrogate-model training (ATLAS AML.T0040) — across the files that expose logprobs, batch endpoints, or fine-tune APIs.
+- **Semantic / effective-state analysis:** decide whether rate limits, per-key quotas, and cost caps are *effectively* enforced at the model boundary, not merely declared on one route — a global limiter that resets per-instance or excludes the streaming endpoint is no defense against query-budget extraction.
+- **External corroboration:** WebSearch/WebFetch for current MITRE ATLAS case studies, model-extraction advisories, and provider rate-limit/abuse guidance for the inference stack in use.
+- **Apply & prove:** write the rate-limit/key-scoping/access-logging fix inline, re-run the `ai-redteam`/`ai` checks (plus a scripted high-volume query harness as the extraction-cost regression floor), then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (limit aggressiveness vs. legitimate throughput) with the secure default.
+
 ## EXECUTION
 
 1. Identify all LLM API endpoints exposed by the application (both internal and external)

package/skills/multipart-abuse-tester/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `injection-deep` + `api` detection modules (`src/gate/checks/injection-deep.ts`, `src/gate/checks/api.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** follow a multipart field (`multer`/`busboy`/`@fastify/multipart`) from the parser config through the route handler into the filesystem write or downstream parser to prove a path-traversal `filename`, content-type spoof, or unbounded `files`/`parts` count actually reaches a sink.
+- **Semantic / effective-state analysis:** decide whether `limits` (fileSize, files, parts, fieldNameSize), content-type allowlists, and filename sanitization are *effectively* enforced before the bytes are buffered — a size limit set after the stream is already consumed, or an extension check that trusts the client `Content-Type`, is no limit at all.
+- **External corroboration:** WebSearch/WebFetch for current multipart-parser CVEs (multer/busboy/formidable) and OWASP file-upload / unrestricted-upload guidance for the versions pinned in the project.
+- **Apply & prove:** write the parser-hardening fix inline, re-run the `injection-deep`/`api` checks (plus a crafted multipart fuzz via burp intruder / a curl harness sending oversized + traversal + duplicate-boundary payloads) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/oauth-pkce-specialist/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `auth-deep` detection module (`src/gate/checks/auth-deep.ts`, OAuth/PKCE/session) is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** model the full authorization-code flow end-to-end — the authorize request, the `redirect_uri` allowlist, the callback handler, and the token exchange may live in four files; chain them to prove a redirect-URI-confusion / open-redirect / `state`-fixation / PKCE-downgrade attack actually lands a code or token in the attacker's hands.
+- **Semantic / effective-state analysis:** decide whether PKCE (`S256`, not `plain`), `state`/`nonce` validation, exact-match redirect URIs, and short-lived single-use codes are *effectively* enforced — a `code_challenge` that is generated but never verified server-side, or a `state` compared with a non-constant-time check, is no protection.
+- **External corroboration:** WebSearch/WebFetch for the current OAuth 2.0 Security BCP (RFC 9700), RFC 7636 PKCE, and CVEs/advisories for the IdP or auth library (e.g. passport, next-auth, authlib) in the project.
+- **Apply & prove:** write the flow fix inline, re-run the `auth-deep` checks (plus a burp/ZAP replay of the authorize→callback→token sequence with tampered `redirect_uri`/`state`/`code_verifier`) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/parser-exhaustion-tester/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `runtime` (DoS/parser exhaustion) + `injection-deep` detection modules (`src/gate/checks/runtime.ts`, `src/gate/checks/injection-deep.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** trace untrusted input from an HTTP route through a parser (`xml2js`/`fast-xml-parser`/JSON.parse/a regex) into the unbounded operation it drives — prove a billion-laughs/XXE expansion, deeply-nested JSON, decompression bomb, or catastrophic-backtracking regex (ReDoS) actually hangs the event loop or exhausts memory in this code path.
+- **Semantic / effective-state analysis:** decide whether body-size limits, entity-expansion caps, parse depth/timeouts, and `RegExp` complexity guards are *effectively* enforced before the costly parse, not declared on a sibling route — a 1MB limit means nothing if the bomb decompresses to gigabytes after it passes.
+- **External corroboration:** WebSearch/WebFetch for current parser/ReDoS CVEs and OWASP DoS / XML-entity-expansion guidance for the parser versions pinned in the project.
+- **Apply & prove:** write the limit/safe-parser fix inline, re-run the `runtime`/`injection-deep` checks (plus a load/fuzz harness firing nested + oversized + backtracking payloads while watching latency and RSS) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/pentest-infra/SKILL.md

@@ -23,6 +23,15 @@ Build the complete privilege escalation graph for the detected infrastructure.
 Verify all Phase 1 cloud findings are exploitable end-to-end.
 Test network segmentation — can a compromised workload reach things it shouldn't?
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `infra` + `iac` + `k8s` detection modules (`src/gate/checks/infra.ts`, `src/gate/checks/iac.ts`, `src/gate/checks/k8s.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** build the privilege-escalation graph the regex can't — chain a permissive Terraform IAM role (`iac.ts`) to a node instance profile that a `privileged`/`hostPath` pod (`k8s.ts`) can steal credentials from, to a peered VPC/security-group rule (`infra.ts`) that lets the workload reach a datastore it shouldn't.
+- **Semantic / effective-state analysis:** decide whether network policies, IAM boundaries, PSA/`securityContext`, and segmentation are *effectively* enforced at the cluster/cloud control plane, not merely written — a NetworkPolicy with no matching pod selector, or a `Deny` that an explicit `Allow` overrides, leaves the path open.
+- **External corroboration:** WebSearch/WebFetch for current cloud-provider and Kubernetes CVEs, CISA KEV entries, and CIS Benchmark updates for the detected provider and k8s version.
+- **Apply & prove:** write the IaC/manifest hardening inline, re-run the `infra`/`iac`/`k8s` checks (plus scoutsuite/prowler for the cloud account and kube-bench/trivy for the cluster) as a regression floor, then re-audit the escalation graph. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 1. Read Phase 1 `infra-findings.json` as the starting point

package/skills/pentest-social/SKILL.md

@@ -23,6 +23,15 @@ Model realistic social engineering threats and insider risk scenarios based on t
 team, secrets, and access patterns found in this project. Write mitigations that reduce
 the blast radius of human compromise.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `secrets`, `ci-pipeline`, and `auth-deep.ts`) is your access map, not your ceiling — read it to learn what a compromised human actually controls. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** turn a `secrets`/`ci-pipeline` finding into a human-factor kill chain — an engineer whose token unlocks the CI secret store can, via one spear-phish, reach prod deploy creds and the customer datastore; map the blast radius of each named role across every surface the suite touches.
+- **Semantic / effective-state analysis:** decide whether MFA, least-privilege, secret scoping, and offboarding are *effectively* enforced for real humans, not just configured — a break-glass account with a shared password or a PAT that outlives the contractor is the actual exploit.
+- **External corroboration:** WebSearch/WebFetch for OSINT on the project and team (public repos, leaked creds, social profiles) and current phishing/insider-threat TTPs (MITRE ATT&CK Initial Access).
+- **Apply & prove:** write the mitigation inline (tighter CI secret scope, MFA enforcement, allowlist logging), re-run the relevant `src/gate/checks/` modules as a regression floor, then re-audit the blast radius. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 1. **OSINT on the project (authorized pre-engagement reconnaissance):**

package/skills/pentest-team/SKILL.md

@@ -25,6 +25,15 @@ SKILL.md §9 is the minimum. You go beyond it.
 Every finding includes: CVSS v4, CWE, ATT&CK technique ID, step-by-step PoC chain,
 and a "blast radius" statement: what data can be accessed, modified, or destroyed.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `api.ts`, `auth-deep.ts`, `injection-deep.ts`, `infra.ts`, `k8s.ts`) is your deterministic floor, not your ceiling. As team LEAD you read the Phase-1 threat-model.json as the access map and attack every surface; treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** chain an exposure across modules — an IDOR found by `api.ts` + a missing tenant check in `database`-layer code + an over-scoped CI secret from `ci-pipeline` becomes a full account-takeover-to-infra-pivot kill chain no single check sees.
+- **Semantic / effective-state analysis:** weigh each individual finding against the modeled adversary's goal and the runtime's effective trust boundaries; a "low" auth gap is critical when it sits on the path to the crown-jewel data flow.
+- **External corroboration:** WebSearch/WebFetch for current CVEs/advisories, CISA KEV entries, and exploit PoCs matching the project's stack and dependency versions.
+- **Apply & prove:** write the remediation inline at the true root cause, re-run the relevant `src/gate/checks/` modules (plus burp/nuclei/sqlmap/scoutsuite as the surface dictates) as a regression floor, then re-audit the whole chain. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## ACTIVATION PROTOCOL
 
 1. Call `orchestration.update_agent_status(agentRunId, "pentest-team", "running")`

package/skills/pentest-web-api/SKILL.md

@@ -23,6 +23,15 @@ Execute full OWASP Testing Guide methodology against all endpoints found in the
 Every finding is exploited end-to-end with a concrete PoC. No theoretical vulnerabilities —
 only confirmed exploitable issues with real impact.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `api` + `web-nextjs` + `injection-deep` + `auth-deep` + `graphql` detection modules (`src/gate/checks/api.ts`, `src/gate/checks/web-nextjs.ts`, `src/gate/checks/injection-deep.ts`, `src/gate/checks/auth-deep.ts`, `src/gate/checks/graphql.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / multi-step reasoning the regex can't do:** chain an IDOR across endpoints — an object ID leaked by one `api.ts` route + a missing ownership check on a second route + a GraphQL field (`graphql.ts`) that exposes the same record becomes full horizontal/vertical privesc; follow user input through a Next.js server action into the DB query to confirm injection reaches the sink.
+- **Semantic / effective-state analysis:** decide whether authZ is enforced per-object (BOLA/BFLA) and not just per-route, whether GraphQL depth/cost limits and introspection controls are *effectively* on, and whether the `auth-deep` session check actually gates the mutation — middleware that authenticates but never authorizes is the bug.
+- **External corroboration:** WebSearch/WebFetch for current OWASP API Top 10 / Testing Guide updates and CVEs for the framework, GraphQL server, and Next.js version in use.
+- **Apply & prove:** write the authZ/validation fix inline, re-run the `api`/`web-nextjs`/`injection-deep`/`auth-deep`/`graphql` checks (plus burp/sqlmap against the live endpoints and a GraphQL introspection/depth probe) as a regression floor, then re-audit the chain. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 1. Read `threat-model.json` and all Phase 1 appsec findings as the engagement brief

package/skills/privacy-flow-analyst/SKILL.md

@@ -22,6 +22,15 @@ Build the complete data flow inventory for all PII, PHI, PAN, and sensitive data
 Apply LINDDUN model to every identified data flow.
 Identify every third-party service that receives personal data and assess compliance risk.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `dlp` privacy/PII detection module (`src/gate/checks/dlp.ts`) is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** `dlp.ts` flags a `track(email)` call in isolation; you must trace the PII from the React form field, through the API handler, into the Segment/Sentry SDK call, and on to the data-warehouse ETL job — proving the byte crosses a consent boundary the per-line scan never sees.
+- **Semantic / effective-state analysis:** model the indirect re-identification path — confirm whether two "anonymised" aggregate endpoints can be differenced to isolate one user, or whether a presigned-URL prefix scope leaks a sibling tenant's objects, even though every individual line is clean.
+- **External corroboration:** WebSearch/WebFetch for current GDPR/CCPA enforcement actions, Schrems II transfer-mechanism status, IAB TCF v2.2 / US GPP signal specs, and Article 35 DPIA guidance for the data classes in scope.
+- **Apply & prove:** write the fix inline (scrubbing middleware, k-anonymity gate, consent propagation, retention job, `targetOrigin` lockdown), re-run the `dlp.ts` checks (plus `gitleaks`/`trufflehog` on history for PII dumps) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the privacy-by-default option.
+
 ## EXECUTION
 
 1. Scan the codebase for PII/PHI/PAN patterns and data model definitions

package/skills/prompt-injection-specialist/SKILL.md

@@ -23,6 +23,15 @@ Find every prompt injection surface and write working proof-of-concept payloads.
 Implement structural separation, semantic detection, and output validation fixes.
 Covers §15 input security fully including ATLAS AML.T0051.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `ai-redteam`, `ai`, and `agentic-instructions` detection modules (`src/gate/checks/ai-redteam.ts`, `src/gate/checks/ai.ts`, `src/gate/checks/agentic-instructions.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** `ai.ts` flags `systemPrompt + userQuery` on one line; you must follow the message array from the API handler, through the RAG retriever, into the tool-call dispatcher, and confirm whether externally-retrieved content can reach a `messages[].role: "system"` slot or a `send_email` argument — a path no single-file scan reconstructs.
+- **Semantic / effective-state analysis:** model the indirect-injection chain end to end — poisoned RAG chunk → unstripped HTML comment → instruction executed → tool-call exfiltration — and the multi-agent case where a subagent's output is trusted by the orchestrator at higher privilege than the injection point.
+- **External corroboration:** WebSearch/WebFetch for current jailbreaks for the exact model version, MITRE ATLAS AML.T0051 updates, OWASP LLM Top 10, and many-shot/GCG-suffix research from the last 12 months.
+- **Apply & prove:** write the fix inline (structural XML separation, RAG chunk sanitiser, tool-call intent gate, output validator, inter-agent HMAC), re-run the `ai-redteam.ts`/`ai.ts`/`agentic-instructions.ts` checks (plus `semgrep` on prompt-construction sinks) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the structurally-separated default.
+
 ## EXECUTION
 
 1. Read all prompt construction code — find every place where user input or external data

package/skills/quantum-migration-planner/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `crypto` detection module (`src/gate/checks/crypto.ts`) is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** `crypto.ts` flags a literal `RS256` or `generateKeyPair("rsa")`; you must trace the algorithm that is actually resolved at runtime from `process.env.JWT_ALG` or a config map, and follow the key-wrapping chain (RSA KEK wrapping an AES-256 DEK) so the quantum-vulnerable outer layer is not masked by a quantum-safe inner one.
+- **Semantic / effective-state analysis:** inventory ALL classical-crypto usages for PQC migration — including third-party SDK TLS sessions (gRPC, pg, redis) and hybrid-scheme fallback branches that silently drop to classical-only ECDH on error — and classify each by data-confidentiality horizon (harvest-now-decrypt-later) rather than by literal match.
+- **External corroboration:** WebSearch/WebFetch for current NIST FIPS 203/204/205 status, CNSA 2.0 / NSM-10 milestone dates, CMVP validation queue for ML-KEM/ML-DSA, and HSM vendor PQC firmware baselines.
+- **Apply & prove:** write the fix inline (cryptographic-agility interface, `@noble/post-quantum` hybrid X-Wing encapsulation, ML-DSA JWT signing), re-run the `crypto.ts` checks (plus `testssl.sh --curves` against endpoints and `osv-scanner` on PQC dependencies) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the hybrid-by-default option.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance

package/skills/rag-poisoning-specialist/SKILL.md

@@ -30,6 +30,15 @@ and metadata filter injection. Only activated if RAG pipeline is detected in the
 Produce working proof-of-concept demonstrations for every finding. Do not declare any
 class of attack clean without explicit evidence of checking.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `ai-redteam` and `ai` detection modules (`src/gate/checks/ai-redteam.ts`, `src/gate/checks/ai.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** `ai-redteam.ts` flags a `retriever.get_relevant_documents()` call; you must trace whether the tenant filter is sourced from `req.body.tenantId`, whether the metadata-filter JSON is interpolated from user input into the Qdrant `must` clause, and whether the retrieved chunk then reaches an unescaped prompt slot — a multi-file path the per-line scan cannot follow.
+- **Semantic / effective-state analysis:** model the RAG poisoning path end to end — attacker ingests a document with a hidden `<!-- SYSTEM -->` instruction or an adversarial universal embedding → it is retrieved in another tenant's query → it overrides the system prompt or saturates context (many-shot) → safety degrades. Reason about embedding-space tenant collapse, not just literal filter strings.
+- **External corroboration:** WebSearch/WebFetch for current indirect-injection research (Greshake et al.), poisoned-passage attacks (Zhong et al.), vector-store CVEs (e.g., unauthenticated Chroma), and HuggingFace embedding-model supply-chain advisories.
+- **Apply & prove:** write the fix inline (namespace-per-tenant isolation, metadata-filter allowlist, chunk HTML/comment stripping, `revision=` SHA pin on the embedding model, pgvector RLS, `k`-cap), re-run the `ai-redteam.ts`/`ai.ts` checks (plus `semgrep` on filter-construction sinks and `osv-scanner` on the embedding-model deps) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the separate-collection-per-tenant default.
+
 ## EXECUTION
 
 1. Identify the vector store in use (pgvector, Pinecone, Weaviate, Chroma, Qdrant, Milvus,