torusguard 0.9.2

package/.torusguard/skills/torusguard/references/frontend-no-db.md

@@ -0,0 +1,53 @@
+# Frontend Database Protection
+
+## When to load
+
+Load during `/TorusGuard check database`, full-stack audits, or when frontend code connects to data stores.
+
+## Linked rules
+
+- [TG-DB-001](../../rules/TG-DB-001-frontend-database-query.md) — Database Query in Frontend (High)
+- [TG-DB-002](../../rules/TG-DB-002-privileged-database-credential.md) — Privileged Credential in Browser (Critical)
+- [TG-DB-003](../../rules/TG-DB-003-frontend-admin-sdk.md) — Frontend Admin SDK (Critical)
+
+## Hard bans
+
+- No SQL in frontend directories (`src/`, `app/`, `pages/`, `components/`, `client/`, `public/`)
+- No imports of `pg`, `mysql`, `mongoose`, `@prisma/client`, Sequelize, TypeORM, Drizzle server client
+- No Supabase service-role key or Firebase Admin SDK in browser code
+- No trust in client-provided user ID or role without server verification
+
+## Safe architecture
+
+```
+Browser → HTTPS API → AuthZ → Parameterized query/ORM → Database
+```
+
+## Supabase
+
+- Browser: anon key + **RLS enabled** on all exposed tables
+- Server: service-role key only for admin tasks
+- **Manual review required:** RLS policies for every table
+
+## Firebase
+
+- Browser: client SDK + Security Rules
+- Server: Admin SDK only
+- **Manual review required:** Firestore/Storage rules
+
+## Audit checklist
+
+- [ ] No DB queries or drivers in client code (TG-DB-001, TG-DB-003)
+- [ ] No connection strings or service-role keys in bundle (TG-DB-002)
+- [ ] All mutations authorized server-side
+- [ ] Supabase RLS / Firebase rules reviewed and tested
+
+## Framework guides
+
+- [Supabase](../../guides/supabase-security.md)
+- [Firebase](../../guides/firebase-security.md)
+- [React/Vite](../../guides/react-vite-security.md)
+
+## Related rules
+
+TG-SEC-002, TG-AUTH-002, TG-AUTH-003

package/.torusguard/skills/torusguard/references/graphql-security.md

@@ -0,0 +1,12 @@
+# GraphQL Security
+
+- Resolver-level authentication and authorization.
+- Query depth limits.
+- Query complexity limits.
+- Pagination and page-size caps.
+- Batching controls.
+- Introspection policy.
+- Aliases and recursive relationships.
+- Error sanitization.
+- Sensitive field exposure.
+- Data-loader and N+1 concerns as resource risks.

package/.torusguard/skills/torusguard/references/input-and-injection.md

@@ -0,0 +1,51 @@
+# Input Validation and Injection Prevention
+
+## When to load
+
+Load during `/TorusGuard check input`, API route reviews, or upload/webhook implementation.
+
+## Linked rules
+
+- [TG-INPUT-001](../../rules/TG-INPUT-001-missing-server-validation.md) — Missing Server Validation (High)
+- [TG-INPUT-002](../../rules/TG-INPUT-002-raw-sql-concatenation.md) — Raw SQL Concatenation (Critical)
+- [TG-INPUT-003](../../rules/TG-INPUT-003-unsafe-html-or-code-execution.md) — Unsafe HTML/Code Execution (High)
+- [TG-INPUT-004](../../rules/TG-INPUT-004-unrestricted-file-upload.md) — Unrestricted File Upload (High)
+
+## Hard bans
+
+- No raw SQL concatenation with request input
+- No `eval`, `Function()`, or shell execution with untrusted input
+- No unsanitized user HTML via `dangerouslySetInnerHTML`
+- No file upload without size, type, and authorization checks
+- No trust in `req.body.role`, `isAdmin`, or `userId`
+
+## Safe defaults
+
+- Validate all external input on the server: body, query, params, headers, cookies, webhooks, uploads
+- Treat third-party API and **LLM output** as untrusted
+- Use Zod, Joi, Yup, or Ajv schemas at route entry
+- Parameterized queries or safe ORM APIs only
+- Redirect URLs must use allowlists
+- Uploads: MIME allowlist, size cap, server-generated filenames, storage outside web root
+
+## Audit checklist
+
+- [ ] Every API route validates input (TG-INPUT-001)
+- [ ] No concatenated SQL (TG-INPUT-002)
+- [ ] No unsafe HTML/code execution (TG-INPUT-003)
+- [ ] Upload routes restricted (TG-INPUT-004)
+
+## Framework notes
+
+- **Express** — validation middleware before handlers
+- **Next.js** — validate in route handlers and Server Actions
+- **Supabase** — Edge Functions validate before privileged ops
+
+## Manual review
+
+- Business-logic validation beyond schema (e.g., cross-field rules)
+- NoSQL injection patterns in MongoDB query builders
+
+## Related rules
+
+TG-AUTH-002, TG-RATE-003, TG-PLATFORM-004

package/.torusguard/skills/torusguard/references/mass-assignment-and-property-auth.md

@@ -0,0 +1,22 @@
+# Mass Assignment and Property Authorization
+
+- Explicit writable-field allowlists.
+- DTOs or request schemas.
+- Separate user-editable and server-managed fields.
+- Server-side assignment for role, balance, status, ownership, and verification.
+- Authorization checks for sensitive individual properties.
+- Tests that submit unexpected fields.
+
+## Unsafe
+```javascript
+await User.update(req.body, { where: { id: req.user.id } });
+```
+
+## Safe
+```javascript
+const input = updateProfileSchema.parse(req.body);
+await User.update(
+  { displayName: input.displayName, avatarUrl: input.avatarUrl },
+  { where: { id: req.user.id } }
+);
+```

package/.torusguard/skills/torusguard/references/platform-hardening.md

@@ -0,0 +1,56 @@
+# Platform and HTTP Hardening
+
+## When to load
+
+Load during `/TorusGuard check platform`, deployment prep, or `/TorusGuard verify`.
+
+## Linked rules
+
+- [TG-PLATFORM-001](../../rules/TG-PLATFORM-001-wildcard-cors-with-credentials.md) — Wildcard CORS + Credentials (High)
+- [TG-PLATFORM-002](../../rules/TG-PLATFORM-002-missing-security-headers.md) — Missing Security Headers (Medium)
+- [TG-PLATFORM-003](../../rules/TG-PLATFORM-003-production-stack-trace-exposure.md) — Stack Trace Exposure (Medium)
+- [TG-PLATFORM-004](../../rules/TG-PLATFORM-004-missing-request-size-limits.md) — Missing Request Size Limits (Medium)
+
+## Hard bans
+
+- No `Access-Control-Allow-Origin: *` with credentials
+- No production stack traces or raw DB errors to clients
+- No debug mode in production
+- No missing body limits on public JSON endpoints
+- No executable uploads in public web directories
+
+## Safe defaults
+
+- CORS explicit allowlist
+- Helmet or equivalent: CSP, `X-Content-Type-Options`, HSTS (production), `Referrer-Policy`, clickjacking protection
+- Generic user-facing errors; detailed logs server-side with request ID
+- HTTPS enforced in production
+- `express.json({ limit: '100kb' })` or appropriate caps
+- Dependency audit before deploy
+
+## Audit checklist
+
+- [ ] CORS allowlist (TG-PLATFORM-001)
+- [ ] Security headers configured (TG-PLATFORM-002)
+- [ ] Errors sanitized (TG-PLATFORM-003)
+- [ ] Request/upload limits set (TG-PLATFORM-004)
+
+## Framework notes
+
+- **Express** — Helmet + central error handler
+- **Next.js** — headers in `next.config` or middleware
+- **Reverse proxy** — TLS termination, HSTS, rate limits
+
+## Manual review
+
+- CSP compatibility with actual script/style sources
+- Infrastructure firewall and WAF rules
+- Backup and monitoring configuration
+
+## Related rules
+
+TG-RATE-003, TG-SEC-004, TG-CLIENT-001
+
+## Framework guide
+
+[Express Security](../../guides/express-security.md)

package/.torusguard/skills/torusguard/references/python-dependencies.md

@@ -0,0 +1,16 @@
+# TorusGuard Skill Reference: Python Dependencies and Supply Chain
+
+> **Loaded When:** Python dependency manifests (`requirements.txt`, `pyproject.toml`, `Pipfile`, `poetry.lock`, `uv.lock`) or `.github/workflows/*.yml` are detected.
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Lockfile Integrity
+* `TG-SUPPLY-001`: Verify that deterministic lockfiles exist alongside manifests and are not excluded in `.gitignore`.
+
+### 2. Known CVE Vulnerability Auditing
+* `TG-SUPPLY-002`: Check for vulnerable dependencies using `pip-audit`. Avoid recommending blind major-version upgrades that introduce breaking changes without tests.
+
+### 3. CI/CD Workflow Hardening
+* `TG-SUPPLY-004`: Inspect `.github/workflows/*.yml` for unpinned 3rd-party actions and overbroad default permissions.

package/.torusguard/skills/torusguard/references/python-security-overview.md

@@ -0,0 +1,12 @@
+# TorusGuard Skill Reference: Python Security Overview
+
+> **Loaded When:** Any Python project is detected (`requirements.txt`, `pyproject.toml`, `Pipfile`, `.py` source files).
+
+---
+
+## 🐍 Python Platform Security Principles
+
+1. **Explicit Boundaries Over Dynamic Magic:** Avoid unpacking arbitrary user dictionaries directly into database ORM models or data structures (`**req.dict()`, `**request.json`).
+2. **Server-Side Authorization First:** Route decorators (`@login_required`) verify identity, but database queries must verify resource ownership (`user_id == current_user.id`).
+3. **Outbound Request Bounding (SSRF):** Always validate scheme, resolve DNS, and block private CIDR blocks before calling `requests.get()` or `httpx.get()`.
+4. **Deterministic Environments:** Always maintain virtual environment isolation and commit cryptographically verifiable lockfiles (`poetry.lock`, `uv.lock`, `requirements.lock`).

package/.torusguard/skills/torusguard/references/rate-limit-and-abuse.md

@@ -0,0 +1,57 @@
+# Rate Limiting and Abuse Prevention
+
+## When to load
+
+Load during `/TorusGuard check rate-limit`, auth endpoint reviews, or public API design.
+
+## Linked rules
+
+- [TG-RATE-001](../../rules/TG-RATE-001-unlimited-auth-endpoint.md) — Unlimited Auth Endpoint (High)
+- [TG-RATE-002](../../rules/TG-RATE-002-unlimited-public-write-endpoint.md) — Unlimited Public Write (Medium)
+- [TG-RATE-003](../../rules/TG-RATE-003-unbounded-resource-consumption.md) — Unbounded Resource Use (High)
+
+## Hard bans
+
+- Never rely only on frontend throttling
+- Never leave login, reset, OTP, or contact endpoints unlimited in production
+- Never use in-memory-only rate limits as sole protection in distributed production
+
+## Configurable default limits
+
+| Endpoint | Suggested starting point |
+|----------|-------------------------|
+| Login | 5 / IP / 15 min + account backoff |
+| Password reset | 3 / email / hour |
+| OTP | 3 / identifier / 15 min |
+| Contact/feedback | 5 / IP / hour |
+| Public API | 60 / IP / minute |
+| Search | 30 / IP / minute |
+| Upload | 10 / IP / hour + size limits |
+| AI/LLM | Per-user and per-IP cost limits |
+
+Adjust for your traffic profile — these are defaults, not universal values.
+
+## Safe defaults
+
+- Per-IP limits on public endpoints
+- Per-account limits on auth flows
+- HTTP 429 with `Retry-After` when practical
+- Body, upload, and pagination caps (TG-RATE-003)
+- Timeouts and concurrency limits on expensive endpoints
+- Shared store (Redis) for multi-instance deployments
+
+## Audit checklist
+
+- [ ] Auth endpoints rate-limited (TG-RATE-001)
+- [ ] Public write/AI endpoints protected (TG-RATE-002)
+- [ ] Body/upload/pagination limits set (TG-RATE-003)
+
+## Manual review
+
+- Webhook endpoints (signature + IP limits)
+- GraphQL complexity/depth limits
+- Spend alerts for metered third-party APIs
+
+## Related rules
+
+TG-AUTH-005, TG-PLATFORM-004, TG-INPUT-004

package/.torusguard/skills/torusguard/references/secrets-and-config.md

@@ -0,0 +1,64 @@
+# Secrets and Environment Configuration
+
+## When to load
+
+Load during `/TorusGuard check secrets`, secret-related audits, or before adding environment variables, CI config, or deployment secrets.
+
+## Linked rules
+
+- [TG-SEC-001](../../rules/TG-SEC-001-hardcoded-secrets.md) — Hardcoded Secret (Critical)
+- [TG-SEC-002](../../rules/TG-SEC-002-public-environment-secrets.md) — Public Environment Secret (Critical)
+- [TG-SEC-003](../../rules/TG-SEC-003-tracked-env-file.md) — Tracked Environment File (High)
+- [TG-SEC-004](../../rules/TG-SEC-004-sensitive-logging.md) — Sensitive Data Logging (Medium)
+
+## Hard bans
+
+- Never hardcode database URLs, JWT secrets, passwords, or API keys in source
+- Never expose service-role or admin credentials to the browser
+- Never put secrets in `VITE_*`, `NEXT_PUBLIC_*`, or `REACT_APP_*` variables
+- Never log passwords, tokens, session IDs, API keys, or full authorization headers
+- Never commit `.env`, credentials JSON, or private key files
+
+## Frontend env prefixes are public
+
+| Prefix | Reaches browser? |
+|--------|------------------|
+| `VITE_` | Yes |
+| `NEXT_PUBLIC_` | Yes |
+| `REACT_APP_` | Yes |
+| (no prefix) | Server only |
+
+Only intentionally public configuration may use client prefixes.
+
+## Safe defaults
+
+1. Server-only env for all secrets
+2. `.env` in `.gitignore`
+3. `.env.example` with placeholder values only
+4. Rotate/revoke any discovered leaked secret immediately
+5. Separate dev/test/production secret stores where applicable
+
+## Audit checklist
+
+- [ ] No real secrets in tracked source (TG-SEC-001)
+- [ ] No sensitive values in public env vars (TG-SEC-002)
+- [ ] `.env` not tracked by Git (TG-SEC-003)
+- [ ] Logs redact auth material (TG-SEC-004)
+- [ ] `.env.example` exists with safe placeholders
+
+## Framework notes
+
+- **Vite/CRA/Next public vars** — treat as published in the client bundle
+- **Supabase** — anon key in browser OK; service-role server-only
+- **Firebase** — client config public; Admin SDK credentials server-only
+- **CI/CD** — use platform secret stores, not plaintext in workflow files
+
+## Manual review
+
+- Verify secret rotation after any exposure
+- Review CI logs for accidental secret echo
+- Confirm production secrets differ from development
+
+## Related rules
+
+TG-DB-002, TG-DB-003, TG-CLIENT-002

package/.torusguard/skills/torusguard/references/sqlalchemy-security.md

@@ -0,0 +1,16 @@
+# TorusGuard Skill Reference: SQLAlchemy Security
+
+> **Loaded When:** Project uses `sqlalchemy` dependencies or imports.
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. SQL Injection in Raw Query Clauses
+* `TG-INPUT-003`: Search for `text(f"...")`, `text("..." + ...)`, or `.format()` inside `text()` constructs. Ensure parameter mapping `text("... WHERE col = :val")` is used.
+
+### 2. Tenant Scoping & Object Ownership
+* `TG-AUTH-007`: Verify queries on tenant-isolated tables include tenant/user ID predicates in `.filter()` or `.filter_by()`.
+
+### 3. Mass Assignment via Bulk Updates
+* `TG-AUTH-006`: Inspect `.update(dict)` calls to ensure input dictionaries are filtered against permitted field allowlists.

package/.torusguard/skills/torusguard/references/ssrf-and-outbound-requests.md

@@ -0,0 +1,46 @@
+# SSRF and Outbound Requests
+
+## When the reference applies
+Applies to any endpoint that fetches a URL.
+
+## User-controlled URL detection
+Always check if the URL is user-controlled.
+
+## URL scheme validation
+Only allow expected schemes.
+
+## Hostname and IP validation
+Validate hostnames carefully.
+
+## Private-network blocking
+Block internal IP addresses.
+
+## Cloud metadata protection
+Block 169.254.169.254 and similar.
+
+## Redirect handling
+Disable redirects or validate them.
+
+## DNS rebinding considerations
+Check DNS at resolution time.
+
+## Timeout and response-size limits
+Enforce timeouts and max response sizes.
+
+## Network isolation
+Run fetches from isolated networks if possible.
+
+## Safe logging
+Avoid logging raw URLs with credentials.
+
+## Manual-review checklist
+- [ ] Is the outbound URL user-controlled?
+- [ ] Is HTTPS required?
+- [ ] Is the hostname allowlisted?
+- [ ] Are loopback and private IPs blocked?
+- [ ] Are cloud metadata endpoints blocked?
+- [ ] Are redirects disabled or revalidated?
+- [ ] Is DNS resolution checked safely?
+- [ ] Is there a timeout?
+- [ ] Is response size limited?
+- [ ] Is the server isolated from sensitive networks?

package/.torusguard/skills/torusguard/references/webhook-security.md

@@ -0,0 +1,15 @@
+# Webhook Security
+
+- Signature verification over the raw request body.
+- Timestamp tolerance.
+- Replay protection.
+- Event-type allowlisting.
+- Payload schema validation.
+- Idempotency keys or event IDs.
+- Safe retry behavior.
+- Rate and size limits.
+- Generic response errors.
+- No trust in event fields before signature verification.
+
+## Workflow
+Receive raw body → Verify signature → Verify timestamp → Check event ID/idempotency → Validate event schema → Authorize event source/tenant → Process within transaction → Return safe response

package/.torusguard/skills/torusguard/references/websocket-security.md

@@ -0,0 +1,12 @@
+# WebSocket Security
+
+- Authentication during handshake.
+- Re-authentication or token expiry.
+- Origin validation.
+- Per-room and per-channel authorization.
+- Message schema validation.
+- Message-size limits.
+- Connection and subscription limits.
+- Tenant isolation.
+- Disconnect behavior.
+- Logging and abuse detection.

package/.torusguard/skills/torusguard-apply/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: torusguard-apply
+description: Apply governed remediation patches to disk with pre-apply rollback snapshots and Human Gate validation.
+version: 0.9.2
+workflow: .torusguard/workflows/apply.md
+tools: Read, Grep, Glob, Bash, Edit, Write
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/diff_guard.py
+---
+
+# TorusGuard Apply — Governed Patch Application & Rollback Snapshot
+
+## Objective
+Safely apply approved remediation bundles to disk source files, capturing a byte-for-byte pre-apply backup snapshot and asserting syntax validity post-patch.
+
+---
+
+## Execution Steps
+
+1. **Load Bundle:** Read `patch.diff` and metadata from `.torusguard/runs/<run_id>/remediation/<finding_id>/`.
+2. **Pre-Apply Snapshot:** Save exact backup to `.torusguard/runs/<run_id>/pre_apply/<filename>.bak`.
+3. **Obtain Human Gate:** Confirm user approval for proposed diff.
+4. **Apply Patch:** Execute surgical modification using `replace_file_content` or `patch`.
+5. **Assert Integrity:** Verify modified file compiles cleanly without syntax errors.
+6. **Record Ledger:** Log timestamp, file path, and post-patch SHA-256 in `apply-log.json`.
+
+---
+
+## Governance & Safety Rules
+- Hard limit: additions $\le 35$, deletions $\le 25$ lines.
+- Always create a rollback snapshot before modifying disk code.
+- If compile or syntax error occurs, instantly restore from `.bak`.
+- Require explicit operator confirmation before writing changes.
+
+---
+
+## Output Format
+```markdown
+🚀 [TorusGuard] Patch Applied Successfully
+- Finding Target: <Finding ID> | File: <Path>
+- Churn: +<Additions> / -<Deletions>
+- Rollback Backup: `.torusguard/runs/<run_id>/pre_apply/<file>.bak`
+- Compile Check: PASSED
+Next: Run `/torusguard recheck` to verify vulnerability is closed.
+```

package/.torusguard/skills/torusguard-audit/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: torusguard-audit
+description: Static security AST scanning, stable fingerprinting, root-cause clustering, and 0–100 confidence scoring.
+version: 0.9.2
+workflow: .torusguard/workflows/audit.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/finding_scorer.py
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Audit — Static Code Analysis & Finding Clustering
+
+## Objective
+Execute static analysis across ASTs, generate line-shift invariant fingerprints, group findings into root causes, compute 0–100 confidence scores, and persist findings to `.torusguard/runs/`.
+
+---
+
+## Execution Steps
+
+1. **Setup Run Directory:** Initialize `.torusguard/runs/run-YYYYMMDD-HHMMSS-audit/` via `run_manager.py`.
+2. **Load Active Rules:** Load rules from `.torusguard/rules/active/` and thresholds from `torusguard.json`.
+3. **AST Scan Sinks:** Match files against active rules:
+   - `TG-SEC-*`: Leaked API keys, secrets.
+   - `TG-INPUT-*`: Unescaped SQL or unvalidated payloads.
+   - `TG-DB-*`: Unscoped queries omitting tenant filters (`Model.get(id=id)`).
+   - `TG-AUTH-*`: Missing `HttpOnly`/`Secure` flags; open CORS.
+   - `TG-CLIENT-*`: Admin credentials in client bundles.
+4. **Stable Fingerprinting:** Compute SHA-256 hash of normalized 3 surrounding AST lines.
+5. **Root-Cause Clustering:** Group findings by root cause (`cluster-tenant-isolation`, `cluster-raw-sql-sink`).
+6. **Confidence Scoring:** Calculate 0–100 score across 5-factor rubric via `finding_scorer.py`.
+7. **Write Run Artifacts:** Persist `findings.md`, `findings.json`, and `summary.md`.
+
+---
+
+## Confidence Scoring Rubric
+- **1. Evidence (35):** AST flow (35), regex match (20), indirect (10).
+- **2. Reproduction (25):** Deterministic test (25), simulated (15), hypothesis (0).
+- **3. Corroboration (15):** >=3 files (15), 2 files (10), single (5).
+- **4. Environment (15):** Explicit route (15), minor ambiguity (8), unknown (0).
+- **5. Review Status (10):** Human verified (10), agent consensus (5), auto (0).
+- **Bands:** 90–100 (`Confirmed`), 70–89 (`High`), 50–69 (`Medium`), <50 (`Review`).
+
+---
+
+## Finding Card Format
+```markdown
+### [TG-DB-004] Missing Tenant Scoping in /invoices/
+- **Severity**: High | **Confidence**: 90/100 (Confirmed)
+- **File**: `views.py:42` | **Cluster**: `cluster-tenant-isolation`
+- **Evidence**: Unscoped query leaks records.
+- **Remediation**: Scope by `tenant=request.user.tenant`.
+```
+
+---
+
+## Safety Constraints
+- Read-only execution; zero code modifications.
+- Exclude build folders (`node_modules/`, `.venv/`, `dist/`).
+- Redact secrets before saving to `findings.md`.
+
+---
+
+## Output Format
+```markdown
+🛡️ [TorusGuard] Static Code Audit Completed
+- Run ID: run-YYYYMMDD-HHMMSS-audit | Files: <Count> | Findings: <Count>
+- Clusters: <Count> identified | Posture: ACTION REQUIRED
+Next: Run `/torusguard harden` to formulate surgical fixes.
+```

package/.torusguard/skills/torusguard-authorize/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: torusguard-authorize
+description: Register and validate runtime target authorization boundaries — scope boundaries, ownership proofs, TTL expiration, and Safety Gate enforcement.
+version: 0.9.2
+workflow: .torusguard/workflows/authorize.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/safety_gate.py
+---
+
+# TorusGuard Authorize — Legal Scope & Safety Gate Registration
+
+## Objective
+Define and validate legal runtime authorization boundaries, verify target ownership, enforce maximum rate limits, and persist a cryptographically auditable `.torusguard/config/scope.json`.
+
+---
+
+## Execution Steps
+
+1. **Capture Scope Parameters:** Collect target host URL, allowed path prefixes, forbidden prefixes, and session TTL.
+2. **Validate Environment:** Assert target is local (`localhost`, `127.0.0.1`) or staging (`*.staging.*`). Block production targets without explicit override.
+3. **Verify Host Ownership:** Confirm ownership token or local process socket binding.
+4. **Invoke Safety Gate:**
+   ```bash
+   python .torusguard/scripts/safety_gate.py check --url <target_url>
+   ```
+5. **Write Scope Record:** Persist authorized targets, rate limits, and expiration timestamp into `.torusguard/config/scope.json`.
+6. **Validate Schema:** Confirm `scope.json` adheres to `auth-boundary.schema.json`.
+
+---
+
+## Safety Constraints
+- Never authorize wildcard hosts (`*`) or third-party domains.
+- State-changing destructive actions (`DELETE`, bulk drops) are disabled by default.
+- Set strict TTL (default 4 hours, maximum 24 hours).
+
+---
+
+## Output Format
+```markdown
+🔒 [TorusGuard] Target Scope Authorized
+- Target Host: <Host URL> | Environment: <Local / Staging>
+- Allowed Paths: <Prefixes> | Rate Limit: <Max Req/sec>
+- Expiration TTL: <Timestamp>
+- Scope File: `.torusguard/config/scope.json`
+Next: Run `/torusguard web-validate` to begin safe runtime probing.
+```

package/.torusguard/skills/torusguard-exploit-check/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: torusguard-exploit-check
+description: Safe, non-destructive confirmation of exploitability using inert canary tokens and sentinels.
+version: 0.9.2
+workflow: .torusguard/workflows/exploit-check.md
+tools: Read, Grep, Glob, Bash, Write
+scripts-binding:
+  - .torusguard/scripts/safety_gate.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Exploit Check — Bounded Exploitability Confirmation
+
+## Objective
+Confirm whether candidate findings are practically exploitable using safe, single-step sentinel canaries without data loss or weaponized execution.
+
+---
+
+## Authorization Gate Check
+Before dispatching any exploitability probe:
+1. Verify target route is explicitly authorized in `.torusguard/config/scope.json`.
+2. Verify authorization TTL has not expired.
+3. Assert probe passes `.torusguard/scripts/safety_gate.py`.
+
+---
+
+## Bounded Probe Strategies
+- **SQLi:** Mathematical identity canary (`' OR 1=1--`) asserting differential response without altering data.
+- **XSS:** Inert HTML marker tag (`<tg-canary-tag>`) checking unescaped reflection in DOM.
+- **IDOR:** Cross-tenant GET using secondary tenant session; assert 403 vs leak.
+- **Auth:** Omit auth header on protected route; assert 401.
+
+---
+
+## Execution Steps
+
+1. **Verify Scope:** Read `scope.json`; assert authorized endpoint.
+2. **Select Canary:** Choose matching non-destructive probe strategy.
+3. **Dispatch Probe:** Send request with header `X-TorusGuard-AuthID`.
+4. **Classify Status:** Transition finding into one of 5 canonical outcomes:
+   - `Confirmed`: Canary reflected or secondary tenant data leaked.
+   - `Not Reproducible`: Endpoint responded with 401/403 or sanitized input.
+   - `Needs Review`: Ambiguous status code or incomplete response.
+   - `Blocked by Controls`: WAF or rate limiter stopped probe.
+   - `Out of Scope`: Target endpoint is not authorized.
+5. **Record Evidence:** Save trace in `.torusguard/runs/<run_id>/exploit-evidence.md`.
+
+---
+
+## Safety Constraints
+- Zero destructive payloads (`DROP`, `DELETE`, `UPDATE`).
+- No denial-of-service or continuous fuzzing loops.
+- Redact tokens before recording traces.
+
+---
+
+## Output Format
+```markdown
+🎯 [TorusGuard] Exploitability Confirmation
+- Finding ID: <Finding ID> | Target: <Route>
+- Status: <Confirmed / Not Reproducible / Blocked>
+- Evidence: <Response snippet or status code>
+Next: Run `/torusguard harden` to formulate surgical remediation bundle.
+```