UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit the attack surface a GraphQL API exposes that a plain endpoint does not: schema introspection left open, unbounded query depth and recursion, aliasing and field duplication that multiply cost, query batching that defeats rate limits and enables brute force, field-level authorization that a resolver skips even…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit a gRPC service for a method a caller can reach without the authorization the service assumes an interceptor enforces, after the interceptor coverage and the channel credentials are resolved. Covers authorization installed on the unary interceptor while the streaming chain omits it, a per-method authorization gap…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Find the missing-check bug by comparing sibling functions that reach the same sink - one validates its input, its peer does not. Use on an authorized source target to surface broken access control, missing bounds checks, and skipped sanitization that linear file-reading hides; when you suspect one handler in a family…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit the host paths and devices a workload mounts for reach across the container boundary onto the node: a writable hostPath into a sensitive node directory, a mount of the host root or a system path that exposes other pods' data and node configuration, a raw device or block volume that grants low-level host access…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit HTTP/2 and gRPC edges for framing and multiplexing trust that breaks when a stream is translated or reused: an h2c or HTTP/2-to-HTTP/1.1 downgrade that reintroduces request smuggling, pseudo-header and header handling that lets a stream forge its path or authority, multiplexed streams on one connection whose…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit the supply chain of infrastructure-as-code modules and providers for trust that runs at plan or apply time: a module sourced from an unpinned or attacker-influenceable location, a provider or plugin pulled from a registry without integrity pinning, a module that executes local commands or fetches remote content…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit existing infrastructure-as-code definitions (Terraform, OpenTofu, CloudFormation, Bicep, Pulumi) for resource state that would provision an insecure resource, after variables, modules, and account defaults are resolved. Covers storage exposed to the public, a security-group or firewall rule open to the whole…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit the init and sidecar containers a workload runs, including ones injected by a mutating admission webhook, for trust the main container never granted: an injected sidecar that runs with broader privileges, host access, or credentials than the workload, an init container that fetches and executes remote content…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit how a service verifies JSON Web Tokens for the classic verification bypasses: an algorithm-confusion attack where a token switches the signing algorithm so a public key is used as a symmetric secret or the algorithm is set to none, a key selected from an attacker-controllable header (a key id, a JWKS URL, or an…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit code that verifies a JSON Web Token for a signature or claims check that trusts token-supplied parameters, so an attacker can forge a token the server accepts, after the algorithm pinning and the key source are resolved. Covers an algorithm taken from the token header rather than pinned server-side, an…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit key-management policies and envelope-encryption design for a decrypt path broader than intended: a key policy or grant that admits a principal who should never decrypt, a wildcard key resource in an identity policy that covers unrelated keys, an encryption context that is not enforced so a data key decrypts…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit Kubernetes manifests for a subject granted more than it needs or a workload that can escape its container, after the binding graph and admission policy are resolved. Covers a RoleBinding or ClusterRoleBinding to cluster-admin or a wildcard-verb role, a pod running privileged or with host namespaces or a…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Red-team the tool layer of an AI agent: the tool definitions, metadata, and outputs that a model reads and trusts. Covers tool poisoning (instructions hidden in a tool's description), tool shadowing and name collisions, rug-pulls (definitions that change after approval), line jumping (metadata acting before any call)…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit message-broker topic and queue authorization for reach a client should not have: a wildcard subscription that receives another tenant's messages, a publish permission broad enough to inject into a control or command topic, a shared broker where topic naming is the only separation between tenants, and a client…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit the machine-learning models you load as untrusted code, not just data. Covers deserialization RCE from unsafe checkpoint formats (a model file that runs code on load), poisoned or backdoored weights, tampered or trojaned models pulled from a public hub, name and version confusion for model artifacts, and skipped…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit how a mobile app handles a deep link, app link, or custom-scheme URL, so an attacker-supplied URL cannot drive a sensitive action or reach a trusted WebView context. Covers a custom scheme any app can register and hijack, an app link whose domain association is unverified so the link is not exclusively the…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit a Move smart contract (Aptos or Sui) for a public entry function or a passed object or resource that acts without verifying signer authority, ownership, or capability possession, after the function visibility and the ability set are resolved. Covers a public entry function with no signer-authority check, an…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit whether every data operation is scoped to the caller's tenant, so a request in one tenant cannot read or write another's data. Covers a query or object lookup with the object identifier but no tenant predicate, a tenant taken from client-controlled input at the operation rather than the authenticated session…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit a Kubernetes namespace that is treated as a tenant isolation boundary for the isolation it does not actually provide: cluster-scoped resources and nodes shared across namespaces, RBAC that grants a tenant reach beyond its own namespace, missing network policy so pods cross namespaces freely, and shared cluster…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit cluster network segmentation for the reachability a workload should not have: a namespace with no default-deny so every pod can reach every other pod, a missing egress policy that lets a compromised pod call out to the internet or the cloud metadata endpoint, an overly broad selector that admits more sources…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit how a resource server trusts OAuth access tokens for confusion it should reject: a token minted for one audience accepted by a different service, a scope treated as coarser or finer than it is so a token reaches an operation it was not granted, a token-issuer or authorization-server mix-up where a token from one…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit telemetry collectors and observability pipelines for trust they should not extend: a collector endpoint that ingests metrics, logs, or traces without authenticating the sender, a processor that executes or forwards based on attacker-controllable telemetry fields, a collector running with broad credentials whose…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit payment provider callbacks and settlement notifications for the trust that lets an attacker forge or alter a payment result: a callback whose signature is not verified so a spoofed success is accepted, an amount or currency taken from the callback or client rather than reconciled against the order the server…
UnboundCompute/security-agent-skills
Skill Claude CodeCodex
Audit payment and checkout state machines for transitions an attacker can drive out of order or replay for value: an order marked paid before the charge is confirmed, a step that can be skipped or repeated so goods ship without settlement, a non-idempotent charge or fulfillment endpoint that double-processes on a…