mastermind-security-research

Mastermind security research

[[mastermind-agent-security-review]] traces untrusted input to sinks and judges the design. This runs first and answers a narrower question: what can reach the privileged operation, what claims to enforce it, and which of those claims the graph can actually establish.

The output is a population and a gap list. It is not a security verdict, and it must not read like one.

The graph is wrong in both directions here

This is the rule the whole skill hangs on, and security is where getting it wrong costs the most.

A missing edge is not an absence of access. Middleware applied globally, a route table, a decorator-based dispatcher, a DI container, or a proxy in front of the service all invoke code the graph never links. A handler with no static caller may be reachable from the internet.

A present edge is not enforcement. mmcg_callers authGuard returning a handler proves the name appears in that function. It does not prove the guard runs before the sensitive operation, that its result is checked, that it fails closed, or that a branch does not skip it. Order, control flow, and error handling are invisible to a call edge.

So the graph never answers "is this protected". It produces two lists, and the difference between them is what a human has to read. Say that explicitly in the output — a research packet that lets a reader infer safety from a query result has done harm, not work.

Enumerate what can reach the privileged operation

mmcg_callers <privileged fn>        # direct callers
mmcg_impact <privileged fn> --depth 3   # transitive reach
mmcg_api_surface src/admin/         # what outside code actually reaches

Start from the operation that matters — the deletion, the payment, the role change, the token mint — not from the endpoint. The reachable set is the population you must account for; every member is either shown to be enforced or listed as unestablished.

mmcg_api_surface is the empirical attack surface: symbols under a prefix that code outside it reaches, independent of what is declared public. A module can export little and still be reached through a re-export.