Defensive Exploit Analysis (Authorized)

Authorization

Use this skill only with explicit written authorization for a named scope (systems, environments, and time window). If authorization is missing, expired, or the request is for someone else's systems, stop.

This skill is defensive and owner-authorized. It does not authorize offensive cyber operations.

Do

• Describe the bug class (e.g. missing authz) at a design level
• Write a regression test that fails before the fix and passes after
• Prefer sanitizers, type systems, and least-privilege patches
• Stop and refuse if the user asks for a working exploit, PoC payload, or bypass kit

Do not

• Write exploits, exploit PoCs, shellcode, or weaponized requests
• Document step-by-step attack procedures against any system
• Help with CTF flags, cracking, or unauthorized access
• Do not produce exploit payloads, malware, or attack procedures.

How to Use

Load this skill from /cc-security when the Task Card domain is security-exploit-dev. Example prompts:

• We confirmed IDOR on /invoices/:id in our app. Help design the authz check and a RED test — no exploit.
• Turn this crash report from our fuzzer into a defensive patch and a regression test.

Integration

• Workflow: /cc-security (CCEP command security)
• Existing OWASP application-security skill remains security (not this id)
• High-risk changes still require security-reviewer