Update to Tahr Security

{
  "name": "tahr-trace-dangerous-inputs",
  "description": "Trace attacker-controlled input through parsing, validation, normalization, storage, and dangerous server or browser sinks, then safely validate exploitability with class-specific proof gates. Use for injection review, source-to-sink analysis, XSS, SQL/NoSQL injection, command or template injection, SSRF, XXE, path traversal, unsafe deserialization, file upload/processing, webhook, CORS/postMessage, or client-side trust-boundary testing.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 236
    },
    {
      "relative_path": "references/exploitability-proof-gates.md",
      "size_in_bytes": 3368
    },
    {
      "relative_path": "references/source-sink-matrix.md",
      "size_in_bytes": 2483
    }
  ],
  "skill_md_contents": "---\nname: tahr-trace-dangerous-inputs\ndescription: Trace attacker-controlled input through parsing, validation, normalization, storage, and dangerous server or browser sinks, then safely validate exploitability with class-specific proof gates. Use for injection review, source-to-sink analysis, XSS, SQL/NoSQL injection, command or template injection, SSRF, XXE, path traversal, unsafe deserialization, file upload/processing, webhook, CORS/postMessage, or client-side trust-boundary testing.\n---\n\n# Trace Dangerous Inputs\n\nFind complete attacker-controlled data paths. Do not report a dangerous API call, suspicious regex match, reflection, or error without proving reachability and impact.\n\n## Set a safe review mode\n\n1. Identify repository roots, runtime targets, specifications, traffic, authentication context, and authorized scope.\n2. Default to static tracing when live testing is not explicitly authorized.\n3. Keep runtime probes low volume, non-destructive, and tied to exact discovered operations. Do not test login credential fields, customer objects, real payment/order flows, or unrelated infrastructure.\n4. Require a disposable fixture before uploads, persistent content, webhook registration, or other mutations. Define readback and cleanup first.\n5. Use harmless unique markers, controlled callbacks, safe owned canaries, and low-impact commands only. Never delete data, establish persistence, dump broad files/databases, scan internal networks, or alter cloud resources.\n\n## Build the source-to-sink map\n\nRead [source-sink-matrix.md](references/source-sink-matrix.md). For every candidate path, record:\n\n- entrypoint and exact source: path, query, body, nested field, header, cookie, form, multipart metadata, GraphQL variable, message, file, stored value, or browser source;\n- parsing and canonicalization order, including decoding, type coercion, content-type selection, duplicate parameters, archive/document parsing, and redirects;\n- validation, allowlisting, authorization, normalization, encoding, parameterization, and sanitization controls;\n- transformations and trust-boundary hops across services, queues, jobs, databases, caches, templates, browsers, and third parties;\n- final sink, execution context, and output/render/fetch/readback path.\n\nTrace second-order behavior: input stored now may later reach a query, template, browser render, document processor, shell, webhook, or background job.\n\n## Prioritize real sinks\n\nPrioritize operations evidenced by code, schemas, JavaScript, or traffic:\n\n- query builders and raw SQL/NoSQL/search expressions;\n- shell/process APIs, dynamic evaluation, deserializers, and template engines;\n- URL fetchers, redirects, webhooks, integrations, image/document renderers, and import/export jobs;\n- XML parsers, file/path/archive operations, upload pipelines, and served-content behavior;\n- HTML/DOM/navigation/eval-like browser sinks, postMessage handlers, and cross-origin data access.\n\nDo not send a payload to the application root merely because a field name looks interesting. Preserve the actual method, body, parser, auth/role/tenant context, and provenance.\n\n## Validate progressively\n\nFor an authorized runtime target:\n\n1. Establish a clean baseline and the operation's real success semantics.\n2. Send a unique inert marker to prove the source reaches the expected context.\n3. Change one field, encoding, parser, or carrier at a time using a context-specific safe probe.\n4. Distinguish filter/WAF behavior from application execution.\n5. Follow the result to the final proof surface: database-derived value, command output, callback, safe file canary, browser runtime effect, persisted readback, internal-service response, or served upload behavior.\n6. Repeat with a negative control and preserve exact request/action and response/proof artifacts.\n\nIf runtime proof is unavailable, report the full reachable code path and missing precondition as a candidate or code-level risk. Do not claim confirmed exploitability.\n\n## Apply class-specific proof gates\n\nRead [exploitability-proof-gates.md](references/exploitability-proof-gates.md). Enforce the appropriate gate before confirming a finding. In particular:\n\n- require database-derived extraction for SQL injection;\n- require browser/runtime JavaScript execution for XSS;\n- require exact-sink callback, internal response, metadata, or file/protocol proof for SSRF;\n- require command output or controlled callback for command/RCE claims;\n- separate upload acceptance from browser, server, or document-processing exploitation.\n\nKeep timing, errors, reflection, status/size differences, accepted files, listener presence, permissive headers, scanner labels, and source-only hypotheses in a candidate ledger until the gate passes.\n\n## Review the control at the right layer\n\nFor each path, determine whether the defense is structurally correct:\n\n- use parameterized APIs instead of blacklist filtering;\n- validate canonicalized data at the authoritative server boundary;\n- allowlist URL schemes/hosts and revalidate every redirect and resolved address;\n- disable unnecessary parser features and unsafe polymorphic deserialization;\n- isolate file storage and processing, generate server-side names, and serve inertly;\n- use context-specific output encoding and safe DOM APIs;\n- enforce origin and message schema checks before acting on cross-window data.\n\nSearch for variants of the same unsafe pattern across the repository after proving one path.\n\n## Report proof and coverage\n\nFor every confirmed issue, provide source-to-sink path, exact entrypoint, control failure, safe proof, impact, affected variants, remediation location, and reproduction steps. Redact secrets and PII while retaining field names, types, lengths, fingerprints, hashes, and proof signals.\n\nList untraced sources, unexecuted sinks, parser variants, background jobs, browser-only paths, unavailable callbacks, missing disposable fixtures, and other coverage gaps. Do not convert incomplete tracing into a clean result.\n"
}