docs(skills): verify release status and behavior per assessment

strix/skills/cloud/kubernetes.md

@@ -34,7 +34,7 @@ Kubernetes clusters expose a large attack surface through their API server, kube
 
 ### Ingress-NGINX Admission
 
-Inventory validating-webhook reachability from the pod network and the controller's service-account permissions. IngressNightmare can reach controller execution without a Kubernetes account; fixes are in ingress-nginx 1.11.5 / 1.12.1 ([advisory](https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/)). Community ingress-nginx is retired and receives no security fixes; identify the implementation before applying that status to other NGINX controllers or the Ingress API ([support status](https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/)).
+Inventory validating-webhook reachability from the pod network and the controller's service-account permissions. IngressNightmare illustrates controller execution without a Kubernetes account ([advisory](https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/)). Identify the controller implementation/image, then verify affected builds, backports, and maintenance status against current project or vendor notices; distinguish community ingress-nginx from other NGINX controllers and the Ingress API ([project notice](https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/)).
 
 ### RBAC Misconfigurations
 

strix/skills/frameworks/django.md

@@ -59,7 +59,7 @@ Map endpoints, authentication classes, and permission classes per route.
 
 ### Request and Spatial Input Handling
 
-- Under ASGI, compare underscore/hyphen forms of proxy-injected identity headers through `ASGIRequest` normalization into `request.META`. Check the installed branch against the [header-collision advisory](https://www.djangoproject.com/weblog/2026/apr/07/security-releases/); Django 4.2 is unsupported.
+- Under ASGI, compare underscore/hyphen forms of proxy-injected identity headers through `ASGIRequest` normalization into `request.META`. Resolve the installed branch, vendor backports, and support status from package metadata and current Django release/advisory information ([header-collision advisory](https://www.djangoproject.com/weblog/2026/apr/07/security-releases/)).
 - For GeoDjango, trace attacker-controlled spatial lookup strings/dictionaries into `GDALRaster`: driver behavior can turn them into server-side requests or file writes. Include custom filter APIs and admin changelist filtering; direct model-field assignment is a separate input path ([spatial lookup advisory](https://www.djangoproject.com/weblog/2026/aug/04/security-releases/)).
 
 ### Authentication & Authorization
@@ -212,7 +212,7 @@ Static analysis is the fastest way to reach the sinks above in white-box scope.
 - **pip-audit** (PyPA) — dependency CVE scanner for known-vuln Django/DRF/simplejwt versions: `pipx install pip-audit && pip-audit -r requirements.txt`
 - **ast-grep** (preinstalled) — quick structural grep for risky calls without a full SAST run: `ast-grep run -p 'mark_safe($X)' -l python`
 
-For the `SECRET_KEY` → signed-cookie forgery path noted under Session Issues, Django's own `django.core.signing` is the "tool": with a leaked key you can mint valid `signing.dumps()` values using the consumer's serializer and signing salt. `PickleSerializer` was removed in Django 5.0; that session-RCE path applies to older or custom pickle-backed serializers, not modern default JSON sessions. Password-reset tokens instead use `PasswordResetTokenGenerator`, with user state and timestamp in the digest, rather than the generic `signing.dumps()` format ([Django 5.0 removals](https://docs.djangoproject.com/en/5.0/releases/5.0/#features-removed-in-5-0), [token implementation](https://github.com/django/django/blob/stable/5.2.x/django/contrib/auth/tokens.py)).
+For the `SECRET_KEY` → signed-cookie forgery path noted under Session Issues, Django's own `django.core.signing` is the "tool": with a leaked key you can mint valid `signing.dumps()` values using the consumer's serializer and signing salt. Inspect `SESSION_SERIALIZER` and the installed implementation: the session-RCE path requires a reachable pickle-backed serializer; JSON sessions do not provide it. Password-reset tokens instead use `PasswordResetTokenGenerator`, with user state and timestamp in the digest, rather than the generic `signing.dumps()` format ([Django 5.0 removals](https://docs.djangoproject.com/en/5.0/releases/5.0/#features-removed-in-5-0), [token implementation](https://github.com/django/django/blob/stable/5.2.x/django/contrib/auth/tokens.py)).
 
 ## Summary
 

strix/skills/frameworks/fastapi.md

@@ -60,7 +60,7 @@ For each route, identify:
 
 ### Starlette Request Handling
 
-Resolve Starlette's version independently of FastAPI and identify the ASGI server/front proxy. Compare middleware authorization against the actual routed path: malformed Host values can alter reconstructed `request.url` without changing routing ([URL parsing advisory](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr)).
+Resolve Starlette's version independently of FastAPI and identify the ASGI server/front proxy. Check current upstream advisories and any vendor backports for the installed build before treating a parser issue as applicable. Compare middleware authorization against the actual routed path: malformed Host values can alter reconstructed `request.url` without changing routing ([URL parsing advisory](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr)).
 
 For `request.form()`, test URL-encoded and multipart limits separately; a limit enforced on one parser may not constrain the other. Check whether crossing an upload's memory-to-disk spool threshold blocks the event loop ([form limits](https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq), [file spooling](https://github.com/Kludex/starlette/security/advisories/GHSA-2c2j-9gv5-cj73)).
 

strix/skills/frameworks/nestjs.md

@@ -80,10 +80,10 @@ For each controller and method, identify:
 
 ### Adapter and Schema Version Boundaries
 
-- **Nest 11 / Express 5:** the default query parser is simple. Bracketed query fields do not automatically become nested objects; identify any `query parser: extended` override before applying `qs`/nested-operator attacks. Wildcard matchers distinguish root and child paths; test both paths against authentication middleware ([Express 5 migration](https://nestjs.io/tutorials/what-s-new-in-express-5-eeb51579)).
-- **Fastify 5:** route validation requires full JSON schemas; shorthand schemas are unsupported. Check the adapter and custom validator configuration before assuming that a DTO or legacy route schema is enforced ([Fastify migration](https://fastify.dev/docs/v5.0.x/Guides/Migration-Guide-V5/)).
-- **Nest 12 Standard Schema:** `@Body({ schema })`, `@Query({ schema })`, `@Param(..., { schema })`, and `@RawBody({ schema })` attach metadata; enforcement requires `StandardSchemaValidationPipe`. Probe schema-decorated routes for accepted invalid values when the pipe is absent or transport-local. Outgoing schema enforcement uses `StandardSchemaSerializerInterceptor`; check actual output rather than relying only on class-transformer decorators.
-- **Nest 12 GraphQL:** use GraphiQL and `graphql-ws`; `subscriptions-transport-ws` is unsupported by the corresponding `@nestjs/graphql` release. Discover the negotiated subprotocol and recheck connection and per-operation authentication on the deployed transport ([Nest 12 migration](https://docs.nestjs.com/migration-guide)).
+- **Express adapter:** resolve the installed Nest/Express versions and effective query-parser setting from configuration or a harmless nested-query probe. Apply `qs`/nested-operator attacks only when the parser constructs nested objects. Check the matching router documentation and test both root and child paths against authentication middleware ([migration reference](https://nestjs.io/tutorials/what-s-new-in-express-5-eeb51579)).
+- **Fastify adapter:** inspect the installed version's schema requirements and any custom validator configuration. Verify whether the route schema is actually enforced before relying on a DTO or shorthand-schema declaration ([migration reference](https://fastify.dev/docs/v5.0.x/Guides/Migration-Guide-V5/)).
+- **Standard Schema, where supported:** `@Body({ schema })`, `@Query({ schema })`, `@Param(..., { schema })`, and `@RawBody({ schema })` attach metadata; enforcement requires `StandardSchemaValidationPipe`. Probe schema-decorated routes for accepted invalid values when the pipe is absent or transport-local. Outgoing schema enforcement uses `StandardSchemaSerializerInterceptor`; check actual output rather than relying only on class-transformer decorators.
+- **GraphQL transport:** inspect installed packages, enabled IDE, and negotiated WebSocket subprotocol. Verify supported/deprecated transports against the matching Nest documentation, then recheck connection and per-operation authentication on the deployed transport ([migration guide](https://docs.nestjs.com/migration-guide)).
 
 ### Guard Bypass
 

strix/skills/frameworks/nextjs.md

@@ -12,7 +12,7 @@ Security testing for Next.js applications. Focus on authorization drift across r
 **Routers**
 - App Router (`app/`) and Pages Router (`pages/`) often coexist
 - Route Handlers (`app/api/**`) and API routes (`pages/api/**`)
-- Middleware: `middleware.ts` at project root; Next.js 16 deprecates this name in favor of `proxy.ts`, which requires the Node.js runtime. Existing Edge deployments can retain `middleware.ts`. Node middleware is stable in 15.5+; inspect the deployed runtime before selecting Edge-specific probes ([migration guide](https://nextjs.org/docs/app/guides/upgrading/version-16)).
+- Middleware/proxy: inspect `middleware.ts`, `proxy.ts`, installed Next.js metadata, and runtime configuration. Check the matching framework docs for supported filenames, Node/Edge behavior, and feature status before selecting runtime-specific probes ([migration guide](https://nextjs.org/docs/app/guides/upgrading/version-16)).
 
 **Runtimes**
 - Node.js (full API access)
@@ -43,6 +43,8 @@ Security testing for Next.js applications. Focus on authorization drift across r
 
 ## Reconnaissance
 
+At each assessment, establish the deployed build from package metadata, lockfiles, or runtime evidence. Verify release/support status and applicable fixes through current official docs, advisories, or upstream source; linked advisories are starting points, not a complete or permanently current list. Recheck when the target build or proposed remediation changes, and mark status unverified if evidence is unavailable.
+
 **Route Discovery**
 
 ```javascript
@@ -91,7 +93,7 @@ Inspect Network tab for POST requests with `Next-Action` header. Extract action
 ### Middleware Bypass
 
 **Known Techniques**
-- `x-middleware-subrequest` header crafting (CVE-2025-29927): middleware-only authorization can be skipped on affected deployments. Fixed in 12.3.5 / 13.5.9 / 14.2.25 / 15.2.3; Vercel-hosted deployments were automatically protected. Check whether external headers reach the origin and whether the destination enforces authorization independently ([advisory](https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw)).
+- `x-middleware-subrequest` header crafting (CVE-2025-29927): middleware-only authorization can be skipped on affected deployments. Resolve the installed branch and hosting protections from the advisory and provider configuration, then check whether external headers reach the origin and the destination enforces authorization independently ([advisory](https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw)).
 - `x-nextjs-data` probing
 - Look for 307 + `x-middleware-rewrite`/`x-nextjs-redirect` headers
 
@@ -123,7 +125,7 @@ Middleware checks first value, handler uses last or array.
 **Cache Boundary Failures**
 - User-bound data cached without identity keys (ETag/Set-Cookie unaware)
 - Personalized content served from shared cache/CDN
-- Missing `no-store` on sensitive fetches that actually enter a shared cache. Next.js 15+ leaves `fetch` and GET Route Handlers uncached by default. Next.js 16 Cache Components use explicit `use cache` boundaries: inspect cache-key arguments/closed-over values, `cacheTag`, `cacheLife`, and invalidation for user/tenant separation ([Next.js caching defaults](https://nextjs.org/docs/app/guides/upgrading/version-15), [Cache Components](https://nextjs.org/docs/app/getting-started/cache-components)).
+- Missing `no-store` on sensitive fetches matters only when they enter a shared cache. Determine `fetch` and GET Route Handler defaults for the deployed version from docs/configuration and observed responses. Where Cache Components are enabled, inspect `use cache` arguments/closed-over values, `cacheTag`, `cacheLife`, and invalidation for user/tenant separation ([caching documentation](https://nextjs.org/docs/app/getting-started/cache-components)).
 
 **Flight Data Leakage**
 

strix/skills/technologies/active_directory.md

@@ -100,7 +100,7 @@ certipy find -u <USER>@<DOMAIN> -p <PASS> -dc-ip <DC_IP> -vulnerable -stdout
 - **ESC8** — NTLM relay to the CA web-enrollment endpoint (coerce a DC, relay to `/certsrv`) → DC certificate → DCSync.
 - **ESC others** — ESC2/3 (any-purpose/enrollment-agent), ESC4 (writable template DACL → make it ESC1), ESC6 (`EDITF_ATTRIBUTESUBJECTALTNAME2` on the CA), ESC7 (CA officer rights), ESC9/10 (weak cert mapping), ESC11 (RPC relay), ESC13 (issuance-policy→group), ESC15 (app-policy on v1 templates). `certipy find -vulnerable` flags each.
 
-**Strong certificate mapping:** DCs with the September 9, 2025 update or later enforce strong certificate mapping without Compatibility-mode fallback. Inspect the issuing template's SID extension, explicit mappings, KDC patch level, and the actual principal selected at authentication. A requested privileged UPN alone does not establish a working ESC chain on a fully updated domain ([KB5014754](https://support.microsoft.com/en-us/servicing/os/windows-server/2022/05/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers)).
+**Strong certificate mapping:** establish the DC patch level, mapping policy, and vendor backports; consult Microsoft's current enforcement guidance before assuming Compatibility mode is available. Inspect template SID extensions, explicit mappings, and the principal selected at authentication. A requested privileged UPN alone does not establish a working ESC chain ([KB5014754](https://support.microsoft.com/en-us/servicing/os/windows-server/2022/05/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers)).
 
 ### Windows Server 2025 dMSA / BadSuccessor
 

strix/skills/technologies/auth0.md

@@ -86,7 +86,7 @@ Authorization: Bearer <token_with_audience_A>
 
 ### Rules and Actions Abuse
 
-Rules and Hooks are scheduled to stop executing on November 18, 2026. Before that cutoff, inventory which legacy flows still execute; during migration to Actions, compare claim assignment, MFA, denial decisions, and account-linking checks across every connection rather than assuming migrated code preserves the same enforcement. Rules/Hooks source code is read-only, so distinguish an exposed legacy secret/configuration update path from source-code modification ([Auth0 lifecycle notice](https://auth0.com/docs/troubleshoot/product-lifecycle/deprecations-and-migrations#rules-and-hooks-deprecations)).
+Inventory which Rules, Hooks, and Actions actually execute in the tenant. Check the current Auth0 lifecycle notice and tenant capabilities for retirement or read-only restrictions. During migration, compare claim assignment, MFA, denial decisions, and account-linking checks across every connection; distinguish secret/configuration access from source-code modification ([lifecycle notice](https://auth0.com/docs/troubleshoot/product-lifecycle/deprecations-and-migrations#rules-and-hooks-deprecations)).
 
 **Post-Login Rule/Action Injection**
 - Rules that add claims based on unvalidated user metadata:

strix/skills/technologies/grafana_prometheus.md

@@ -81,6 +81,8 @@ Prometheus and Alertmanager ship with **no authentication**; the docs explicitly
 
 ## Plugin and MCP Boundaries
 
+Resolve installed Grafana, plugin, and MCP server builds separately; check current upstream advisories and vendor backports before applying a listed attack path or recommending a release.
+
 - Plugin archives are extracted before signature verification. Test chained symlinks and containment before trusting a signature failure to prevent filesystem writes; archive installation is the required trigger ([extraction advisory](https://grafana.com/security/security-advisories/cve-2026-15815/)).
 - Inventory mcp-grafana separately from Grafana. Trace `grafana_api_request` and `X-Grafana-URL` into destination selection; preventing token forwarding alone does not prevent SSRF ([MCP advisory](https://grafana.com/security/security-advisories/cve-2026-19516/)).
 

strix/skills/technologies/llm_applications.md

@@ -78,11 +78,11 @@ Record both forward and reverse reachability: attacker-controlled input to privi
 
 ## Optional Tool Routing
 
-Use tools only when they match the deployed surface. Treat generated cases and scanner labels as leads until the application-side boundary is validated.
+Use tools only when they match the deployed surface. Resolve compatible versions, runtime requirements, maintenance status, and advisories from registry metadata and current upstream documentation, then pin the exact reviewed versions for the run. Treat generated cases and scanner labels as leads until the application-side boundary is validated.
 
-- **[Promptfoo](https://github.com/promptfoo/promptfoo)** — use for repeatable model/application trials, custom adversarial cases, graders, provider comparisons, and success-rate regression. Install the reviewed version locally with `npm install --save-dev --save-exact promptfoo@0.122.0`, then invoke `./node_modules/.bin/promptfoo redteam run`. Define explicit plugins, assertions, `numTests`, `maxConcurrency`, and `delay`; provider calls may transmit test data and incur cost. Its `owasp:llm` preset still uses the 2025 category mapping in version 0.122.0, so build or select tests from the 2026 matrix above and do not present the preset report as complete 2026 coverage.
-- **[MCP Inspector](https://github.com/modelcontextprotocol/inspector)** — use for LLM01/LLM03 surface mapping when MCP servers are present. Install the reviewed version with `npm install --save-dev --save-exact @modelcontextprotocol/inspector@2.2.0`, then use `./node_modules/.bin/mcp-inspector --cli --config <reviewed-config> --server <name> --method tools/list` and the equivalent `resources/list` / `prompts/list` operations. Starting a stdio server executes that configured process, initialization/list handlers may have side effects, and `tools/call` can perform the real action; inspect the target and credentials before invoking it.
-- **[ModelScan](https://github.com/protectai/modelscan)** — use for LLM04 static triage of supported H5, Pickle, and SavedModel artifacts before loading them, for example `uvx modelscan==0.8.8 -p <artifact>`. Run it as an untrusted-file parser in an isolated analysis environment. A clean result covers only the scanner's supported formats and signatures; it does not establish artifact provenance, integrity, or absence of behavioral backdoors.
+- **[Promptfoo](https://github.com/promptfoo/promptfoo)** — use for repeatable model/application trials, custom adversarial cases, graders, provider comparisons, and success-rate regression. Install the reviewed version locally with `npm install --save-dev --save-exact promptfoo@<reviewed-version>`, then invoke `./node_modules/.bin/promptfoo redteam run`. Define explicit plugins, assertions, `numTests`, `maxConcurrency`, and `delay`; provider calls may transmit test data and incur cost. Inspect the installed `owasp:llm` preset's category mapping and actual tests before claiming coverage; add cases for gaps against the assessment's chosen taxonomy.
+- **[MCP Inspector](https://github.com/modelcontextprotocol/inspector)** — use for LLM01/LLM03 surface mapping when MCP servers are present. Install the reviewed version with `npm install --save-dev --save-exact @modelcontextprotocol/inspector@<reviewed-version>`, then use `./node_modules/.bin/mcp-inspector --cli --config <reviewed-config> --server <name> --method tools/list` and the equivalent `resources/list` / `prompts/list` operations. Starting a stdio server executes that configured process, initialization/list handlers may have side effects, and `tools/call` can perform the real action; inspect the target and credentials before invoking it.
+- **[ModelScan](https://github.com/protectai/modelscan)** — use for LLM04 static triage of supported H5, Pickle, and SavedModel artifacts before loading them, for example `uvx modelscan==<reviewed-version> -p <artifact>`. Run it as an untrusted-file parser in an isolated analysis environment. A clean result covers only the scanner's supported formats and signatures; it does not establish artifact provenance, integrity, or absence of behavioral backdoors.
 
 ## LLM01:2026 Prompt Injection
 

strix/skills/technologies/supabase.md

@@ -48,9 +48,9 @@ Security testing for Supabase applications. Focus on mis-scoped Row Level Securi
 ### API Keys and Signing Keys
 
 - Opaque keys start with `sb_publishable_` or `sb_secret_`; JWT decoding will not classify them. Search bundles, server configuration, and responses for both formats. Publishable keys are intended for public clients; secret keys use `service_role` and bypass RLS. A browser 401 for a leaked secret key is not revocation: the browser restriction uses `User-Agent` and does not stop server-side use.
-- Creating new keys does not disable legacy keys. After migration, test whether the old `anon` / `service_role` credential remains accepted; dashboard revocation is a separate action. Supabase documents legacy-key deprecation for the end of 2026 ([API keys](https://supabase.com/docs/guides/getting-started/api-keys)).
-- Edge Functions use user JWTs in `Authorization` and API keys in `apikey`. For migration compatibility, the platform `verify_jwt` check also accepts opaque API keys on either header; passing that check with a publishable key does not establish a signed-in user. Test whether the handler verifies user identity before using a privileged client. Conversely, `verify_jwt=false` with explicit secret-key or webhook verification is not necessarily public. Trace the configured `@supabase/server` auth mode or custom verification ([function authorization](https://supabase.com/docs/guides/functions/auth-headers)).
-- Asymmetric signing keys are discoverable at `/auth/v1/.well-known/jwks.json`. Test custom API/Edge Function validators for issuer/algorithm binding and stale cached keys after rotation/revocation. Supabase documents a 10-minute edge cache plus potentially another 10 minutes in client libraries; custom caches can last longer. Supabase's own services do not use that same revocation cache ([signing keys](https://supabase.com/docs/guides/auth/signing-keys)).
+- Creating new keys does not disable legacy keys. After migration, test whether the old `anon` / `service_role` credential remains accepted; dashboard revocation is a separate action. Verify supported key formats and migration/deprecation status from project settings and current Supabase documentation ([API keys](https://supabase.com/docs/guides/getting-started/api-keys)).
+- Edge Functions use user JWTs in `Authorization` and API keys in `apikey`. Verify the deployed platform's `verify_jwt` behavior with current docs and controlled requests, including API keys on either header; passing a platform check with a publishable key does not establish a signed-in user. Test whether the handler verifies user identity before using a privileged client. Conversely, `verify_jwt=false` with explicit secret-key or webhook verification is not necessarily public. Trace the configured `@supabase/server` auth mode or custom verification ([function authorization](https://supabase.com/docs/guides/functions/auth-headers)).
+- Asymmetric signing keys are discoverable at `/auth/v1/.well-known/jwks.json`. Test custom API/Edge Function validators for issuer/algorithm binding and stale cached keys after rotation/revocation. Measure cache lifetimes from response headers, SDK configuration, and controlled rotation tests; check service-specific revocation behavior in current documentation rather than assuming platform and custom validators share a cache ([signing keys](https://supabase.com/docs/guides/auth/signing-keys)).
 
 ## High-Value Targets
 

strix/skills/vulnerabilities/agentic_system_security.md

@@ -110,10 +110,10 @@ Classify each discovered integration by data read, data write, external communic
 - For browser or loopback OAuth, review redirect URI, state/PKCE handling, localhost binding, and consent proxying. Treat metadata fetches and tool discovery on remote servers as SSRF-relevant surfaces.
 - For stdio servers, the launch command and environment are already code execution. Discovery must not execute an unreviewed server binary or mutable package tag.
 
-#### MCP 2026-07-28 Protocol Boundaries
+#### MCP Protocol Boundaries
 
-- Identify the actual protocol revision. MCP 2026-07-28 requests carry their own version and client metadata, with optional `server/discover`; this revision does not use `initialize`/`initialized` or `Mcp-Session-Id`. On this revision, test authorization on every independent request and do not trust client-supplied identity/capabilities in `_meta` as authenticated identity. Keep initialization/session tests for older deployments.
-- Multi-round tool requests return `input_required` and resume through a retry with `inputResponses`. Test whether a response from another user, tool invocation, or approval round can be substituted, and whether a retry repeats a consequential action ([MCP protocol specification](https://blog.modelcontextprotocol.io/posts/2026-07-28/)).
+- Identify the protocol revision and client/server SDK builds from configuration and wire traffic, then consult the matching specification and current SDK advisories. Determine whether the transport uses initialization/session IDs or independent requests with client metadata and discovery. Test authorization on every request; client-supplied identity/capabilities in `_meta` are not authenticated identity.
+- Where multi-round tool requests use `input_required` and `inputResponses`, trace the retry/resume binding. Test whether a response from another user, tool invocation, or approval round can be substituted, and whether a retry repeats a consequential action ([MCP protocol specification](https://blog.modelcontextprotocol.io/posts/2026-07-28/)).
 - For OAuth callbacks, bind the expected issuer from validated discovery to the PKCE transaction. A present `iss` must match exactly, even if metadata did not advertise support; an absent `iss` must be rejected when `authorization_response_iss_parameter_supported` is true. Test issuer changes between discovery, registration, and callback, including error callbacks. Bind client credentials to their authorization-server issuer. Require the MCP server's `resource` in authorization and token requests and validate the token's audience at the server ([authorization requirements](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization)).
 
 ### Executable Component Supply Chain
@@ -164,7 +164,7 @@ npx @modelcontextprotocol/inspector@<reviewed-version> --cli \
   --method tools/list --format json
 ```
 
-- MCP Inspector 2.1.0 requires Node.js `>=22.19.0`. Check the selected package's engine requirements before pinning.
+- Before choosing MCP Inspector, inspect package-registry metadata, engine requirements, release notes, and advisories. Select a compatible reviewed version and pin that exact version for the run; do not infer safety from a release tag.
 - Prefer CLI/TUI and loopback binding over exposing the web UI.
 - Preserve the generated API token; never disable authentication or bind the process-spawning backend to an external interface.
 - Do not publish ports 6274/6277 or pass through the Docker socket/host devices.
@@ -179,7 +179,7 @@ npx @modelcontextprotocol/inspector@<reviewed-version> --cli \
 npx promptfoo@<reviewed-version> eval
 ```
 
-- Promptfoo's documented Node.js requirements are `^20.20.0` or `>=22.22.0`. Check the selected package's engine requirements before pinning.
+- Resolve Promptfoo's runtime requirements, supported features, and security status from registry metadata and current upstream docs before choosing and pinning a version.
 - Use synthetic prompts/data and a dedicated test provider/project.
 - Provider calls transmit data externally and can incur cost even when evaluation orchestration is local. Set request/concurrency and spending ceilings.
 - Pin model, provider, prompt, tool schema, retrieval corpus revision, and evaluator versions.

strix/skills/vulnerabilities/browser_security.md

@@ -106,9 +106,9 @@ Prove the strongest reliable capability first. If escalation requires a user ges
 
 ### Local Network and Loopback Access
 
-Chrome 142+ applies Local Network Access permission checks for covered requests from websites to local destinations; secure-context, request type, permission state, and enterprise policy affect reachability. Test DNS rebinding and browser-to-local-service chains in the target browser, including permission denied and granted states. A successful server-side request does not establish browser reachability ([Chrome LNA](https://developer.chrome.com/blog/local-network-access)).
+Identify the browser build, enabled flags, permission state, and enterprise policy; consult its current Local Network Access documentation and verify actual behavior with controlled requests. Test DNS rebinding and browser-to-local-service chains in both permission-denied and permission-granted states. A successful server-side request does not establish browser reachability ([Chrome LNA](https://developer.chrome.com/blog/local-network-access)).
 
-Chrome 145+ uses separate permissions for `local-network` and `loopback-network`; `local-network-access` is an alias for permission queries and Permissions Policy. Record which destination class was permitted before claiming access to both LAN and localhost services ([Chrome 145](https://developer.chrome.com/release-notes/145#local_network_access_split_permissions)).
+Discover which permission names and aliases the target supports, including `local-network`, `loopback-network`, and `local-network-access`. Record which destination class was permitted before claiming access to both LAN and localhost services ([permission reference](https://developer.chrome.com/release-notes/145#local_network_access_split_permissions)).
 
 ### JavaScript Gadget Discovery
 

strix/skills/vulnerabilities/insecure_deserialization.md

@@ -79,7 +79,7 @@ JNDI injection is not itself a serialization format. It becomes part of this wor
 
 ### Python Pickle
 
-**Model checkpoints:** `torch.load(..., weights_only=True)` does not rule out parser/storage memory corruption; the restricted loader is affected through PyTorch 2.9.1, with a fix in 2.10.0. Trace untrusted checkpoints through the exact loader and inspect safe-global allowlists ([PyTorch advisory](https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p)).
+**Model checkpoints:** `torch.load(..., weights_only=True)` does not rule out parser/storage memory corruption. Resolve the installed loader build and check current upstream advisories/backports before trusting that flag. Trace untrusted checkpoints through the exact loader and inspect safe-global allowlists ([example advisory](https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p)).
 
 Pickle executes arbitrary code during unpickling by design:
 ```python
@@ -103,14 +103,14 @@ When `yaml.load` used instead of `yaml.safe_load`.
 - POP chains through framework classes (Laravel, Symfony, WordPress plugins)
 
 **Phar Deserialization**
-- On PHP before 8.0, upload or reference `phar://` to trigger metadata deserialization through file operations. PHP 8.0+ does not automatically deserialize metadata on archive opening; inspect explicit `Phar::getMetadata()` / `PharFileInfo::getMetadata()` calls and their `allowed_classes` options on newer targets ([PHP 8.0 change](https://www.php.net/manual/en/migration80.incompatible.php#migration80.incompatible.phar)).
+- Trace `phar://` file operations and explicit `Phar::getMetadata()` / `PharFileInfo::getMetadata()` calls. Verify the installed PHP version's metadata-deserialization behavior and `allowed_classes` handling from source/docs; archive opening alone does not establish a deserialization sink ([migration reference](https://www.php.net/manual/en/migration80.incompatible.php#migration80.incompatible.phar)).
 
 ### .NET Deserialization
 
 **BinaryFormatter / LosFormatter**
 - Never safe on untrusted input; full RCE with known gadget chains (ysoserial.net)
 
-In .NET 9+, the in-box `BinaryFormatter` implementation throws on use. Establish the target framework and whether the application restored the unsupported compatibility package before pursuing its gadget chains. Older .NET Framework applications and separate serializers such as `LosFormatter` remain distinct surfaces ([Microsoft migration guide](https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-migration-guide/)).
+Inspect the target framework and resolved serialization packages to establish whether `BinaryFormatter` executes, throws, or is restored through a compatibility package. Check the matching runtime documentation before choosing gadget chains; `LosFormatter` and other serializers are separate surfaces ([Microsoft guide](https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-migration-guide/)).
 
 **Json.NET**
 ```json
@@ -197,7 +197,7 @@ Payload generation is the practitioner's core tool here. The sandbox has `git`/`
 | **ysoserial** (frohoff) | Java native | Gadget-chain payloads: `CommonsCollections1-7`, `Groovy1`, `Spring1/2`, and `URLDNS` for a safe no-exec DNS oracle. Needs a JRE. |
 | **phpggc** (ambionics) | PHP `unserialize` / Phar | Framework POP chains (Laravel, Symfony, WordPress, Drupal, Monolog). Needs `php-cli`. |
 | **ysoserial.net** | .NET `BinaryFormatter` / Json.NET | Windows/.NET gadget payloads. Needs .NET/mono — usually out of scope in a Linux sandbox. |
-| **marshalsec** | Java Hessian/Burlap, Kryo, JSON, and JNDI reference tooling | Use only from a reviewed, pinned upstream commit when a non-native Java marshaller requires it. It has no stable release and intentionally bundles historical gadget dependencies; do not treat it as a globally installed default tool. |
+| **marshalsec** | Java Hessian/Burlap, Kryo, JSON, and JNDI reference tooling | Use only from a reviewed, pinned upstream commit when a non-native Java marshaller requires it. Check upstream release status and bundled gadget dependencies before selecting a commit; do not treat it as a globally installed default tool. |
 
 ```
 # Java: prove the sink with a no-exec DNS oracle BEFORE any RCE chain

strix/skills/vulnerabilities/nosql_injection.md

@@ -91,7 +91,7 @@ Binary search the character space to minimize requests. Works on any string fiel
 
 ### `$where` JavaScript Injection
 
-If `$where` is enabled, inject server-side JavaScript. `$where`, `$function`, and `$accumulator` are deprecated in MongoDB 8.0+, but server-side scripting is enabled by default; inspect `security.javascriptEnabled` / `--noscripting` and the deployed service configuration. MongoDB 6.0 uses MozJS-91 instead of MozJS-60; some legacy nonstandard functions are unavailable ([MongoDB documentation](https://www.mongodb.com/docs/manual/reference/operator/query/where/)):
+If `$where` is enabled, inject server-side JavaScript. Inspect `security.javascriptEnabled` / `--noscripting`, managed-service restrictions, and the installed engine version. Verify operator availability, defaults, and supported functions against that build's documentation or controlled probes; deprecation alone does not mean execution is disabled ([MongoDB documentation](https://www.mongodb.com/docs/manual/reference/operator/query/where/)):
 ```json
 {"$where": "function(){return this.role == 'admin'}"}                          // direct filter — returns matching documents
 {"$where": "function(){return this.username == 'admin' && sleep(2000)}"}       // timing oracle only — sleep() returns undefined (falsy), so no documents are returned; observe latency

strix/skills/vulnerabilities/path_traversal_lfi_rfi.md

@@ -148,7 +148,7 @@ Improper file path handling and dynamic inclusion enable sensitive file disclosu
 - Verify symlink handling and path canonicalization prior to write
 - Impact: overwrite config/templates or drop webshells into served directories
 
-**Python extraction filters:** Python 3.14 defaults `tarfile` extraction to `data`; earlier branches differ. Inspect `filter`, `TarFile.extraction_filter`, and runtime patch level ([documentation](https://docs.python.org/3/library/tarfile.html#extraction-filters)). Filters do not eliminate link-handling bugs: test archive link ordering and post-extraction reads for outside-file disclosure or permission/timestamp changes, separately from content overwrite ([security advisory](https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/)).
+**Python extraction filters:** Determine the effective `filter` and `TarFile.extraction_filter` from the installed Python runtime, caller configuration, and matching documentation; verify patch/backport status against current advisories ([documentation](https://docs.python.org/3/library/tarfile.html#extraction-filters)). Filters do not eliminate link-handling bugs: test archive link ordering and post-extraction reads for outside-file disclosure or permission/timestamp changes, separately from content overwrite ([security advisory](https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/)).
 
 ### File Write to Execution
 

strix/skills/vulnerabilities/prototype_pollution.md

@@ -51,7 +51,7 @@ Prototype pollution corrupts shared object prototypes (`Object.prototype`, `Arra
 **Common Sinks**
 - `lodash.merge`, `lodash.defaultsDeep`, `deep-extend`, `merge-options`
 - Express/query parsers accepting nested objects
-- YAML merge-key handling with prototype keys: js-yaml `>=4.0.0 <4.1.1` and `<3.14.2` can change the parsed result's prototype through `<<` merges (fixed in 4.1.1 / 3.14.2). Trace inherited values from that parsed object into a sensitive consumer; this does not require global `Object.prototype` modification. The old `load` versus `safeLoad` distinction does not describe the modern API ([merge advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m)).
+- YAML merge-key handling with prototype keys: identify the js-yaml version/schema and check applicable upstream advisories. Test whether `<<` merges alter the parsed result's prototype, then trace inherited values into a sensitive consumer; global `Object.prototype` modification is not required. Verify the installed API rather than assuming `load` versus `safeLoad` determines safety ([merge advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m)).
 - JSON.parse → merge into existing object without null prototype
 
 **RCE Gadget Chains (Node.js)**

strix/skills/vulnerabilities/ssti.md

@@ -76,7 +76,7 @@ When output isn't reflected:
 
 ### Jinja2 / Mako (Python)
 
-**Jinja sandbox:** indirect `str.format` references and `|attr` require version-specific checks; their sandbox fixes are in 3.1.5 and 3.1.6 respectively. Establish template-source control and inspect custom filters before choosing gadgets; user data passed only as a variable is a different surface ([release notes](https://jinja.palletsprojects.com/en/stable/changes/)).
+**Jinja sandbox:** resolve the installed Jinja build and check current sandbox advisories before selecting indirect `str.format` or `|attr` gadgets. Establish template-source control and inspect custom filters; user data passed only as a variable is a different surface ([release notes](https://jinja.palletsprojects.com/en/stable/changes/)).
 
 The classic Python class walk — every object exposes its method-resolution-order, which leads to `object`, which exposes every subclass loaded in the interpreter, which includes things like `subprocess.Popen`:
 

strix/skills/vulnerabilities/xss.md

@@ -55,7 +55,7 @@ Cross-site scripting persists because context, parser, and framework edges are c
 
 ### DOMPurify Live-Node Sanitization
 
-Distinguish HTML-string input from live DOM objects sanitized with `IN_PLACE`. Through DOMPurify 3.4.6, a controlled observable `nodeName` can make a script node survive sanitization; fixed in 3.4.7. Trace same-origin foreign nodes or `adoptNode()` into this mode before selecting the bypass ([advisory](https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4)).
+Distinguish HTML-string input from live DOM objects sanitized with `IN_PLACE`. Resolve the deployed DOMPurify build and check relevant upstream advisories; a controlled observable `nodeName` is one live-node bypass mechanism. Trace same-origin foreign nodes or `adoptNode()` into this mode before selecting the bypass ([example advisory](https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4)).
 
 ### DOM XSS