docs(skills): reduce advisory catalogs to focused testing guidance

strix/skills/cloud/kubernetes.md

@@ -32,10 +32,9 @@ Kubernetes clusters expose a large attack surface through their API server, kube
 
 ## Key Vulnerabilities
 
-### Ingress-NGINX Admission and Retirement
+### Ingress-NGINX Admission
 
-- **IngressNightmare / CVE-2025-1974:** admission-controller reachability is a separate surface from public ingress routes. The exploit chain can reach controller execution and its Kubernetes credential authority from the pod network without a Kubernetes account. Inventory the validating webhook endpoint, controller image, network access, and service-account permissions. The admission-controller vulnerabilities are fixed in ingress-nginx 1.11.5 / 1.12.1; match the installed branch ([Kubernetes advisory](https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/)).
-- **Unsupported controller:** community ingress-nginx has received no upstream security fixes since its March 2026 retirement. A deployment patched for IngressNightmare can still be running an unsupported controller. Identify the controller implementation precisely: this retirement does not describe every NGINX-branded controller or the Kubernetes Ingress API. Assess migration to a maintained controller/Gateway API separately from exploitation of a specific CVE ([retirement statement](https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/)).
+Inventory validating-webhook reachability from the pod network and the controller's service-account permissions. IngressNightmare can reach controller execution without a Kubernetes account; fixes are in ingress-nginx 1.11.5 / 1.12.1 ([advisory](https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/)). Community ingress-nginx is retired and receives no security fixes; identify the implementation before applying that status to other NGINX controllers or the Ingress API ([support status](https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/)).
 
 ### RBAC Misconfigurations
 

strix/skills/frameworks/django.md

@@ -57,15 +57,10 @@ Map endpoints, authentication classes, and permission classes per route.
 
 ## Key Vulnerabilities
 
-### Framework Vulnerabilities
+### Request and Spatial Input Handling
 
-- **ASGI header identity — CVE-2026-3902:** underscore-bearing headers can collide with trusted hyphenated headers during `ASGIRequest` normalization. Trace proxy-injected identity headers into `request.META` and compare underscore/hyphen forms; this is an ASGI-specific trust boundary. Fixed in 6.0.4 / 5.2.13 / 4.2.30. Django 4.2 is unsupported as of April 7, 2026 ([advisory](https://www.djangoproject.com/weblog/2026/apr/07/security-releases/)).
-- **GeoDjango — CVE-2026-15307:** attacker-controlled spatial lookup strings/dictionaries can reach `GDALRaster`, causing server-side requests or file writes depending on the driver. Admin staff with view permission on a model containing a spatial field can reach the path through changelist filtering; also inspect custom filter APIs. Direct model-field assignments remain a separate input path after the lookup fix.
-- **Admin stored XSS — CVE-2026-15920:** unsafe-scheme values stored in a `URLField` can become clickable links in changelists/read-only displays. Trace imports, APIs, and direct saves that bypass form validation into an administrator's render path.
-- **Geometry parser DoS — CVE-2026-15830:** nested WKT/WKB geometry collections can crash GEOS. The fix limits collection depth/count; GeoJSON uses a different parser and is excluded from this specific issue. Inspect custom `max_geom_collections` overrides.
-- **Language cache growth — CVE-2026-15337:** many distinct long language codes populate the `check_for_language()` cache; inspect exposure of the optional `set_language` view. This is bounded memory consumption, not an arbitrary process-memory primitive.
-
-CVE-2026-15307, CVE-2026-15920, CVE-2026-15830, and CVE-2026-15337 are fixed in Django 6.0.8 / 5.2.17 and the 6.1 branch ([Django advisories](https://www.djangoproject.com/weblog/2026/aug/04/security-releases/)). Match backports to the installed branch rather than comparing only major versions.
+- Under ASGI, compare underscore/hyphen forms of proxy-injected identity headers through `ASGIRequest` normalization into `request.META`. Check the installed branch against the [header-collision advisory](https://www.djangoproject.com/weblog/2026/apr/07/security-releases/); Django 4.2 is unsupported.
+- For GeoDjango, trace attacker-controlled spatial lookup strings/dictionaries into `GDALRaster`: driver behavior can turn them into server-side requests or file writes. Include custom filter APIs and admin changelist filtering; direct model-field assignment is a separate input path ([spatial lookup advisory](https://www.djangoproject.com/weblog/2026/aug/04/security-releases/)).
 
 ### Authentication & Authorization
 

strix/skills/frameworks/fastapi.md

@@ -58,20 +58,11 @@ For each route, identify:
 
 ## Key Vulnerabilities
 
-### Starlette Vulnerabilities
+### Starlette Request Handling
 
-Resolve the installed Starlette version independently of FastAPI and identify the ASGI server and front proxy. The following paths depend on the application using the affected Starlette feature:
+Resolve Starlette's version independently of FastAPI and identify the ASGI server/front proxy. Compare middleware authorization against the actual routed path: malformed Host values can alter reconstructed `request.url` without changing routing ([URL parsing advisory](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr)).
 
-| Advisory | Affected / fixed Starlette | Attack path |
-|---|---|---|
-| [GHSA-86qp-5c8j-p5mr](https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr) | `<=1.0.0` / 1.0.1 | Malformed Host containing `/`, `?`, or `#` changes reconstructed `request.url.path` while routing still uses the original path. Compare middleware authorization against the actual routed endpoint through the deployed proxy. |
-| [GHSA-jp82-jpqv-5vv3](https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3) | `<1.3.0` / 1.3.0 | A request-target lacking a leading slash can poison `request.url.hostname`. Requires the ASGI server to forward that target; focus on pre-routing middleware and error handlers, since the malformed path normally returns 404. |
-| [GHSA-x746-7m8f-x49c](https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c) | `<1.1.0` / 1.1.0 | `HTTPEndpoint` registered without explicit `Route(methods=...)` can dispatch nonstandard verbs to matching helper methods. Inventory helpers accepting a request and returning a response; ordinary FastAPI decorators alone do not establish this path. |
-| [GHSA-wqp7-x3pw-xc5r](https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r) | `<1.1.0` / 1.1.0 | Windows `StaticFiles` with default `follow_symlink=False` resolves UNC paths before containment checks, causing SMB/NTLM exposure even when the HTTP response is 404. Requires Windows and reachable outbound SMB. |
-| [GHSA-82w8-qh3p-5jfq](https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq) | `>=0.4.1 <1.3.1` / 1.3.1 | `request.form()` ignores field-count/part-size limits for URL-encoded bodies. Compare the same small configured limit under URL-encoded and multipart content types; use an isolated worker for resource measurements. |
-| [GHSA-7f5h-v6xp-fcq8](https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8) | `>=0.39.0 <=0.49.0` / 0.49.1 | Crafted multi-range headers trigger quadratic processing in `FileResponse`, including `StaticFiles`. Measure bounded growth against a file-serving endpoint. |
-
-Multipart file spooling has a separate [event-loop blocking vulnerability](https://github.com/Kludex/starlette/security/advisories/GHSA-2c2j-9gv5-cj73), with 0.47.2 listed as patched: crossing the in-memory spool threshold can perform disk rollover on the event thread. Check the parser and upload path rather than treating a general request-body limit as coverage of all form-parser issues.
+For `request.form()`, test URL-encoded and multipart limits separately; a limit enforced on one parser may not constrain the other. Check whether crossing an upload's memory-to-disk spool threshold blocks the event loop ([form limits](https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq), [file spooling](https://github.com/Kludex/starlette/security/advisories/GHSA-2c2j-9gv5-cj73)).
 
 ### Authentication & Authorization
 

strix/skills/frameworks/nextjs.md

@@ -83,30 +83,10 @@ Inspect Network tab for POST requests with `Next-Action` header. Extract action
 
 ## Key Vulnerabilities
 
-### RSC Deserialization, Source Disclosure, and DoS
+### RSC and Image Processing
 
-- **React2Shell — CVE-2025-55182 / Next.js CVE-2025-66478:** unauthenticated RCE in the RSC request decoder. An App Router application can expose the vulnerable decoder even without explicitly declared Server Actions. Inventory the bundled `react-server-dom-*` implementation, not just the top-level React version; client-only React and Pages-only applications are different surfaces. Trace an incoming Flight/Server Function request to the decoder and distinguish decoding from invocation of an application action. See [React advisory](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components).
-- **Incomplete patch chains:** CVE-2025-55183 concerns Server Function source disclosure; CVE-2025-55184, CVE-2025-67779, and CVE-2026-23864 concern DoS. Source disclosure can reveal constants embedded in a function, but does not automatically disclose runtime environment variables. These issues are fixed in RSC packages 19.0.4 / 19.1.5 / 19.2.4; versions 19.0.3 / 19.1.4 / 19.2.3 remain affected by incomplete fixes. These version floors cover only this CVE family. Check Next.js advisories for the framework's affected and patched branches ([RSC advisory](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)).
-
-### Proxy, Action, and Cache Attack Paths
-
-The following issues are fixed in Next.js 15.5.21 / 16.2.11 and stable 16.3.0 ([advisories](https://nextjs.org/blog/july-2026-security-release)). Match the individual advisory's affected range to the deployed build.
-
-| Issue | Required surface and test direction |
-|---|---|
-| CVE-2026-64642 | App Router + Turbopack + exactly one `i18n.locales` entry: test middleware/proxy-protected routes. |
-| CVE-2026-64645 | Request-derived external rewrite/redirect hostnames: check whether the intended suffix still constrains the destination. |
-| CVE-2026-64649 | Custom-server Server Actions: trace forwarded/redirected requests and attacker-controlled Host-associated headers. |
-| CVE-2026-64643 | App Router action/`use cache` endpoint-ID disclosure: enumerate the exposed endpoints, then test their authorization separately. |
-| CVE-2026-64648 / 64647 | Cached fetch bodies: compare `fetch(new Request(init), differentInit)` and distinct invalid-UTF-8 bodies for cross-request response reuse. |
-| CVE-2026-64641 / 64646 | Action CPU exhaustion / Edge action-body memory exhaustion: requires a reachable Server Action; assess limits in an isolated worker. |
-| CVE-2026-64644 | Self-hosted default image loader with remote optimization: SVG processing can exhaust CPU. |
-
-### Native Image and Windows RCE
-
-- **AVIF optimizer:** an attacker-controlled AVIF reaching the `sharp`/libheif decoder can trigger unauthenticated RCE. Trace upload or allowed remote-image content into `/_next/image`; URL allowlisting does not make attacker-controlled image bytes trusted. Next.js 15.5.24 / 16.3.3 mitigate this path by disabling AVIF optimization.
-- **CVE-2026-75604:** Windows-hosted applications combining Pages Router and App Router **without Cache Components** have a separate unauthenticated RCE path. Linux/macOS and applications without that router combination are excluded. Fixed in 15.5.24 / 16.3.3 ([Next.js advisories](https://nextjs.org/blog/august-2026-security-release)).
-- **CVE-2026-94545 / GHSA-vcvr-r3jv-pc5j:** Next.js `>=16.2.0 <16.3.6`, Node `next/og` `ImageResponse`, and attacker-controlled SVG content, attributes, or styles. Trace input into image construction rather than testing only `/_next/image`; these are separate pipelines. The Edge implementation is excluded. Patched in 16.3.6 ([ImageResponse advisory](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)).
+- **React2Shell (CVE-2025-55182):** App Router applications can expose the vulnerable RSC decoder without explicit Server Actions. Identify the bundled `react-server-dom-*` implementation and trace requests into decoding; client-only React and Pages-only apps have different exposure. Check the framework's patched branch, including source-disclosure and DoS fixes ([RCE advisory](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components), [RSC advisories](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components)).
+- Treat `/_next/image` optimization and Node `next/og` `ImageResponse` as separate input paths. Trace attacker-controlled image bytes into native decoders, and SVG content/attributes/styles into image construction. URL allowlisting does not make image contents trusted; match the decoder, runtime, and Next.js version to the relevant advisory ([optimizer](https://nextjs.org/blog/august-2026-security-release), [ImageResponse](https://github.com/vercel/next.js/security/advisories/GHSA-vcvr-r3jv-pc5j)).
 
 ### Middleware Bypass
 

strix/skills/technologies/grafana_prometheus.md

@@ -79,13 +79,10 @@ Unauthenticated view (and, with `public_mode`, delete) of the lowest-key snapsho
 ### Prometheus / Alertmanager — exposure is the vuln (no auth by default)
 Prometheus and Alertmanager ship with **no authentication**; the docs explicitly say do not expose them. There is rarely a CVE — reachability itself is the finding, and the payoff is recon + credential leakage + pivoting (below).
 
-## Authentication, Plugin, and MCP Paths
+## Plugin and MCP Boundaries
 
-- **CVE-2026-12704 — Enterprise SAML replay:** with `allow_idp_initiated` enabled, `InResponseTo` validation is skipped even for SP-initiated responses. Test replay/session binding with a signed assertion for a controlled account. The setting is off by default; OSS is excluded. Fixed branches include 12.4.11 / 13.0.8 / 13.1.5 / 13.2.1 ([advisory](https://grafana.com/security/security-advisories/cve-2026-12704/)).
-- **CVE-2026-14199 — Auth Proxy identity collision:** self-managed Auth Proxy with `sync_ttl > 0` concatenates username and forwarded attributes without separators. Test whether two controlled identities produce the same cache key while an entry is live; attacker control of the relevant attributes is required. Fixed branches include 12.4.10 / 13.0.8 / 13.1.5 / 13.2.1 ([advisory](https://grafana.com/security/security-advisories/cve-2026-14199/)).
-- **CVE-2026-15815 — plugin extraction:** chained relative symlinks in a plugin archive can write outside the plugin directory and place an executable backend binary. Extraction occurs before signature verification, so signature checks alone do not block the write. Trace archive origin through CLI, `GF_INSTALL_PLUGINS`, or preinstall configuration; installing the archive is the necessary trigger. Fixed in 12.4.11 / 13.0.9 / 13.1.6 / 13.2.2 ([advisory](https://grafana.com/security/security-advisories/cve-2026-15815/)).
-- **CVE-2026-76154 — Geomap/MapLibre stored XSS:** an Editor-controlled external style configuration can execute script in a dashboard viewer's session, including an Org Admin. Follow the style URL and rendering path rather than testing only panel text. Fixed branches include 12.4.11 / 13.0.9 / 13.1.6 / 13.2.2 ([advisory](https://grafana.com/security/security-advisories/cve-2026-76154/)).
-- **CVE-2026-19516 — MCP Grafana SSRF:** a caller of `grafana_api_request` can steer destination, method, path, and body through `X-Grafana-URL`. The earlier CVE-2026-15583 fix stopped token forwarding but left destination control exploitable. Test destination restrictions independently of credential leakage. Fixed in mcp-grafana 1.1.0; the MCP server version is separate from Grafana's version ([advisory](https://grafana.com/security/security-advisories/cve-2026-19516/)).
+- Plugin archives are extracted before signature verification. Test chained symlinks and containment before trusting a signature failure to prevent filesystem writes; archive installation is the required trigger ([extraction advisory](https://grafana.com/security/security-advisories/cve-2026-15815/)).
+- Inventory mcp-grafana separately from Grafana. Trace `grafana_api_request` and `X-Grafana-URL` into destination selection; preventing token forwarding alone does not prevent SSRF ([MCP advisory](https://grafana.com/security/security-advisories/cve-2026-19516/)).
 
 ## Pivoting: Observability → Deeper Compromise
 

strix/skills/vulnerabilities/insecure_deserialization.md

@@ -79,7 +79,7 @@ JNDI injection is not itself a serialization format. It becomes part of this wor
 
 ### Python Pickle
 
-**Model checkpoints:** `torch.load(..., weights_only=True)` is not an unconditional safe boundary. [GHSA-63cw-57p8-fm3p](https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p) affects PyTorch through 2.9.1 and is fixed in 2.10.0. Malformed pickle opcodes and inconsistent storage metadata can corrupt memory even with the restricted unpickler. Trace uploaded/downloaded `.pth` files through the exact loader and worker runtime; checking only for `weights_only=False` misses this path. Inspect custom safe-global allowlists and alternative checkpoint loaders separately.
+**Model checkpoints:** `torch.load(..., weights_only=True)` does not rule out parser/storage memory corruption; the restricted loader is affected through PyTorch 2.9.1, with a fix in 2.10.0. Trace untrusted checkpoints through the exact loader and inspect safe-global allowlists ([PyTorch advisory](https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p)).
 
 Pickle executes arbitrary code during unpickling by design:
 ```python
@@ -96,8 +96,6 @@ class Exploit:
 ```
 When `yaml.load` used instead of `yaml.safe_load`.
 
-**JavaScript YAML resource attacks:** js-yaml `!!omap` uniqueness checks cause quadratic parser work on affected versions. Fixed in 3.15.1 / 4.3.1 / 5.2.1 ([advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj)). Repeated merges of empty mappings bypass `maxTotalMergeKeys` on affected versions; fixed in 3.15.2 / 4.3.2; merges are enabled by default on those branches ([merge-limit advisory](https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh)). Resolve the schema and parser branch, then use bounded input growth in an isolated worker to distinguish execution gadgets from CPU-exhaustion paths.
-
 ### PHP unserialize()
 
 **Object Injection**

strix/skills/vulnerabilities/path_traversal_lfi_rfi.md

@@ -148,9 +148,7 @@ Improper file path handling and dynamic inclusion enable sensitive file disclosu
 - Verify symlink handling and path canonicalization prior to write
 - Impact: overwrite config/templates or drop webshells into served directories
 
-**Python extraction filters:** Python 3.14 defaults `tarfile` extraction to the `data` filter; inspect explicit `filter`, `TarFile.extraction_filter`, and runtime patch level rather than assuming `extractall()` is unfiltered. Filters were backported to earlier branches but their defaults differ ([Python documentation](https://docs.python.org/3/library/tarfile.html#extraction-filters)).
-
-`data`/`tar` extraction filters require patched link handling to prevent CVE-2024-12718 and CVE-2025-4138/4330/4435/4517 ([3.12.11 security fixes](https://www.python.org/downloads/release/python-31211/)). **CVE-2026-82049** affects CPython 3.13 and earlier: hard links to symlinks can expose outside-file contents inside the extraction tree or modify outside-file permissions/timestamps despite those filters. Test archive link ordering and post-extraction reads in an isolated directory; distinguish content disclosure/metadata modification from arbitrary content overwrite. Check branch-specific patches in the [Python security announcement](https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/).
+**Python extraction filters:** Python 3.14 defaults `tarfile` extraction to `data`; earlier branches differ. Inspect `filter`, `TarFile.extraction_filter`, and runtime patch level ([documentation](https://docs.python.org/3/library/tarfile.html#extraction-filters)). Filters do not eliminate link-handling bugs: test archive link ordering and post-extraction reads for outside-file disclosure or permission/timestamp changes, separately from content overwrite ([security advisory](https://mail.python.org/archives/list/security-announce@python.org/thread/EFJWGAZJA56AKSBR2WHMHQZO7RRLZPRH/)).
 
 ### File Write to Execution
 

strix/skills/vulnerabilities/ssti.md

@@ -76,7 +76,7 @@ When output isn't reflected:
 
 ### Jinja2 / Mako (Python)
 
-**Jinja sandbox patch boundaries:** CVE-2024-56326 covers indirect `str.format` calls through stored references/custom filters (fixed in 3.1.5); CVE-2025-27516 covers `|attr` retrieving the plain format method outside sandbox attribute checks (fixed in 3.1.6). Inventory the exact Jinja version, environment, custom filters, and attacker control over template source. A patched sandbox changes which gadget paths work; user data passed only as a template variable does not expose this source-control prerequisite ([Jinja release notes](https://jinja.palletsprojects.com/en/stable/changes/), [attr advisory](https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7)).
+**Jinja sandbox:** indirect `str.format` references and `|attr` require version-specific checks; their sandbox fixes are in 3.1.5 and 3.1.6 respectively. Establish template-source control and inspect custom filters before choosing gadgets; user data passed only as a variable is a different surface ([release notes](https://jinja.palletsprojects.com/en/stable/changes/)).
 
 The classic Python class walk — every object exposes its method-resolution-order, which leads to `object`, which exposes every subclass loaded in the interpreter, which includes things like `subprocess.Popen`:
 

strix/skills/vulnerabilities/xss.md

@@ -55,7 +55,7 @@ Cross-site scripting persists because context, parser, and framework edges are c
 
 ### DOMPurify Live-Node Sanitization
 
-[GHSA-x4vx-rjvf-j5p4](https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4), fixed in DOMPurify 3.4.7, affects `IN_PLACE` sanitization through 3.4.6 when an attacker supplies live DOM objects with a controlled observable `nodeName`. A script node can be misclassified and survive insertion into the document. Trace same-origin iframe/popup node references or `adoptNode()` into `sanitize(node, { IN_PLACE: true })`; a raw HTML string is not the prerequisite, and ordinary string-input sanitization is excluded. Record the actual node source and sanitization mode before selecting this bypass.
+Distinguish HTML-string input from live DOM objects sanitized with `IN_PLACE`. Through DOMPurify 3.4.6, a controlled observable `nodeName` can make a script node survive sanitization; fixed in 3.4.7. Trace same-origin foreign nodes or `adoptNode()` into this mode before selecting the bypass ([advisory](https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4)).
 
 ### DOM XSS