Quality

Kiro Review performs adversarial task-local review of a task implementation against approved specs, task boundaries, and verification evidence. Use it after an implementer finishes a task, after remediation, or before accepting a task as complete.

Kiro Review performs adversarial review of a task implementation against approved specs, task boundaries, and verification evidence. Use it after an implementer reports the task ready, after remediation, or before accepting a task as complete.

Kiro Spec Status reads a specification's files and reports its current phase, completion percentage, task breakdown, boundary context, and next actions. Use it to see where a spec-driven development effort stands and what blockers or revalidation needs are next.

Kiro Validate Design reviews technical design documents against requirements and project context, identifying critical issues and giving a GO/NO-GO decision before implementation.

Verify Completion checks completion and success claims against fresh command evidence before a task, fix, test, or feature is reported as done. Use it before closing tasks, trusting subagent success, or giving feature GO.

API Misconfig Hunter finds mass assignment, prototype pollution, HTTP verb tampering, and server-side parameter pollution in APIs. Use it when auditing API endpoints for security misconfigurations in bug bounty or penetration testing.

Auth Bypass Hunting guides reconnaissance of authentication entry points and exploitation of SSO, SAML, JWT, XMLRPC, and legacy protocol weaknesses to find login bypasses and privilege escalation. Use when assessing web apps, WordPress, SharePoint, Atlassian, and partner portals for auth flaws.

Bug Bounty guides security researchers through the full bug bounty workflow: reconnaissance, hunting vulnerabilities (IDOR, SSRF, XSS, auth bypass, AI/LLM security issues), validating findings, and writing impactful reports.

Bug Bounty Methodology orchestrates bug bounty hunting sessions by combining a five-phase non-linear workflow with critical thinking tactics like developer psychology, anomaly detection, and what-if experiments to decide next steps.

Business Logic Hunter identifies business logic vulnerabilities in web applications, covering price tampering, coupon stacking, verification bypass, and rate limit abuse. Use it when hunting for financial-impact bugs in e-commerce, SaaS, and payment platforms.

Cache Poison Hunter finds cache poisoning and web cache deception vulnerabilities in CDN-fronted apps, using techniques like unkeyed header reflection and path confusion to poison cached responses or steal dynamic content.

CAPTCHA Bypass Hunter identifies CAPTCHA validation weaknesses such as omitted fields, replayable tokens, and missing server-side checks. Use it during security testing to find bypasses that enable brute force, account farming, or automated abuse.