Quality

Detect Cross-Site Scripting vulnerabilities in a codebase using a three-phase approach: recon for sink sites, batched taint tracing, and result merging. Use when auditing code for XSS bugs.

Performs codebase analysis and architecture mapping as the initial reconnaissance phase of a security assessment. Explores tech stack, entry points, data flows, and trust boundaries. Outputs a structured architecture document for use before vulnerability detection.

Detects business logic vulnerabilities in code using threat modeling, parallel subagent verification, and result merging. Covers price manipulation, workflow bypass, race conditions, and other abuse-of-function bugs.

Detect insecure file upload vulnerabilities in codebases using a three-phase approach: discovery, batched verification, and merge. Use when auditing code for unrestricted upload, extension bypass, or RCE via file upload.

Detects GraphQL injection vulnerabilities by identifying unsafe construction of GraphQL operation documents from user input. Uses a three-phase approach: recon, batched verify, and merge to produce a findings report.

Detects hardcoded API keys, tokens, passwords, and other secrets in publicly accessible code. Uses a three-phase approach (recon, verify, merge) to identify real secrets in frontend JavaScript, mobile apps, and client-side bundles. Ideal for security assessments.

Detect insecure JSON Web Token (JWT) implementations in codebases by analyzing token issuance and verification patterns. Use to find token forgery, algorithm confusion, weak secrets, missing signature checks, and misconfigured claim validation.

Detects endpoints lacking authentication or proper role checks (vertical privilege escalation) in source code via a three-phase analysis. Use for identifying unauthenticated access and unauthorized admin function invocation.

Detects path traversal vulnerabilities in a codebase using a three-phase approach: recon, batched verify, and merge. Use when asked to find path traversal, directory traversal, or file disclosure bugs.

Guides preparation of AAAI artifact packages (code, data, appendices) that meet double-blind and reproducibility requirements, helping reviewers verify claims without identity leaks or missing dependencies.

Audit AAAI experiment designs before submission to ensure empirical evidence supports AI claims, with baselines, ablations, statistical significance, reproducibility checklist alignment, and broader review requirements.

Audit AAAI paper reproducibility: map claims to evidence, verify checklists, test artifact dry-runs, and address reviewer pushback on rigor.