/vuln-chain

Three-phase security analysis that finds not just individual vulnerabilities — but how they chain into critical impact.

A single IDOR is medium severity. An IDOR + a missing rate limit + a leaked JWT = account takeover. That's what this skill finds.

Usage

/vuln-chain                          → analyze current repo/codebase
/vuln-chain <path>                   → analyze specific directory or file
/vuln-chain <url>                    → analyze a web endpoint or API
/vuln-chain --quick                  → Phase 1 only (individual findings, no chain synthesis)
/vuln-chain --depth critical         → only report chains that reach critical severity

When to Use

• Before merging a PR that touches auth, payments, or data access
• Auditing a new API surface you didn't write
• When individual scanners return "all clear" but something feels off
• After a dependency update in a security-sensitive path
• Preparing for a real penetration test engagement

When NOT to Use

• Simple "does this code have XSS" — use /code-review or security-reviewer agent directly
• Production live exploit attempt — this is analysis only
• Static linting — use ESLint/Bandit instead

---

Three Phases

Phase 1 — Parallel Recon (4 agents in parallel)

Four specialized agents run simultaneously, each with a narrow lens:

Agent	Focus	OWASP Coverage
Surface Scout	Entry points: routes, endpoints, inputs, file uploads	A1 Broken Access Control
Auth Auditor	Authentication & authorization: JWT, sessions, RBAC, OAuth flows	A2 Cryptographic Failures, A7 Auth Failures
Data Flow Tracer	How data moves: injection sinks, serialization, query building	A3 Injection, A8 Integrity Failures
Config Inspector	Environment, secrets, dependencies, headers, CORS, CSP	A5 Misconfiguration, A6 Vulnerable Components

Each agent returns: [finding_id, location, severity (Low/Med/High), description, evidence]

Phase 2 — Chain Synthesis (1 agent, reads all Phase 1 output)

The Chain Synthesizer receives all Phase 1 findings and answers:

"Which of these findings, if combined, produce a higher-severity impact than any individual finding alone?"

It explicitly looks for:

Auth bypass + Data exposure       → Account takeover
SSRF + Cloud metadata endpoint    → Credential theft
IDOR + Mass assignment            → Privilege escalation
XSS + CSRF + Missing SameSite     → Session hijack
Insecure deserialization + RCE    → Full compromise
Path traversal + File write       → Backdoor installation
Open redirect + OAuth             → Token theft

Output per chain:

• Chain path: Finding A → Finding B → Impact
• Combined severity: what it becomes when chained
• Exploitability: how many steps an attacker needs
• Proof-of-concept sketch: what the attack would look like

Phase 3 — Remediation Priority

Prioritized fix list sorted by:

1. Chains that reach Critical — fix before any deploy
2. Chains that reach High — fix this sprint
3. Individual High findings with no chain
4. Individual Medium/Low findings

Each fix includes: specific code location, recommended change, and a test to verify the fix.

---

Output Format

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  VULN CHAIN REPORT  ·  [target]  ·  [timestamp]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

CHAINS FOUND: N critical / N high / N medium

── CHAIN #1  [CRITICAL] ──────────────────────────
  Path:   Finding #3 (IDOR) → Finding #7 (Mass assign) → Privilege escalation
  Impact: Any authenticated user can elevate to admin
  Steps:  2 (trivially exploitable)
  PoC:    PATCH /api/users/:id {"role":"admin"} with any valid session token
  Fix:    [file:line] Add ownership check before PATCH handler

── INDIVIDUAL FINDINGS ───────────────────────────
  #1 [High]   Missing rate limit on /api/auth/login  →  Brute force
  #2 [Medium] JWT HS256 with weak secret             →  Token forgery
  ...

── REMEDIATION QUEUE ─────────────────────────────
  BEFORE DEPLOY:  Chain #1, Chain #2
  THIS SPRINT:    Finding #1, #5
  BACKLOG:        Finding #2, #4, #8

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

---

Execution Protocol

Step 1  Read target (codebase, URL, or path provided by user)
Step 2  Spawn 4 Phase 1 agents in PARALLEL — do not wait for one before starting others
Step 3  Collect all Phase 1 findings into a unified list
Step 4  Pass unified list to Chain Synthesizer (single agent, serial)
Step 5  Chain Synthesizer produces chain report + individual findings list
Step 6  Generate Remediation Queue sorted by combined severity
Step 7  Present full report in the output format above

Never skip Phase 2 unless --quick flag is passed. Individual findings without chain analysis miss the most critical compound risks.

---

Anti-Fake-Pass Checks

❌ DO NOT report "no vulnerabilities found" without evidence from all 4 Phase 1 agents
❌ DO NOT mark a chain as Critical without stating the specific PoC attack path
❌ DO NOT list findings without file:line location references
❌ DO NOT skip Phase 2 chain synthesis (most important phase — where Strix's insight lives)
❌ DO NOT merge findings from different phases without labeling which phase found each
❌ DO NOT confuse "no chain" with "safe" — a single High finding still needs remediation

Do NOT use for

• Writing actual exploits or malware (use authorized pentesting tools with explicit permission)
• Scanning systems you don't own (analysis only — on code/APIs you control)
• Replacing a real security audit for regulated industries (SOC 2, HIPAA, PCI DSS)
• See also: security-reviewer agent (per-file review), agentshield-security-scanner (pattern scanning)