Sign in Get started

00-red-team - Skill - OpenSmartRoute

Skillv1.0.0

00-red-team

Red Team — adversarial API and security review (advisory)

by ubc(0) 0 installs

Free

Sign in to install

Free account. Installing gives you the manifest plus copy-paste snippets.

About

Instruction file imported from ubc/tlef-engeai (.cursor/rules/red-teams/00-red-team.mdc). Copyright stays with the author.

Red Team

Act as adversary: probe APIs, auth boundaries, data leaks. Advisory only — do not block merge; output findings.

Output

planner/red-team-<slug>-<date>.md:

Scope (files/endpoints reviewed)
Findings (severity: critical / high / medium / low)
Exploit or misuse scenario
Suggested mitigation

Focus areas

Unauthenticated or wrong-role API access
IDOR on course/chat/user resources
Monitor/export/backup data exposure
Session fixation / cookie flags across envs
Admin reset endpoints
Prompt injection affecting server behavior
Student PUID or private data in student-facing responses or logs

Methods

Trace documents/ENDPOINT_ARCHITECTURE.md RBAC vs actual route middleware
curl/httpie scenarios (read-only where possible)
Do not run destructive admin resets without explicit human approval

Trigger

Orchestrator invokes on essentially all non-trivial changes; scope to handoff file list.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/ubc-tlef-engeai-00-red-team-rule/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

ubc-tlef-engeai-00-red-team-rule.ocm.jsonjson

{
  "ocm": "1",
  "id": "ubc-tlef-engeai-00-red-team-rule",
  "kind": "skill",
  "name": "00-red-team",
  "description": "Red Team — adversarial API and security review (advisory)",
  "publisher": "ubc",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "github-cursor-rules"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Red Team — adversarial API and security review (advisory)"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github-cursor-rules",
      "repository": "https://github.com/ubc/tlef-engeai",
      "path": ".cursor/rules/red-teams/00-red-team.mdc",
      "ref": "b8424bc1cff4a58abf78fe36b7b4f4e84a073bc0",
      "url": "https://github.com/ubc/tlef-engeai/blob/b8424bc1cff4a58abf78fe36b7b4f4e84a073bc0/.cursor/rules/red-teams/00-red-team.mdc",
      "key": "ubc/tlef-engeai/.cursor/rules/red-teams/00-red-team.mdc"
    }
  },
  "instructions": "# Red Team\n\nAct as adversary: probe APIs, auth boundaries, data leaks. **Advisory only** — do not block merge; output findings.\n\n## Output\n\n`planner/red-team-<slug>-<date>.md`:\n\n- Scope (files/endpoints reviewed)\n- Findings (severity: critical / high / medium / low)\n- Exploit or misuse scenario\n- Suggested mitigation\n\n## Focus areas\n\n- Unauthenticated or wrong-role API access\n- IDOR on course/chat/user resources\n- Monitor/export/backup data exposure\n- Session fixation / cookie flags across envs\n- Admin reset endpoints\n- Prompt injection affecting server behavior\n- Student PUID or private data ",
  "cost": {
    "context_tokens": 237
  }
}

Fetch it by URL: GET /api/v1/registry/ubc-tlef-engeai-00-red-team-rule/manifest?version=1.0.0