What problem does it solve? Security testers often finish reconnaissance with a large endpoint inventory but no structured way to decide what to test first. This Skill converts Cartographer or threat-model outputs into ranked, falsifiable vulnerability hypotheses without executing any attacks, so testing stays evidence-driven and scoped. ## Core Features & Use Cases - Invariant-Based Hypothesis Generation: Maps endpoints, roles, tenants, and trust boundaries to security invariants (BOLA, BFLA, tenant isolation, CSRF, webhook verification, and more) and produces falsifiable hypotheses with control, mutation, and expected secure behavior. - Ranked Executor Queue: Outputs hypothesis_queue.json and hypothesis_queue.md prioritized by crown-jewel proximity, trust boundary, and evidence completeness, plus ready-to-copy executor and judge agent prompts. - Coverage Gap Tracking: Writes coverage_gaps.json and manual_validation_required.md listing exactly which accounts, tenants, or object pairs are missing before reliable testing can begin. - Use Case: After running recon on a multi-tenant SaaS target, feed notes/{target}/recon-data/endpoint_inventory.json into this Skill to produce a prioritized queue of cross-tenant, RBAC, and authorization hypotheses for a bounded executor agent. ## Quick Start Generate a hypothesis queue from the endpoint inventory at notes/my-target/recon-data/endpoint_inventory.json for target my-target.
