What problem does it solve? Most bug bounty candidates die not from detection failures but from assumption-analysis failures: the behavior is real but has no impact, a compensating control holds, or the behavior is intended design. This Skill front-loads that analysis so weak candidates are closed in minutes instead of after a full PoC and report draft. ## Core Features & Use Cases - Assumption ledger: Enumerate the implicit contract behind each trust boundary (reachability, upstream validation, identifier secrecy, caller identity, parser agreement, execution context) and rank entries by impact if false. - Design-intent and control checks: Verify whether a behavior is deliberate and documented, name the primary control actually holding the boundary, and test whether breaking the assumption grants anything beyond the attacker's starting privilege. - Hunter routing: Route surviving assumptions to the matching vulnerability-class hunter (access control, IDOR, SSRF, path traversal, business logic, privilege escalation) for dynamic proof. - Use Case: After recon surfaces an exported Android component, build an assumption ledger, discover the path-sandbox assumption is defended by an unnamed control, close it as control_held, and route only the caller-identity assumption to the auth-bypass hunter. ## Quick Start Run the break-assumptions analysis on the current target's recon output and write a ranked assumption ledger to the target's notes directory.
