What problem does it solve? Testing gRPC-based APIs for authorization flaws is difficult because service/method discovery, protobuf schemas, and metadata-based auth differ from REST conventions, and naive probing produces false positives or out-of-scope damage. This Skill provides an evidence-gated workflow to verify whether a low-privilege identity can invoke services or access objects it should not. ## Core Features & Use Cases - Protocol-Aware Discovery: Confirms transport, service/method names, protobuf or JSON schemas, metadata auth, and stream types from real client traffic instead of guessing from ports or headers. - Minimal Safe Validation: Runs single-variable metadata and message differentials against your own test methods and objects, comparing server responses, audit logs, and authoritative object read-backs. - Strict Oracle and Stop Rules: Treats WAF blocks, captchas, and transcoding errors as inconclusive, and halts on reflection sprawl, stream flooding, third-party data, or sensitive admin RPCs. - Use Case: During an authorized assessment of a microservices platform, use this Skill to verify whether a standard user token can invoke an admin-only gRPC method, capturing sanitized evidence for the report. ## Quick Start Use the hunt-grpc skill to plan an evidence-gated authorization test of our gRPC service endpoints within the declared scope.
