What problem does it solve? It provides a disciplined, evidence-gated procedure for testing whether template, include, or language file parameters can escape the controlled include root, without reading real sensitive files or producing false positives. ## Core Features & Use Cases - Engagement Gating: Runs only when authorization and scope are locked, and defers to the blackbox-vuln-orchestrator for current action recommendations. - Controlled Marker Testing: Uses self-created markers inside and outside the include root, changing one include semantic at a time (template name, relative reference, alias, loader prefix). - False-Positive Oracle: Treats captchas, WAF blocks, error pages, and 404s as inconclusive, requiring reproducible access to an out-of-root self-owned marker as valid proof. - Use Case: During an authorized web assessment, a tester suspects the template_name parameter crosses the include root; the skill guides baseline setup, single-variable probes, evidence capture, and routing to hunt-path-traversal or hunt-rce when appropriate. ## Quick Start Ask the agent to run the hunt-lfi procedure against the in-scope template parameter and report whether the include root boundary holds.
