What problem does it solve? Security testers need a disciplined, evidence-gated method to assess password reset and account recovery flows without guessing tokens, spamming reset emails, or touching third-party accounts. This Skill enforces a safe, scoped methodology for finding real recovery flaws. ## Core Features & Use Cases - Full State-Machine Mapping: Records the complete request → issuance → delivery → confirmation → password set → session revoke lifecycle using two self-owned accounts. - Token Binding & Lifecycle Checks: Verifies subject binding, single-use, expiry, revocation, and rate/enumeration defenses of reset tokens and recovery codes. - Minimal Safe Validation: Replays only self-obtained consumed or revoked tokens and runs small valid/invalid email differentials, with explicit stop conditions for third parties or irreversible side effects. - Use Case: During an authorized web app assessment, use this Skill to test whether a consumed reset token remains valid or whether a token is incorrectly bound across your own two test accounts, then route confirmed takeover findings to triage. ## Quick Start Ask the agent to run the password recovery hunt route against my authorized test application using my two self-owned accounts and report any token binding or revocation flaws.
