What problem does it solve? Security testers need a controlled, evidence-based way to verify whether regular expressions, parsers, or input handlers cause measurable server-side resource exhaustion, without risking production availability or producing inconclusive results. ## Core Features & Use Cases - Engagement Gating: Enforces written authorization, locked scope, baselines, and stop thresholds before any probe is sent. - Minimal Safe Validation: Uses pre-approved tiny input gradients and single requests, comparing server-side latency, CPU, and error rates against baselines with immediate abort on threshold breach. - Oracle & False-Positive Filtering: Distinguishes genuine disproportionate resource growth from network jitter, WAF interference, or client-side timing artifacts. - Use Case: During an authorized assessment, you suspect a regex validation endpoint is vulnerable to catastrophic backtracking. The skill guides you to reproduce it offline first, then run a single-variable probe inside the approved performance window, capturing monitoring timelines as evidence. ## Quick Start Use the hunt-redos skill to plan an evidence-gated validation of a suspected ReDoS issue on an authorized target.
