What you are holding
Match the thing in front of you to one skill. The tool is the second click. Pasted scope stays in the browser.
| You have | Skill | Hunt | Tool | Next |
|---|---|---|---|---|
| Saved JavaScript | JavaScript and client trust | XSS hunting | jsluice | Read the bundle you already saved. A match is not execution. |
| Two accounts you own | Access control and tenant boundaries | IDOR and broken authorization | Burp Suite | Replay one account's object id with the other account's session. |
| A webhook you can send | Access control and tenant boundaries | Webhook authenticity | Burp Suite | Check the signature when the header is absent. A URL the server fetches belongs on the SSRF brief. |
| A workflow file | CI and dependency trust | Supply chain and CI | zizmor | Read the file you already have. Do not run it. |
A pasted host list is sorted in the browser at Utilities, scope sort. That page does not send the list to the hosted MCP.
Coverage shows which classes still have no skill, checklist, or disclosure card.