Authorization & Scope Notice: This skill is part of the REA_Skill + claude-red Unified Security & Reverse Engineering Suite. It is designed strictly for authorized security assessments, defensive architecture reviews, vulnerability triage, bug bounty verification, and remediation engineering on software, infrastructure, and assets you own or have explicit permission to test.

1. Surface & Architecture Inventory
   • Identify all entrypoints, trust boundaries, parsers, and configuration files relevant to HTTP Parameter Pollution (HPP) (

     web

     domain).
   • Combine static code/binary inspection (via REA MCP tools,

     rg

     , AST analysis, or decompilation) with runtime configuration verification.
2. Hypothesis & Vulnerability Verification
   • Test each security invariant systematically against known CWE and OWASP patterns.
   • Record concrete evidence: affected file/procedure, line numbers or binary offsets, request/response trace, and root cause.
3. Impact & Reachability Triage
   • Evaluate whether the issue is reachable across trust boundaries, whether defense-in-depth controls mitigate it, and compute an accurate CVSS v3.1 / v4.0 score.
4. Remediation & Regression Verification
   • Implement or provide production-ready, copy-pasteable remediation code.
   • Write an automated regression test or verification command to prove the flaw is resolved with 0 regressions.

• Static & Binary Analysis: Pair with

  rea-universal-orchestrator

  ,

  rea-binary-disassembly

  ,

  rea-web-bundle-recovery

  , or

  rea-mobile-app-recovery

  when source code is unavailable.
• Interactive Scoping: Invoke

  /rea-grill-me

  before large-scale assessments to clarify scope, target environments, and acceptance criteria.
• Reporting: Pair with

  offensive-reporting

  to format findings with CVSS vectors, CWE mappings, and remediation patches.