Rhodawk Agent
feat(v6): Masterplan build — semantic skill selector, 84 skills, night-hunt orchestrator, OpenClaw gateway, 12 MCP servers, developer playbook
58fe8fa | name: deserialization-python | |
| domain: web | |
| triggers: | |
| languages: [python] | |
| severity_focus: [P1, P2, P3] | |
| # deserialization-python | |
| Python deser: pickle (any unpickle of untrusted data is RCE), PyYAML yaml.load() pre-5.1, marshal, jsonpickle, dill. Detection: any *.load(...) on user-controlled bytes. | |
| ## Detection checklist | |
| - enumerate exposure | |
| - match canonical sinks | |
| - confirm reproducibility | |
| - map to CWE / OWASP / CVSS | |
| ## Exploitation primitives | |
| - reproduce in lab | |
| - minimise the PoC | |
| - assess blast radius | |
| ## Reporting fingerprint | |
| - include affected version range | |
| - include suggested fix snippet | |
| - include CVSS 3.1 vector | |