hunting-mutual-tls-and-service-identity-gaps SKILL.md skillA
hunting-mutual-tls-and-service-identity-gaps from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/hunting-mutual-tls-and-service-identity-gaps@git:20260829.b60f9b2Pins git:20260829.b60f9b2 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/hunting-mutual-tls-and-service-identity-gaps/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260829.b60f9b2, committed Aug 29, 2026
- Size
- 10,288 bytes
- Repository stars
- 26
- License
- MIT
Hunt for gaps in how a service establishes and verifies the identity of the peer calling it: a mutual-TLS endpoint that requests a client certificate but does not require or verify it, verification that checks the certificate chains to a trusted authority but never checks which identity it names, a trust anchor broad enough that any certificate it issued is accepted as any service, and an identity derived from a spoofable attribute (a header, a source IP) instead of the verified certificate.…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Hunting mutual TLS and service identity gaps: proving which service is on the other end Service-to-service authentication with mutual TLS rests on a chain of checks, and skipping any one of them leaves the caller's identity unproven while the connection still looks encrypted and authenticated. The endpoint has to actually require a client certificate, not merely request one and proceed without it. It has to verify the certificate is valid and chains to a trusted authority. Crucially, it then has to check which identity the certificate names and that this identity is authorized for the call, verifying the chain proves the certificate is legitimate, not that it belongs to the right service. And the trust anchor matters: if the service accepts any certificate issued by a broad authority, then any peer that authority ever issued a certificate to can authenticate as any service. When identity is instead taken from a header or source IP, it is spoofable and the certificate is decorative. The hunt is for the missing link in that chain. You hunt this by presenting the wrong certificate, no certificate, and a valid-but-wrong-identity certificate and seeing what authenticates. …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/hunting-mutual-tls-and-service-identity-gaps@sha256:9ecc0bd1b54c6ddfThe line at the top of this page pins the label git:20260829.b60f9b2, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_ftld4qd6qhbwqzvz)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 29, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10288 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_ftld4qd6qhbwqzvz GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/hunting-mutual-tls-and-service-identity-gaps GET https://markdownregistry.com/api/v1/blob/9ecc0bd1b54c6ddf8a7f8130d95eeb7c8d500a8a5c8ed5b5baaf38db0b7bf1f4
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.