Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1627_execution-guardrails
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
Passed 20 of 23 test cases with the skill, and 8 of 23 without it.
and 16 more in the full report
12 fixed8 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 12 test cases the skill fixed. Same model, same prompt, with and without the skill.
Security operations managers are reviewing an automated scanner report that tagged a mobile payload checking target environment values. What exact ATT&CK Mobile technique ID should be recorded in the ticket?
| Checked | Without skill | With skill |
|---|---|---|
| Records MITRE ATT&CK Mobile ID T1627. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include environment information such as location.
Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical System Checks. While use of System Checks may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.
Platforms: Android, iOS
Determine if the target mobile environment is susceptible to Execution Guardrails by examining the target platforms (Android, iOS).
Review whether mitigations for T1627 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
New OS releases frequently contain additional limitations or controls around device location access.
test cases passed, vs 8 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.