Results for “authorization-testing”

12 skills

idor-vulnerability-testing

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.

More results

jrennie99-glitch

Claims-based authorization for agents and operations. Grant, revoke, and verify permissions for secure multi-agent coordination. Use when: permission management, access control, secure operations, authorization checks. Skip when: open access, no security requirements, single-agent local work.

input-validation

`analysis-agent`/`task-agent`/`review-agent`: use for input authority, parsing, canonicalization, bounds, state checks, writable fields, rejection, or external-response changes.

quality-test-gate

Use `analysis-agent` to map acceptance to validation, `task-agent` to add or run bounded tests, and `review-agent` to assess proof coverage. Skip work with no material change or already-fresh complete validation.

skill-security-auditor

Scan and audit AI agent skills for security risks before installation, producing a PASS/WARN/FAIL verdict with findings and remediation guidance.

20.4k · bundle

Conduct authorized security assessments of LLM applications and AI agents, covering prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

12.8k · bundle

integration-testing

`analysis-agent`/`task-agent`/`review-agent`: use for database, broker, cache, HTTP, framework, process, or transaction seam proof; skip local, portfolio, and release-verdict work.

auth-strategy-designer

Design authentication and authorization strategy for a product or MVP. Use when the team needs sign-in methods, session model, user/workspace membership, roles, tenant boundaries, invitation flows, or permission enforcement plans.

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every techniqu

Static OWASP review of app code (injection, headers, deps). Use when "review security" or "check vulnerabilities". Session/route×gate/getSession → audit-auth-flows. Plan-only burndown → plan-security-audit. Table RLS → plan-rls-audit. LLM attacks → audit-llm-security.

authentication-security

Use with analysis-agent, task-agent, or review-agent for task-local authentication lifecycle and recovery risk. Do not use without that decision or as task owner.

security-privacy-gate

Use `analysis-agent` to analyze permissions, secrets, sensitive data, trust boundaries, and injection; `task-agent` to implement controls; and `review-agent` to assess evidence. Skip self-review and no-trust-impact work.