How do I install the Pentest Authentication Authorization Review skill?

Run npx skillmds@latest add crtvrffnrt/pentest-authentication-authorization-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pentest Authentication Authorization Review safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pentest Authentication Authorization Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pentest Authentication Authorization Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pentest Authentication Authorization Review?

crtvrffnrt (@crtvrffnrt) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pentest Authentication Authorization Review by crtvrffnrt

Name: Pentest Authentication Authorization Review
Author: crtvrffnrt

Pentest Authentication Authorization Review

Authentication and authorization security assessment for sessions, tokens, MFA, account takeover, IDOR, BOLA, BFLA, privilege escalation, tenant isolation, and identity boundary validation. Hands off to recon, input/protocol, access-control deep dive, exploit, or reporting workflows when those become the owner phase.

crtvrffnrt Updated Sep 17, 2026

File contents

Authentication & Authorization Review

Use When

Session replay, token lifecycle, MFA behavior, account takeover, tenant isolation, or identity-boundary validation is the main question.
The task needs paired-role testing for object, function, or workflow authorization.
The next step is to distinguish authentication failure from authorization failure.

Handoff Criteria

Hand off to pentest-advanced-access-control-auditor for a deep IDOR, BOLA, BFLA, RBAC, or ownership test matrix.
Hand off to pentest-input-protocol-manipulation when parser behavior or request mutation becomes the owner blocker.
Hand off to pentest-evidence-structuring-report-synthesis when live validation is complete.

Output Schema

Access-control matrix: actor, resource, action, expected, observed
Session/token lifecycle findings: issued, replayed, revoked, result
Confirmed boundary breaks with attacker capability statement

Instructions

Define identity roles and expected permissions before testing.
Validate both horizontal and vertical boundaries with paired-role comparisons.
Test session and token invalidation across interfaces and time windows.
Confirm authorization at object, function, and workflow levels.
Distinguish authentication weakness from authorization weakness in output.
Escalate only confirmed boundary failures into exploit chaining.

Verification Gate

Use explicit role-to-action test cases.
Capture full evidence for accepted and denied control paths.
Verify revocation behavior, not just issuance behavior.
Do not infer access-control findings from UI behavior alone.
Do not conflate missing data with denied access.
Mark privilege escalation only with deterministic proof of a crossed boundary.

Situational Awareness

Cross-check high-impact authz claims with an alternate role, alternate object, alternate method, or alternate interface.
Track confirmed, rejected, and unknown role/action pairs separately.

---name: pentest-authentication-authorization-reviewdescription: Authentication and authorization security assessment for sessions, tokens, MFA, account takeover, IDOR, BOLA, BFLA, privilege escalation, tenant isolation, and identity boundary validation. Hands off to recon, input/protocol, access-control deep dive, exploit, or reporting workflows when those become the owner phase.---# Authentication & Authorization Review## Use When- Session replay, token lifecycle, MFA behavior, account takeover, tenant isolation, or identity-boundary validation is the main question.- The task needs paired-role testing for object, function, or workflow authorization.- The next step is to distinguish authentication failure from authorization failure.## Handoff Criteria- Hand off to `pentest-advanced-access-control-auditor` for a deep IDOR, BOLA, BFLA, RBAC, or ownership test matrix.- Hand off to `pentest-input-protocol-manipulation` when parser behavior or request mutation becomes the owner blocker.- Hand off to `pentest-evidence-structuring-report-synthesis` when live validation is complete.## Output Schema- Access-control matrix: `actor`, `resource`, `action`, `expected`, `observed`- Session/token lifecycle findings: `issued`, `replayed`, `revoked`, `result`- Confirmed boundary breaks with attacker capability statement## Instructions1. Define identity roles and expected permissions before testing.2. Validate both horizontal and vertical boundaries with paired-role comparisons.3. Test session and token invalidation across interfaces and time windows.4. Confirm authorization at object, function, and workflow levels.5. Distinguish authentication weakness from authorization weakness in output.6. Escalate only confirmed boundary failures into exploit chaining.## Verification Gate- Use explicit role-to-action test cases.- Capture full evidence for accepted and denied control paths.- Verify revocation behavior, not just issuance behavior.- Do not infer access-control findings from UI behavior alone.- Do not conflate missing data with denied access.- Mark privilege escalation only with deterministic proof of a crossed boundary.## Situational Awareness- Cross-check high-impact authz claims with an alternate role, alternate object, alternate method, or alternate interface.- Track confirmed, rejected, and unknown role/action pairs separately.

Frequently asked questions