Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →archive228/authz-check
Verify that an endpoint checks ownership, not just authentication.
Passed 22 of 22 test cases with the skill, and 20 of 22 without it.
2 fixed20 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
Analyze this e-commerce endpoint: ```python @app.route('/cart/item/delete', methods=['POST']) def delete_cart_item(): user_id = session.get('user_id') if not user_id: return jsonify({'error': 'Login required'}), 401 item_id = request.json.get('item_id') db.execute('DELETE FROM cart_items WHERE id = %s', (item_id,)) return jsonify({'status': 'removed'}) ``` State the missing safety constraint.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies that deletion lacks scoping to the authenticated user's cart | Missed | Passed |
The instructions your model reads when the skill loads.
The most common security hole: the code checks you're logged IN, but not that you OWN the thing.
WHERE id = ? AND owner_id = current_user — not just WHERE id = ?.test cases passed, vs 20 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.