Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-athn-08
Testing for Weak Security Question Answer
Passed 20 of 22 test cases with the skill, and 17 of 22 without it.
3 fixed17 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
A web application vulnerability assessment report assigns CVSS 4.3 to a finding where password recovery relies on a single easily guessable security question like favorite color. What standard CVSS v3.1 base score should be assigned to a single easily guessable security question finding?
| Checked | Without skill | With skill |
|---|---|---|
| The response specifies a CVSS base score of 8.8 for a single easily guessable security question. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-ATHN-08
Testing for Weak Security Question Answer
Security questions are often used as a secondary authentication mechanism for password recovery. This test evaluates whether security questions provide adequate protection or are vulnerable to guessing, research, or social engineering attacks. Weak security questions can allow attackers to bypass authentication entirely by providing easily guessable or publicly available answers.
| Category | Risk Level |
|---|---|
| Mother's maiden name | High (public records) |
| Pet's name | High (social media) |
| School name | High (LinkedIn) |
| City of birth | High (public) |
| Favorite color | High (limited options) |
| Custom questions | Low-Medium |
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.