Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-athn-10
Testing for Weaker Authentication in Alternative Channel
Passed 12 of 23 test cases with the skill, and 12 of 23 without it.
1 fixed15 passed either way7 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
If a main web login caps failed attempts at 5 per minute but its corresponding mobile API endpoint permits unlimited automated attempts, what CVSS severity score applies to this missing rate limit on the API channel?
| Checked | Without skill | With skill |
|---|---|---|
| The response assigns a CVSS score of 7.5 with High severity for unthrottled API authentication. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-ATHN-10
Testing for Weaker Authentication in Alternative Channel
Many applications provide multiple access channels (web, mobile, API, legacy interfaces) that may have inconsistent authentication controls. This test identifies scenarios where alternative channels have weaker security than the primary channel, potentially allowing attackers to bypass stronger controls by using a less secure path to the same functionality.
| Channel | Potential Weakness |
|---|---|
| Mobile API | No 2FA, weaker rate limiting |
| Legacy interface | Old auth mechanisms |
| Internal API | No auth assumed |
| Partner API | API key only |
| Dev/staging | Default credentials |
test cases passed, vs 12 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.