Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-idnt-03
Test Account Provisioning Process
Passed 16 of 22 test cases with the skill, and 10 of 22 without it.
and 11 more in the full report
7 fixed9 passed either way5 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
I need to audit our company's user management and self-service invitation endpoints for authorization bypasses and privilege escalation risks. Please generate a testing methodology covering account creation, self-provisioning of API keys, bulk imports, and account modification. Format the output with clear testing steps, sample HTTP/JSON attack payloads, and Python Flask code snippets demonstrating proper authorization controls and approval workflows.
| Checked | Without skill | With skill |
|---|---|---|
| Includes JSON payloads manipulating role parameters or permissions attributes to request admin privileges. | Missed | Passed |
| Includes Python Flask remediation code checking if creator role level strictly exceeds target role level. | Missed | Passed |
| Includes approval workflow logic returning HTTP 202 for elevated role provisioning requests. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-IDNT-03
Test Account Provisioning Process
Account provisioning is the process by which user accounts are created, modified, and managed by administrators or automated systems. This test evaluates the security of the provisioning workflow, including how accounts are created, what privileges are assigned, and whether proper authorization is required. Weaknesses in provisioning can lead to unauthorized account creation, privilege escalation, and insider threats.
| Stage | Security Consideration |
|---|---|
| Creation | Who can create accounts? Authorization required? |
| Modification | Who can change roles/permissions? |
| Suspension | Process for disabling accounts |
| Deletion | Complete removal of access and data |
| Review | Regular access reviews conducted? |
test cases passed, vs 10 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.