Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →utkusen/sast-missingauth
Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/mis
Passed 16 of 20 test cases with the skill, and 9 of 20 without it.
and 8 more in the full report
8 fixed10 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
After merging all `sast/missingauth-batch-*.md` files into `sast/missingauth-results.md`, what should happen to `sast/missingauth-recon.md` and the batch markdown files?
| Checked | Without skill | With skill |
|---|---|---|
| Deletes sast/missingauth-recon.md upon completing the merged report. | Missed | Passed |
| Deletes all sast/missingauth-batch-*.md files upon completing the merged report. | Passed | Passed |
The instructions your model reads when the skill loads.
You are performing a focused security assessment to find missing authentication and broken function-level authorization vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: recon (map endpoints and the permission system), batched verify (check authentication and authorization in parallel batches of 3 endpoints each), and merge (consolidate batch results into the final report).
Prerequisites: sast/architecture.md must exist. Run the analysis skill first if it doesn't.
An endpoint performs a sensitive action but requires no login at all — any anonymous HTTP request can trigger it.
An endpoint requires authentication (user must be logged in) but does not check whether the authenticated user has the required role or permission to invoke that function. The classic example: a regular user calling an admin-only API.
Do not conflate with:
The endpoint modifies data, returns private information, or performs an administrative action — with no authentication required.
GET /api/admin/users → returns full user list, no token needed
DELETE /api/admin/users/5 → deletes a user, no token needed
POST /api/settings/smtp → updates server config, no token needed
The endpoint requires a valid session/token but performs no role or permission check. Any authenticated user — regardless of role — can invoke admin or privileged functions.
test cases passed, vs 9 / 20 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.