admin-authorization

The most common critical bug in vibe-coded apps: /admin is "protected" because the link is hidden, and the API behind it answers anyone. This skill checks the server, where authorization actually lives.

Activate when

Any admin/staff/operator route or API exists (/admin, /dashboard/users, /api/admin/*, role fields, "isAdmin" checks), or roles/permissions exist.
production-all/web-security routes here.
Not to design admin features (that is admin-dashboard, which calls this skill for access control). If the only "admin" is the database console, say so.

Inspect

Enumerate privileged surfaces from routes, API handlers, server actions, database policies, and UI conditionals: user management, content moderation, refunds, exports, impersonation, feature flags, settings, data deletion, "run job" endpoints, internal tools.
For each, find the check: authentication (who are you?) and authorization (may you do this on this object?) executed on the server at the handler, middleware, or database policy. Client-side route guards, hidden links, if (user.isAdmin) in React, and obscure URLs are not authorization.
Roles and grants: where roles come from (database column, JWT claim, provider metadata); can a user modify their own role via any endpoint (mass assignment: PATCH /api/me accepting role)? First-user-becomes-admin logic; default/seed admins with default passwords; invite/reset flows for staff.
Object-level access: an admin's or user's request for another resource ID (/api/orders/123); listing endpoints returning all users' data to non-admins; database row-level security present for tables holding admin-only or per-user data.
Test on local/staging (never against production or other people's accounts): request each privileged route/API (a) with no session, (b) with a normal test user, (c) with an admin test user. Expect (a) and (b) denied (401/403, not a 200 with empty data and not a redirect that still leaks data), (c) allowed. Also try direct API calls that bypass the UI, and ID substitution.
Discoverability: admin routes not in the sitemap or robots.txt as a hint (seo-readiness); consistent noindex; login page protections: rate limiting, no user enumeration, MFA where the product warrants.
Sensitive destructive actions: confirmation, and an audit trail (admin-audit-log).