The Agent Skills Directory

[SAFE]: The skill provides clear instructions for auditing security vulnerabilities related to administrative access control. It follows best practices by explicitly advising against testing production environments or accounts not owned by the user. The methodology includes checking for common issues such as hardcoded credentials, broken object-level authorization (BOLA/IDOR), and mass assignment vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing untrusted data from a project's source code, API handlers, and route definitions. This constitutes an attack surface for indirect prompt injection if the audited files contain malicious instructions. However, the skill mitigates this risk by requiring the agent to use specific evidence labels (e.g., OBSERVED, SOURCE-INDICATED, DECLARED) to distinguish between actual behavior and claims made within the analyzed code, ensuring a more objective evaluation.

admin-authorization