exploiting-broken-function-level-authorization

This skill is purpose-aligned but high risk: it equips an AI agent with offensive API exploitation procedures and automates destructive privileged actions using real credentials. There is no clear exfiltration or malware behavior, but the capability itself is dangerous and should be treated as a high-risk security testing skill requiring strict authorization and human oversight.

The code is a dual-use API authorization scanner, not apparent malware. It performs network probing against an operator-supplied target and can send potentially destructive HTTP methods. The explicit verify=False setting creates a significant transport-security weakness, and command-line token handling can expose credentials locally. Findings may be inaccurate because any status below 400 is classified as authorized access. The shown ending also appears syntactically incomplete. Use only against authorized systems, enable TLS verification, and restrict or confirm state-changing requests.