detecting-broken-object-property-level-authorization
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes a Python testing script that uses the
requestslibrary to communicate with external API endpoints. It performs GET, POST, PUT, and PATCH requests to verify if an API incorrectly exposes sensitive properties or allows unauthorized field modifications. - [SAFE]: The script uses a dictionary of sensitive property patterns (e.g.,
password,ssn,api_key) to identify data exposure risks. This is a standard detection mechanism for security tooling. - [SAFE]: The skill provides legitimate mitigation strategies, including the use of explicit property allowlists and secure serialization patterns, which align with security best practices.
- [SAFE]: No evidence of prompt injection, obfuscation, or unauthorized data exfiltration was found. The network operations are restricted to the target API defined by the user during the security assessment.
Audit Metadata