access-control

Analyze source code for broken access control vulnerabilities.

12|1|Updated Feb 9, 2026

Search Tags:#authorization #security #owasp #access control #vulnerability scanning #idor

Ready to run

npx skills add https://github.com/florianbuetow/claude-code --skill access-control-florianbuetow

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: access-control
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/access-control
Command: npx skills add https://github.com/florianbuetow/claude-code --skill access-control-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies and helps you fix critical security vulnerabilities related to how users and systems access resources, preventing unauthorized data exposure and manipulation.

Core Features & Use Cases

Vulnerability Detection: Scans code for common access control weaknesses like IDOR, missing authorization, and CORS misconfigurations.
Security Auditing: Maps findings to OWASP Top 10 and CWE standards for comprehensive security assessment.
Use Case: You've just deployed a new API. Run this Skill to ensure that only authenticated and authorized users can access sensitive endpoints and data, preventing breaches before they happen.

Quick Start

Use the access-control skill to analyze the current codebase for broken access control vulnerabilities.

Frequently Asked Questions about access-control

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan source code for broken access control vulnerabilities?▼

Scanning for broken access control vulnerabilities involves analyzing source code to identify missing authorization checks, insecure direct object references, and CORS misconfigurations. This process maps findings to OWASP Top 10 2021 A01 standards.

How do I detect IDOR and privilege escalation issues in my codebase?▼

Detecting IDOR and privilege escalation issues requires analyzing source code paths for missing authorization checks and insecure direct object references. Scanners like semgrep, bandit, and brakeman can identify these vulnerabilities during security auditing.

What is broken access control in the context of OWASP Top 10?▼

Broken access control, mapped to OWASP Top 10 2021 A01, encompasses security flaws where users access resources or perform actions outside their intended permissions. This includes missing authorization checks, JWT manipulation, and directory traversal.

Does this access control analyzer work with semgrep, bandit, and brakeman?▼

Yes, this access control analyzer supports integration with various scanners including semgrep, bandit, and brakeman. It leverages these tools to detect missing authorization, CORS misconfigurations, and other vulnerabilities mapped to CWE standards.

Can I audit my API endpoints for CORS misconfiguration and JWT manipulation?▼

Auditing API endpoints for CORS misconfiguration and JWT manipulation involves scanning the source code for insecure implementations. This identifies unauthorized data exposure risks by mapping findings to OWASP Top 10 and CWE standards.