What problem does it solve? Authorization bugs often hide where a restriction exists in one channel but not another — a UI block that the API ignores, an invitation accepted by an unverified account, or a password-reset flow whose context is not bound to the right user. This Skill gives security researchers a systematic method to find those generic access-control failures on in-scope bug bounty targets. ## Core Features & Use Cases - Authorization Matrix Testing: Build controlled LOW/ADMIN users across tenants and vary one predicate at a time to expose missing server-side policy enforcement. - Channel-Parity and Lifecycle Tests: Replay actions across REST, GraphQL, API-key, and mobile endpoints, and probe invitation, suspension, SCIM/SSO provisioning, and password-reset state transitions. - Negative-Control Taxonomy: Apply 12 stop-condition categories with real HackerOne report anchors so you never file duplicates, expected behavior, or below-threshold findings. - Use Case: A program hides an admin action in the UI for free-plan users. Use this Skill to replay the backing mutation with an API-key credential, prove a durable unauthorized state change, and document a report-ready finding. ## Quick Start Ask the agent to run the access-control-hunter methodology against my authorized target, starting with a channel-parity test between the UI and the API-key endpoint.
