access-review

Name: access-review
Availability: InStock
Author: MindFort

Review authorization, access control, role boundaries, and tenant isolation.

16|2|Updated May 26, 2026

Search Tags:#authorization #access control #security review #tenant isolation #authorization issues

Ready to run

npx skills add https://github.com/mindfortai/security-skills --skill access-review-mindfortai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: access-review
Source: https://github.com/mindfortai/security-skills/tree/main/skills/access-review
Command: npx skills add https://github.com/mindfortai/security-skills --skill access-review-mindfortai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill performs in-depth security reviews to identify and mitigate issues in authorization, access control, role boundaries, and tenant isolation. It helps in detecting IDOR, BOLA, BFLA, privilege escalation, and other security vulnerabilities.

Core Features & Use Cases

Deep Security Reviews: Focuses on verifying whether users can access data and actions they are allowed to, including authorization checks for reads, writes, deletes, exports, and more.
Tenant and Identity Mapping: Provides guidelines to map tenant and identity models from schema, docs, and auth code for better control and testing.
Review Workflow: Includes a detailed step-by-step process for a thorough security audit, covering policy checks, authorization tracing, and more.

Quick Start

Run the access-review skill on your project directory to perform a security review of your authorization model.

Frequently Asked Questions about access-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I review authorization and access control for IDOR and BOLA vulnerabilities?▼

To review authorization and access control for IDOR and BOLA, this Skill performs deep security audits tracing read, write, and delete actions to verify users only access permitted data. It maps tenant boundaries to detect broken object or function level authorization.

What is the best way to test tenant isolation in a multi-tenant SaaS application?▼

Testing tenant isolation in a multi-tenant SaaS application requires mapping tenant and identity models from schema and auth code. This Skill provides guidelines to verify role boundaries and prevent unauthorized cross-tenant data access during security reviews.

How do I detect privilege escalation and BFLA issues in my API?▼

Detecting privilege escalation and BFLA issues in APIs involves tracing authorization checks across user actions. This Skill audits role boundaries and function level authorization to identify and mitigate unauthorized privilege escalation vulnerabilities.

Can I audit internal tools and marketplaces for unauthorized data access?▼

Yes, you can audit internal tools and marketplaces for unauthorized data access. This Skill applies security reviews to APIs, marketplaces, and internal tools, verifying that authorization policies prevent users from accessing restricted data and actions.

How do I trace authorization policies across my project codebase?▼

Tracing authorization policies across a project codebase requires a structured review workflow. This Skill includes a step-by-step process covering policy checks, identity mapping, and authorization tracing to ensure comprehensive access control verification.

When do I need a dedicated security review for access control?▼

A dedicated security review for access control is needed when building SaaS products, APIs, or multi-tenant systems to prevent unauthorized data access. It verifies role boundaries, tenant isolation, and authorization checks for all user actions.