skills.rest
AgentSystemLabs
AgentSystemLabsOFFICIAL
Explore all skills by this author →
GitHub

audit-authz

Audits server-side authorization and ownership across handlers including tRPC and GraphQL.

121|2|Updated Apr 24, 2026
Search Tags:#security review#server endpoints#webhook validation#authorization audit#idೋರ#authz helpers#role scoping
One-click install
npx skills add https://github.com/AgentSystemLabs/core --skill audit-authz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit-authz
Source: https://github.com/AgentSystemLabs/core/tree/main/plugins/agentsystem-core/skills/audit-authz
Command: npx skills add https://github.com/AgentSystemLabs/core --skill audit-authz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents production security bugs by auditing server-side authorization and ownership checks, especially where authenticated identity is present but resource access control is missing or incorrectly scoped.

Core Features & Use Cases

  • Entry-point enumeration across common server handler types (server functions, HTTP routes, tRPC, GraphQL resolvers, webhooks, workers, IPC).
  • Authorization classification that distinguishes public, authenticated, user-scoped, role-gated, and internal/service endpoints.
  • Targeted findings for anonymous access, IDOR (ownership missing after identity), role-but-not-scoped mistakes, client-supplied admin flags, weak/absent webhook signature verification, and checks that occur after side effects.
  • Actionable fixes that propose concrete code changes using the project’s existing auth helpers and require confirmation before anything is applied.

Quick Start

Run the audit-authz skill to scan your server code for missing authorization checks and produce a prioritized list of critical, high, and medium authz findings with recommended fixes.

Frequently Asked Questions about audit-authz

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit server endpoints for IDOR and missing authorization checks?▼

To audit for IDOR and missing authorization, enumerate server handlers like HTTP routes, tRPC procedures, and GraphQL resolvers, then verify that resource ownership checks match the required access classifications.

What is the best way to find missing role scoping in tRPC procedures and GraphQL resolvers before release?▼

The best way to find missing role scoping is to classify tRPC and GraphQL endpoints by access level, then verify the code against those requirements using existing auth helpers to catch role-but-not-scoped mistakes.

Does this authorization audit work with TanStack Start server functions and webhook receivers?▼

Yes, the authorization audit supports TanStack Start server functions and webhook receivers, classifying their access requirements and specifically checking for weak or absent webhook signature verification.

How do I check for webhook validation and authorization issues in queue workers and IPC handlers?▼

Checking webhook validation in queue workers and IPC handlers involves enumerating these entry points, classifying them as internal or service endpoints, and verifying signature checks occur before any side effects.

Can the audit automatically fix missing authorization logic in my server code?▼

No, the audit never silently inserts new authorization logic; it proposes concrete code fixes using your existing auth helpers and requires your confirmation before applying any changes to prevent unauthorized access.

Related Skills

Explore More Software Engineering Skills→
webdevcodywebdevcody
22

code-audit-authz

Audit server-side authorization for missing ownership checks and IDOR.

Community
Advanced
riftzen-bitriftzen-bit

ai-regression-testing

Run sandbox-mode API regression tests to detect regressions in AI-assisted code.

Community
Intermediate
RajAryanIITBHURajAryanIITBHU

clerk-tanstack-patterns

Protect TanStack React Start routes and server functions with Clerk authentication.

Community
Intermediate
MAF2414MAF2414
1

authz-bypass-hunter

Identify authorization bypass vulnerabilities in code and API endpoints.

Community
Advanced