Detect authentication and authorization flaws in web and API targets.
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill auth-agent
Please help me install this Agent Skill. Skill: auth-agent Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/agents/auth-agent Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill auth-agent
Eliminates blind spots in web security testing by systematically validating authentication and authorization boundaries across login, session, token, and user/resource access paths.
Ask the agent to perform full authentication and authorization testing for your target URL using your provided authorization scope, test accounts, and any available logged-in session artifacts so it can produce reproducible HTTP evidence.
High-intent search queries and answers about installing and using this skill.
To test for IDOR and authorization bypass, you systematically enumerate object authorization paths using A/B account comparisons. This validates trust-boundary failures by capturing reproducible HTTP evidence to confirm permission gaps.
Detecting JWT and OAuth misconfigurations requires exercising token validation paths with deterministic HTTP testing. This identifies protocol misconfigurations, insecure randomness, and session management defects backed by strict evidence capture.
Brute force testing evaluates rate limiting by executing controlled attacks driven by configuration rules. It simultaneously checks lockout behaviors and throttling mechanisms to determine if authentication endpoints resist automated credential stuffing.
Performing SSO and SAML testing requires providing target URLs, authorization scopes, and test accounts. Systematic validation of trust boundaries across login and session paths requires deterministic HTTP testing to produce reproducible evidence.
User enumeration occurs during login flow testing when authentication responses reveal whether an account exists. It is detected by exercising login paths and analyzing HTTP responses to identify trust-boundary failures and protocol misconfigurations.
Reproducing an authentication bypass requires deterministic HTTP testing artifacts capturing exact request and response pairs. This strict evidence capture ensures the trust-boundary failure can be replayed and verified during authorization validation.
jacardlAutomate exploratory QA testing of web applications with a browser toolset.
sjinksReview webhook receivers and delivery paths for signature, transport, and replay weaknesses.
alexfazioIntercept and inspect Claude Code API traffic using mitmproxy.
summarybotngScan code, dependencies, and configurations for OWASP Top 10 vulnerabilities.
