Identify missing authorization checks in routes, controllers, resolvers, and data models.
npx skills add https://github.com/superagent-ai/skills --skill authz-security
Please help me install this Agent Skill. Skill: authz-security Source: https://github.com/superagent-ai/skills/tree/main/skills/authz-security Command: npx skills add https://github.com/superagent-ai/skills --skill authz-security
This skill turns the model into an authorization reviewer. Read the routes, controllers, resolvers, and data models; walk the detection passes; report each missing access-control check with a severity and a concrete, framework-correct fix. No tools to install, no app to run, no credentials — the analysis is the model reading the code.
Review a codebase and generate static findings with concrete fixes for authorization gaps.
High-intent search queries and answers about installing and using this skill.
Static authorization review detects BOLA and BFLA vulnerabilities by reading routes, controllers, and data models without runtime execution. It walks detection passes across REST and GraphQL endpoints to report missing access-control checks with severity labels and concrete framework-correct fixes.
Yes, static security review supports BOLA detection in Express and Django. The evaluation applies detection passes across Express, Django, Rails, and Spring frameworks to identify object access gaps and suggest denied-by-default patterns and centralized policy usage.
No, this code review tool requires no runtime execution, installed tools, running app, or credentials. The authorization analysis is performed entirely statically by reading the codebase to identify mass-assignment gaps and guide secure design decisions.
Enforce owner checks and centralized authorization policies by applying denied-by-default patterns to endpoints. The static review produces framework-specific fix guidance that integrates centralized policy usage and owner checks directly into your controllers and resolvers.
Auditing multitenancy access control in nested resources requires statically walking code paths to identify missing object-level authorization. The review checks routes and resolvers across multiple stacks, producing a reproducible per-endpoint checklist with concrete framework-correct fixes.
weirdgmeGenerate Node.js/Express/TypeScript microservice backend guidelines with layered architecture.
Prohao42Identify and verify IDOR, BOLA, and BFLA vulnerabilities in web APIs.
weirdgmeAutomate security integration across CI/CD pipelines with policy-as-code enforcement.
AcczdyDetect broken object level authorization in REST and GraphQL APIs.
