disabled-credential-stuffing-policy

Govern credential-stuffing assessment requests with authorization and risk approval protocols.

Updated Jul 30, 2026

Search Tags:#security #authentication #compliance #risk-management #policy #pentesting

Ready to run

npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill disabled-credential-stuffing-policy

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: disabled-credential-stuffing-policy
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/disabled-credential-stuffing-policy
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill disabled-credential-stuffing-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill prevents unauthorized or high-risk credential-stuffing and account-abuse activities by providing a strict policy-only boundary and guiding users toward safer defensive assessment alternatives.

Core Features & Use Cases

Policy Enforcement: Clearly defines the refusal rationale for credential-stuffing and account-takeover requests.
Defensive Guidance: Redirects users toward constructive security assessments like lockout policy audits, MFA review, and incident response planning.
Use Case: When a user asks to test a list of credentials against a login page, this skill intervenes to explain why such actions are blocked and suggests auditing the rate-limiting and lockout configurations instead.

Quick Start

Use the disabled-credential-stuffing-policy skill to review the safety requirements and defensive alternatives for account security testing.

Frequently Asked Questions about disabled-credential-stuffing-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why is automated credential stuffing blocked during security testing?▼

Automated credential stuffing is blocked because it introduces severe account-abuse risks. This policy enforces a strict refusal for high-risk login automation, requiring risk approval and authorization gates before proceeding with any authentication testing.

What are defensive alternatives for account-abuse assessment?▼

Defensive alternatives for account-abuse assessment include auditing lockout policies, reviewing MFA configurations, and evaluating rate-limiting controls. This policy framework redirects testing requests toward these constructive security reviews instead of active login automation.

How do I validate scope for authentication pentesting?▼

Scope validation for authentication pentesting requires strict adherence to authorization gates and risk approval protocols. This policy framework mandates verifying explicit permission and scope boundaries before discussing any credential-stuffing or account security testing.

Can I test a credential list against a login page?▼

Testing a credential list against a login page is refused under this security policy. It blocks high-risk login automation and instead suggests auditing the target's lockout configurations, rate-limiting, and incident response planning.

What is a credential stuffing policy framework?▼

A credential stuffing policy framework provides governance for managing account-abuse assessment requests. It enforces refusal rules for high-risk login automation while promoting defensive control reviews and incident response planning for compliance.

When should I avoid active login automation in pentesting?▼

Active login automation should be avoided when authorization gates, scope validation, and risk approval protocols are not fully satisfied. This policy intervenes to prevent unauthorized credential testing and guides users toward safer defensive assessments.