php-auth-audit

Name: php-auth-audit
Availability: InStock
Author: 0xShe

Analyze PHP web applications to map route authentication and authorization risks.

386|38|Updated Mar 24, 2026

Search Tags:#authorization #authentication #php #web-security #code-audit #idor #trace-audit

Ready to run

npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-auth-audit-0xshe

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: php-auth-audit
Source: https://github.com/0xShe/PHP-Code-Audit-Skill/tree/main/php-auth-audit
Command: npx skills add https://github.com/0xShe/PHP-Code-Audit-Skill --skill php-auth-audit-0xshe

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

本 Skill 通过静态和源码级分析，识别 PHP Web 项目的认证与授权链路，判断路由的鉴权状态，并揭示潜在的鉴权绕过、越权与 IDOR 风险，输出可审计的路由-鉴权映射与修复建议。

Core Features & Use Cases

自动识别认证/鉴权实现：Session/JWT/中间件/自定义校验函数，并对路由进行鉴权状态标注
输出路由-鉴权映射表与风险分级：对每条路由给出公开/受保护/仅认证/无鉴权等状态，以及 IDOR/越权等风险类型
支持两种运行模式：STATIC_MAPPING（静态映射，无需 trace）与 TRACE_AUDIT（完整的 trace 证据引用），并提供 PoC 与修复建议

Quick Start

Run the auth audit workflow on a PHP project to generate route-auth mappings and an audit report.

Frequently Asked Questions about php-auth-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify authentication and authorization mechanisms in a PHP web application?▼

To identify authentication and authorization mechanisms in a PHP web application, you can use source-level static analysis to detect Session, JWT, middleware, or custom validation functions and map their enforcement across routes.

What is the best way to audit PHP routes for IDOR and authorization bypass risks?▼

The best way to audit PHP routes for IDOR and authorization bypass risks is by generating a route-auth mapping that assesses each route's authentication state and flags potential vertical or horizontal privilege escalation vulnerabilities.

Can I audit PHP authentication flows without runtime traces?▼

Yes, you can audit PHP authentication flows without runtime traces by using the STATIC_MAPPING mode, which performs source-level analysis to identify authorization mechanisms and map route protection statuses statically.

How does source-level code audit detect broken access control in PHP projects?▼

Source-level code audit detects broken access control in PHP projects by analyzing authentication chains and evaluating route-level authorization states to uncover missing checks, bypass paths, and IDOR vulnerabilities.

Do I need runtime traces to generate a route-auth mapping for PHP applications?▼

No, you do not need runtime traces to generate a route-auth mapping for PHP applications; the analysis supports a STATIC_MAPPING mode that works purely from source code to identify authentication states and risks.

What limitations exist when using static mapping for PHP authorization audits?▼

A key limitation of using static mapping for PHP authorization audits is the absence of runtime execution context, meaning dynamic includes or runtime-evaluated middleware conditions may not fully resolve without switching to TRACE_AUDIT mode.