skills.rest
utkusen
utkusenCOMMUNITY
Explore all skills by this author →
Website𝕏@utkusen_enGitHub

sast-missingauth

Detect missing authentication and broken function-level authorization in codebases.

1.3k|61|Updated Mar 30, 2026
Search Tags:#sast#endpoints#privilege-escalation#security-testing#authz#missing-auth
One-click install
npx skills add https://github.com/utkusen/sast-skills --skill sast-missingauth
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-missingauth
Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-missingauth
Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-missingauth

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/missingauth-results.md. Use when asked to find missing auth, broken access control, or privilege escalation bugs.

Core Features & Use Cases

  • Recon maps endpoints and the permission system, identifying auth posture and privileged actions.
  • Batched verify runs parallel checks (batches of up to 3 endpoints each) to validate authentication and authorization.
  • Merge consolidates batch results into a final sast/missingauth-results.md with remediation guidance.
  • Use case: security teams map auth gaps and vertical privilege escalation across large codebases.

Quick Start

Run the Missing Auth analysis on your codebase to generate sast/missingauth-results.md.

Frequently Asked Questions about sast-missingauth

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect missing authentication and broken access controls in my codebase?▼

To detect missing authentication and broken access controls, this Skill maps endpoints and the permission system, then runs batched parallel checks to identify unauthenticated access and vertical privilege escalation vulnerabilities before merging findings into a final report.

What's the best way to find vertical privilege escalation vulnerabilities during security testing?▼

Finding vertical privilege escalation vulnerabilities is handled by verifying function-level authorization across mapped endpoints, checking whether regular users can access admin-only functions, and surfacing those access control gaps in a merged security report.

Do I need to run sast-analysis before checking for missing auth vulnerabilities?▼

Yes, you need to run sast-analysis first because this Skill requires the sast/architecture.md file to exist. It uses that architectural mapping as input to understand endpoints and the permission system before verifying authorization posture.

How does batched verification work for endpoint authorization checks?▼

Batched verification works by dividing mapped endpoints into groups of up to 3, running parallel subagent checks on each batch to validate authentication and authorization, and then merging all batch results into a final consolidated findings report.

Where are missing auth and broken access control findings stored after analysis?▼

Missing auth and broken access control findings are stored in sast/missingauth-results.md. This output file contains the consolidated batch results along with remediation guidance for unauthenticated access and privilege escalation issues.

Related Skills

Explore More Software Engineering Skills→
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced
utkusenutkusen
1.3k

sast-idor

Identify and map IDOR vulnerabilities in REST or GraphQL endpoints.

Community
Advanced
alexmaruccialexmarucci

static-analysis

Automate SAST and SCA scans to identify security and dependency vulnerabilities.

Community
Advanced
BagelHoleBagelHole
46

dast-scanning

Perform DAST scans on web applications and APIs with OWASP ZAP.

Community
Intermediate