skills.rest
sjinks
sjinksCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review-owasp-authorization-testing-automation

Analyze authorization testing automation risks in security review artifacts.

Updated Mar 26, 2026
Search Tags:#authorization#owasp#trust-boundaries#security-review#privilege-escalation#copilot-chat#identity-proof
One-click install
npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-authorization-testing-automation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review-owasp-authorization-testing-automation
Source: https://github.com/sjinks/ai-owasp-skillset/tree/main/.github/skills/security-review-owasp-authorization-testing-automation
Command: npx skills add https://github.com/sjinks/ai-owasp-skillset --skill security-review-owasp-authorization-testing-automation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps reviewers evaluate authorization testing automation for weaknesses that can lead to account takeover, privilege escalation, identity confusion, or unsafe trust propagation.

Core Features & Use Cases

  • Identity and recovery review: Inspect enrollment, login, recovery, reset, and step-up flows for weak proofing or bypass paths.
  • Trust-boundary analysis: Trace how identity and authorization context moves across services, jobs, headers, and delegated actions.
  • Evidence-based findings: Produce review output grounded in code, configuration, tests, documentation, and observable behavior.
  • Use Case: A security reviewer can use this skill to assess a login or recovery flow, confirm whether authorization decisions rely on client-controlled data, and document concrete remediation steps.

Quick Start

Ask Copilot to review the target authentication or authorization flow with this skill and focus on identity proof, recovery, propagation, and privilege enforcement.

Frequently Asked Questions about security-review-owasp-authorization-testing-automation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review authorization flows for privilege escalation and weak identity proofing?▼

Trust-boundary analysis traces how identity and authorization context moves across services, jobs, and headers. It requires evidence-based validation of privilege enforcement and safe failure handling to confirm controls cannot be bypassed.

What is the best way to automate security reviews for account takeover and identity confusion risks?▼

Evidence-based findings are produced by inspecting code, configuration, tests, and documentation for authorization weaknesses. Observable review gaps are documented when privilege enforcement controls cannot be verified.

How do I check if my authorization decisions rely on client-controlled data during a security review?▼

Trust-boundary analysis traces identity and authorization context across services, jobs, headers, and delegated actions. It requires evidence-based validation of privilege enforcement and documents observable review gaps when controls cannot be verified.

Can I use this authorization testing approach for step-up authentication and credential recovery flows?▼

Identity and recovery review inspects enrollment, login, recovery, reset, and step-up flows for weak proofing or bypass paths. It requires evidence-based validation of privilege enforcement and safe failure handling across code, configuration, and tests.

Why does my authorization security review miss trust propagation vulnerabilities across services?▼

Trust-boundary analysis traces how identity and authorization context moves across services, jobs, headers, and delegated actions. It requires evidence-based validation of privilege enforcement and documents observable review gaps when controls cannot be verified.

Related Skills

Explore More Software Engineering Skills→
CAPHTECHCAPHTECH
1

security-observation

Identify security defects in generated code to prevent data leakage and injection attacks.

Official
Advanced
45ck45ck
6

heal-spec

Patch broken demo-machine specs by analyzing failure artifacts and validating with the CLI.

Community
Advanced
bugrabilgebugrabilge
10

vulnerability-scanner

Detect security vulnerabilities in code, running apps, and dependencies.

Community
Advanced
zaiyemeiyou404zaiyemeiyou404

ctf-web-encoding-bypass

Bypass web application defenses and extract data from CTF challenges.

Community
Advanced