security-review-owasp-mass-assignment

What problem does it solve?

This Skill helps reviewers find mass assignment weaknesses where request data can silently populate sensitive fields and compromise authorization, ownership, pricing, or account state.

Core Features & Use Cases

• Binding Boundary Review: Checks whether public request payloads are safely separated from domain and persistence models.
• Sensitive Field Protection: Flags risky exposure of fields like roles, permissions, status, owner identifiers, and financial values.
• Framework Control Validation: Assesses allowlists, ignored properties, DTO mapping, and other binding safeguards across code and configuration.
• Use Case: Use it when reviewing an API, form handler, or ORM flow that may let attackers set fields they should never control.

Quick Start

Review the selected flow for mass assignment risks with the security-review-owasp-mass-assignment skill and report any bindable sensitive fields.