auth-bypass
Hunt authentication/authorization bypass in route guards, role checks, tenant boundaries, and state-machine transitions.
64
Quality
77%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Securityby
Critical
Do not install without reviewing
Fix and improve this skill with Tessl
tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/auth-bypass/SKILL.mdAuth Bypass Playbook
Targets
- Endpoints with role-based access
- Admin-only routes
- Tenant-scoped resources
- Multi-step auth flows (MFA, password reset)
Common failure patterns
- Missing middleware on one route variant
- Trusting client-controlled role/tenant fields
- TOCTOU between check and action
- Alternate API versions lacking guard checks
Validation
- Positive: low-priv session performs high-priv action.
- Negative: same request with expected guard path should deny.
- Repository
- PurpleAILAB/Decepticon
- Commit
e34afba
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.