CtrlK
BlogDocsLog inGet started
Tessl Logo

auth-bypass

Hunt authentication/authorization bypass in route guards, role checks, tenant boundaries, and state-machine transitions.

64

Quality

77%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/standard/analyst/auth-bypass/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

72%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A compact, well-organized hunting checklist that is admirably concise and free of bundle-file overhead. It would benefit from a concrete executable example and an explicit step sequence linking discovery to validation.

Suggestions

Add one concrete executable probe, e.g. a curl example replaying a low-priv token against a high-priv endpoint, to lift actionability.

Make the workflow explicit with numbered steps (enumerate targets → test each failure pattern → run the positive/negative validation) so the sequence and checkpoint are unambiguous.

Include a concrete negative-control example (the same request routed through the expected guard) so the validation step is copy-paste ready.

DimensionReasoningScore

Conciseness

The body is a lean set of bullets with zero padding and no explanation of concepts Claude already knows; every line carries a distinct, usable signal.

3 / 3

Actionability

It names concrete failure patterns ('TOCTOU between check and action', 'Missing middleware on one route variant') and a positive/negative validation method, but offers no executable commands, payloads, or copy-paste examples.

2 / 3

Workflow Clarity

The Targets → Patterns → Validation sections imply a loose sequence and validation is present, but there is no explicit numbered workflow with checkpoints tying the hunt to the verification step.

2 / 3

Progressive Disclosure

At under 50 lines with no need for external references, the well-organized section headers satisfy progressive disclosure without any bundle files.

3 / 3

Total

10

/

12

Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A tight, specific description that names concrete targets and natural trigger terms within a distinct niche. Its only gap is the absence of an explicit 'when to use' clause inside the description field itself.

Suggestions

Append an explicit trigger clause to the description, e.g. 'Use when auditing access control, testing route guards, or hunting privilege-escalation and tenant-isolation bugs.'

Fold a few common user phrasings (e.g. 'privilege escalation', 'IDOR', 'broken access control') into the description so it matches how users naturally ask for auth-bypass testing.

DimensionReasoningScore

Specificity

The description lists multiple concrete hunting targets — 'route guards, role checks, tenant boundaries, and state-machine transitions' — going well beyond vague domain naming.

3 / 3

Completeness

It clearly states what the skill does ('Hunt authentication/authorization bypass...') but the description field itself lacks an explicit 'Use when...' trigger clause, capping completeness at 2 per the guideline.

2 / 3

Trigger Term Quality

Terms like 'authentication/authorization bypass', 'route guards', 'role checks', and 'tenant boundaries' are natural phrasings a security tester would actually say when requesting this kind of work.

3 / 3

Distinctiveness Conflict Risk

The auth-bypass niche with its specific guard/role/tenant/state-machine triggers is clearly distinguishable and unlikely to fire for unrelated skills.

3 / 3

Total

11

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.