bfla

Broken Function Level Authorization (BFLA) — exploit action-level access control failures where lower-privileged principals invoke admin/staff functions across REST, GraphQL, gRPC, WebSocket, and background job paths.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An exceptionally actionable, well-sequenced testing runbook with concrete commands and strong verification checkpoints. Its sole weakness is the absence of progressive disclosure — all detail lives inline in one long file with no references to split it out.

Suggestions

Move the gRPC-Specific Testing, Common Framework Weaknesses table, and ATT&CK Mapping into reference files (e.g. references/grpc-bfla.md, references/framework-gaps.md) linked from the main body.

Keep the SKILL.md body as a concise overview + the core 7-step methodology, and signal the deeper references explicitly so the main file stays scannable.

Optionally extract the Reconnaissance actor×action matrix script into a scripts/ file referenced from the Reconnaissance section.

Dimension	Reasoning	Score
Conciseness	The body is dense with executable commands and assumes Claude's competence; the only conceptual sentence (distinguishing BFLA from IDOR) is domain-defining rather than generic background, so every section earns its place.	3 / 3
Actionability	It provides fully executable curl/grpcurl/python examples with concrete payloads and only appropriate <TARGET> placeholders — copy-paste ready rather than pseudocode.	3 / 3
Workflow Clarity	Step 1–7 are clearly sequenced and the Verification section supplies explicit checkpoints (baseline contrast, durable state change, minimal repro) plus an assertion-based script and a stated "Win condition," satisfying validation for destructive operations.	3 / 3
Progressive Disclosure	It is well-organized into sections but is a monolithic ~240-line single file with no bundle references; gRPC-specific testing, framework weaknesses, and detailed per-step methodology could be split into one-level-deep reference files.	2 / 3
	Total	11 / 12 Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A specific, well-targeted security skill description with strong trigger terms and a clear distinct niche. Its only weakness is the absence of an explicit "Use when…" clause, which leaves the "when to use" guidance implied rather than stated.

Suggestions

Append an explicit trigger clause such as "Use when testing for BFLA, broken function-level authorization, admin endpoint bypass, or privilege escalation across REST/GraphQL/gRPC/WebSocket/background-job surfaces."

Consider adding the high-frequency layperson terms ("privilege escalation", "admin endpoint bypass") that currently live only in the metadata.when_to_use field directly into the description.

Dimension	Reasoning	Score
Specificity	The description lists multiple concrete actions and surfaces — "exploit action-level access control failures where lower-privileged principals invoke admin/staff functions across REST, GraphQL, gRPC, WebSocket, and background job paths" — matching the anchor for several specific concrete actions rather than just a domain name.	3 / 3
Completeness	The "what" is clearly stated but there is no explicit "Use when…" trigger clause, so per the judging guideline completeness is capped at 2 (has what, when only implied).	2 / 3
Trigger Term Quality	Natural domain terms a tester would say are present ("BFLA", "admin/staff functions", "access control failures") with broad coverage across transport paths, matching the anchor for good coverage of natural terms.	3 / 3
Distinctiveness Conflict Risk	It carves a narrow, explicitly-named niche (action-level authorization, distinct from object-level IDOR) with distinct triggers, making conflict with other skills unlikely.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/standard/exploit/web/bfla/SKILL.md
Commit: e34afba

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.