CtrlK
BlogDocsLog inGet started
Tessl Logo

bfla

Broken Function Level Authorization (BFLA) — exploit action-level access control failures where lower-privileged principals invoke admin/staff functions across REST, GraphQL, gRPC, WebSocket, and background job paths.

67

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with a clear, validated multi-step workflow and minimal padding. Its only real gap is monolithic single-file structure with no progressive-disclosure offloading, though the absence of bundle files makes that a minor issue.

DimensionReasoningScore

Conciseness

Mostly efficient with executable blocks, a framework-weakness table, and ATT&CK/detection sections rather than concept lectures; a few near-duplicate curl blocks and inline parsing snippets could be factored or trimmed.

4 / 5

Actionability

Provides concrete, executable curl/grpcurl/Python snippets with real flags and a complete verification harness with asserts, copy-paste-ready across REST, GraphQL, gRPC, WebSocket, and job paths.

5 / 5

Workflow Clarity

Clear numbered Step 1–Step 7 sequence plus a 3-criteria Verification checklist (baseline contrast, durable state change, minimal repro) with an assert-based feedback loop — appropriate validation for a destructive/privileged-write skill.

5 / 5

Progressive Disclosure

Single self-contained file with strong section organization and no missing references, but it is monolithic with no pointers to separate files; the framework-weakness table and gRPC block could be offloaded if bundles existed.

4 / 5

Total

18

/

20

Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, action-oriented, and highly distinct, but it omits an explicit 'Use when...' trigger clause, leaving the 'when' only weakly implied. Adding a concrete trigger sentence would lift completeness.

Suggestions

Append an explicit 'Use when...' clause naming natural triggers (e.g., 'Use when testing for broken function level authorization, admin endpoint bypass, privilege escalation, or role/action bypass across API transports').

Surface a few natural synonyms (privilege escalation, admin api, method override) directly in the description rather than only in metadata, to improve trigger-term coverage.

DimensionReasoningScore

Specificity

Names the domain (BFLA, action-level access control) and enumerates concrete actions across five named transport surfaces — 'invoke admin/staff functions across REST, GraphQL, gRPC, WebSocket, and background job paths.'

5 / 5

Completeness

Provides a clear, concrete 'what' but lacks any explicit 'Use when...' or equivalent trigger guidance, which per the rubric caps completeness at 3.

3 / 5

Trigger Term Quality

Includes the canonical term 'BFLA' and natural phrases like 'admin/staff functions' plus transport names, but several natural synonyms (privilege escalation, admin api, method override) live only in metadata rather than the description itself.

4 / 5

Distinctiveness Conflict Risk

The 'BFLA' niche is sharp and explicitly contrasted against object-level IDOR, giving a clear distinct trigger surface with minimal conflict risk.

5 / 5

Total

17

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Repository
PurpleAILAB/Decepticon
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.