broken-authentication

Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems.

Quality

55%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/broken-authentication/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is a thorough, largely actionable testing runbook with good sequencing and an authorization gate, but it is monolithic with no file splitting, carries noticeable padding, and lacks validation feedback loops for its batch operations. It earns mid-range scores across the board.

Suggestions

Move the payload lists, quick-reference tables, and worked examples into separate reference files (e.g. references/payloads.md, references/examples.md) and link to them one level deep to improve progressive disclosure.

Remove the verbatim Purpose repetition and the 'Required Knowledge' list of basics Claude already knows to tighten conciseness.

Add explicit validate→fix→retry checkpoints after batch operations (e.g. confirm a brute-force finding by re-running with a single credential, or verify session-fixation success before reporting) to lift workflow clarity above the cap.

Dimension	Reasoning	Score
Conciseness	The body is mostly actionable but includes padding: the Purpose section repeats the description verbatim, the 'Required Knowledge' list restates basics Claude already knows, and several bash blocks are comment-only pseudo-guidance rather than commands.	3 / 5
Actionability	Most phases give concrete, executable material (a real Hydra command, HTTP requests, JWT 'none'-alg manipulation, a Python token-collection snippet), with only minor gaps where blocks are comment-only.	4 / 5
Workflow Clarity	The ten phases are clearly sequenced and a mandatory authorization gate sits up top, but the batch operations (brute force, credential stuffing, OTP brute force) lack validate→fix→retry feedback loops, so per the destructive/batch cap workflow clarity cannot exceed 3.	3 / 5
Progressive Disclosure	The skill is a single ~490-line monolithic file with no references/, scripts/, or assets/ bundle and no external file pointers, but it is well-organized with clear sections and tables rather than being an unstructured wall of text.	3 / 5
	Total	13 / 20 Passed

Description

53%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description clearly states what the skill does and targets a well-defined niche, but it omits any explicit 'Use when...' trigger guidance and lacks natural synonyms, capping both completeness and trigger quality. It is solid but not exemplary.

Suggestions

Add an explicit 'Use when...' clause with concrete triggers, e.g. 'Use when testing login flows, session handling, MFA, or password-reset mechanisms in authorized security assessments.'

Include natural synonyms users would say ('login', 'brute force', 'session hijacking', 'credential stuffing') to broaden trigger coverage.

Trim the consequence list (OWASP ranking, account takeover) and replace it with one or two additional concrete testing actions to raise specificity.

Dimension	Reasoning	Score
Specificity	It names the domain ('authentication and session management vulnerabilities') and two concrete actions ('Identify and exploit'), but the second sentence only lists consequences (OWASP ranking, account takeover) rather than additional actions, so coverage is not comprehensive.	3 / 5
Completeness	The 'what' is clearly stated ('Identify and exploit authentication and session management vulnerabilities'), but there is no 'Use when...' trigger clause, which per the guidelines caps completeness at 3.	3 / 5
Trigger Term Quality	Relevant keywords like 'authentication', 'session management', and 'OWASP Top 10' are present, but common natural variations or synonyms a user might say (e.g. 'login', 'brute force', 'session hijacking') are missing.	3 / 5
Distinctiveness Conflict Risk	'Authentication and session management vulnerabilities' is a distinct niche with low conflict risk, though as an offensive-testing skill it could overlap marginally with broader pentesting skills.	4 / 5
	Total	13 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/broken-authentication/SKILL.md
Commit: 1f67c44

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.