broken-authentication

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is strong on actionability with genuinely executable commands and code, and its ten-phase structure is easy to follow. It loses points for verbosity, missing validation feedback loops on batch operations, and a monolithic layout with no progressive disclosure.

Suggestions

Trim explanatory prose Claude already knows (the OWASP/ Purpose framing, the 'credential stuffing differs from brute force' aside, and OTP combination arithmetic) to tighten conciseness.

Add explicit validation checkpoints to the batch phases, e.g. after brute force/credential stuffing 'review successful logins; if none, refine wordlist and retry' to lift workflow clarity.

Split the monolithic body into one-level-deep reference files (e.g. move Quick Reference payloads, session-cookie flag tables, and Examples into separate referenced .md files) so SKILL.md stays a lean overview.

Dimension	Reasoning	Score
Conciseness	Mostly actionable but padded with concepts Claude already knows (OWASP framing in Purpose, "Credential stuffing differs from brute force", OTP combination arithmetic), so it is not lean enough for the top anchor.	2 / 3
Actionability	Provides copy-paste-ready executable material throughout: a real hydra http-post-form command, a runnable Python session-token collector, concrete HTTP/JWT "none" algorithm attack payloads, and step-by-step Burp Intruder guidance.	3 / 3
Workflow Clarity	The ten numbered phases give a clear sequence, but batch operations (brute force, credential stuffing) lack explicit validate->fix->retry checkpoints, so the workflow-clarity cap for batch/destructive operations applies.	2 / 3
Progressive Disclosure	No bundle files exist and the body is a ~477-line monolith where the Quick Reference payloads, cookie-flag tables, and Examples are inline rather than split into clearly signaled one-level-deep reference files.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is well-formed: third-person voice, explicit use-when triggers, and a concrete list of testing actions that clearly differentiate the skill. The only minor weakness is the slightly fluffy phrase "comprehensive techniques", which does not change the scores.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete testing actions ("test for broken authentication vulnerabilities", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", "identify authentication bypass flaws") matching the top anchor; voice is third person so no penalty applies.	3 / 3
Completeness	Explicitly answers when ("This skill should be used when the user asks to...") and what ("provides comprehensive techniques for identifying authentication and session management weaknesses"), so the explicit-trigger cap does not apply.	3 / 3
Trigger Term Quality	Quoted phrases such as "assess session management security", "perform credential stuffing tests", and "test for session fixation" are natural terms a security tester would actually say, with broad coverage of the broken-auth subspace.	3 / 3
Distinctiveness Conflict Risk	Triggers are narrowly scoped to broken authentication and session management, a clear niche unlikely to fire for unrelated skills.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/broken-authentication/SKILL.md
Commit: af7d491

Reviewed: about 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.