Skills broken-authentication
📦
broken-authentication
v1.1 Content revision r1 High Risk ⚙️ External commands🌐 Network access
Assess Broken Authentication Risks
Authentication flaws can lead to account takeover and data exposure. This skill guides authorized testers through structured checks for passwords, sessions, MFA, and reset flows.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "broken-authentication" from https://skillstore.io/skills/sickn33-broken-authentication.md and its manifest at https://skillstore.io/api/skills/sickn33-broken-authentication/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "broken-authentication". Review login, reset, and MFA flows for a scoped staging application.
Expected outcome:
A structured assessment plan covering test accounts, allowed endpoints, control checks, evidence needs, and safe stopping conditions.
Using "broken-authentication". Summarize session management findings from tester notes.
Expected outcome:
A finding summary with affected controls, risk rating, observed behavior, user impact, and remediation recommendations.
Using "broken-authentication". Prepare a retest checklist for authentication fixes.
Expected outcome:
A focused checklist for lockout, enumeration, MFA recovery, session timeout, reset token binding, and reporting evidence.
Security Audit
High Riskv4 • 7/6/2026 Open versioned report
Most external-command detections are Markdown fence false positives, not executable backtick usage. The skill still contains high-risk authentication attack workflows, including brute-force testing, credential-stuffing evasion, MFA bypass, session fixation, JWT forgery, and password-reset account takeover techniques. Publication should require stronger authorization gating and removal or narrowing of offensive execution guidance.
1
Files scanned
482
Lines analyzed
14
Review items
0
False positives ignored
Confirmed security concerns (12)
High
System reconnaissance
"/login:username=^USER^&password=^PASS^:Invalid credentials"
The line is part of a Hydra form-based login attack command using username and password payload markers. This enables credential brute-force testing and is dangerous without authorization.
High
System reconnaissance
- Previous valid OTP reuse
The line names reuse of a previous valid OTP as an MFA bypass technique. That is a direct authentication bypass test with account takeover impact.
High
System reconnaissance
# Try changing user parameter while using valid token
The line instructs changing the user parameter while using a valid reset token. This is a password reset account takeover technique.
High
Network reconnaissance
- Skip MFA step by direct URL access
The line suggests skipping MFA through direct URL access. This is an authentication bypass technique that can lead to account takeover.
High
Credential Attack and Evasion Workflow
The skill provides brute-force and credential-stuffing procedures, including Hydra usage, breached credential pairs, and source IP or user-agent rotation guidance.
The cited sections explicitly cover brute force testing, credential stuffing, credential payloads, and lockout bypass via IP rotation. Authorization language exists, but the procedures are directly usable for account attack workflows.
High
MFA Bypass Workflow
The skill instructs OTP brute forcing, direct URL MFA skipping, response manipulation, empty OTP submission, OTP reuse, and API version downgrade testing.
The MFA section lists multiple concrete bypass methods and payload strategies. These are legitimate in a lab, but harmful if applied outside authorized scope.
High
Account Takeover Through Session and Reset Abuse
The skill describes session fixation and password reset token manipulation workflows that can transfer or reset another user account.
The cited sections describe fixed-session victim login and changing reset user parameters. These are clear account takeover paths when controls are vulnerable.
High
JWT Token Forgery Workflow
The skill walks through modifying a JWT to use the none algorithm, changing the role to admin, and submitting the modified bearer token.
The example gives a complete token forgery flow with role escalation and replay. It is clearly a security test, but it is operationally useful for unauthorized privilege escalation.
Show all 12 confirmed findings
Medium
System reconnaissance
# Compare responses for valid vs invalid usernames
The line instructs comparing valid and invalid username responses. This is username enumeration testing and can disclose account existence if used against an unauthorized target.
Medium
System reconnaissance
# Invalid: "Invalid username" vs Valid: "Invalid password"
The line gives differential error messages for valid and invalid usernames. That is a concrete account enumeration signal.
Medium
Network reconnaissance
# Recovery process
The recovery-process section asks whether MFA can be disabled via email alone. This is a valid security test, but it also identifies account recovery bypass opportunities.
Low
System reconnaissance
username=valid&password=valid
The credentials appear inside a session fixation validation flow. It can be legitimate with test accounts, but it still supports checking whether a fixed session remains usable after login.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.1
The IP is used in an account lockout bypass example with X-Forwarded-For rotation. This directly supports repeated login attempts against a target.
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.2
The IP is the next rotated X-Forwarded-For value in the lockout bypass example. The context is evading authentication protections across attempts.
Medium
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
The URL adds an admin email parameter to a reset token to test account takeover. This is a concrete password reset abuse pattern despite using a placeholder host.
Medium
Hardcoded IP address
X-Forwarded-For: 127.0.0.1
The IP appears in a list of spoofed forwarding headers for rate-limit bypass testing. This can help evade account lockout or throttling controls if misused.
Medium
Hardcoded IP address
X-Real-IP: 127.0.0.1
The IP appears in a spoofed client IP header for rate-limit bypass testing. This can help evade throttling controls when applied to a vulnerable target.
Medium
Hardcoded IP address
X-Originating-IP: 127.0.0.1
The IP appears in an originating IP header used for rate-limit bypass testing. The context is explicit evasion of authentication rate controls.
Medium
Hardcoded IP address
X-Client-IP: 127.0.0.1
The IP appears in a client IP header used for rate-limit bypass testing. The technique can weaken brute-force defenses when a target trusts the header.
Medium
Hardcoded IP address
X-Remote-IP: 127.0.0.1
The IP appears in a remote IP header used for rate-limit bypass testing. This is an evasion technique against authentication rate controls.
Medium
Hardcoded IP address
True-Client-IP: 127.0.0.1
The IP appears in a True-Client-IP header used for rate-limit bypass testing. It can support bypass attempts if a target trusts forwarded IP values.
Low
Python HTTP libraries
response = requests.get("https://target.com/login")
The Python example uses requests in a loop to collect session cookies from a login URL. This is expected for scoped testing, but it can generate network traffic against a target if executed.
Low
Hardcoded URL
response = requests.get("https://target.com/login")
The hardcoded login URL appears inside a runnable HTTP request example. It is a placeholder, but it demonstrates live requests to an authentication endpoint.
Low
Hardcoded URL
https://target.com/login?SESSIONID=attacker_session
The URL is part of a session fixation attack scenario that sends a fixed session value to a victim. The host is illustrative, but the workflow is an account takeover technique.
Low
Hardcoded URL
https://target.com/reset?token=abc123&user=victim
The reset URL is used to demonstrate token and user parameter manipulation. It is a placeholder, but the surrounding workflow tests password reset abuse.
Low
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6
The reset link is used as an example token for password reset exploitation testing. The domain is illustrative, but the workflow can be harmful outside authorization.
Risk Factors
⚙️ External commands (40)
SKILL.md:49-62 SKILL.md:62-66 SKILL.md:66-72 SKILL.md:72-78 SKILL.md:78-83 SKILL.md:83-91 SKILL.md:91-95 SKILL.md:95-104 SKILL.md:104-110 SKILL.md:110-123 SKILL.md:123-127 SKILL.md:127-141 SKILL.md:141-147 SKILL.md:147-162 SKILL.md:162-168 SKILL.md:168-177 SKILL.md:177-181 SKILL.md:181-197 SKILL.md:197-203 SKILL.md:203-216 SKILL.md:216-220 SKILL.md:220-227 SKILL.md:227-233 SKILL.md:233-249 SKILL.md:249-255 SKILL.md:255-279 SKILL.md:279-283 SKILL.md:283-291 SKILL.md:291-297 SKILL.md:297-316 SKILL.md:316-335 SKILL.md:335-357 SKILL.md:357-372 SKILL.md:372-379 SKILL.md:379-407 SKILL.md:407-426 SKILL.md:426-432 SKILL.md:432-447 SKILL.md:447-453 SKILL.md:453-469
Detected Patterns
System reconnaissance×6Network reconnaissance×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-broken-authentication/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-broken-authentication?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-broken-authentication?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-broken-authentication/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-broken-authentication.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). broken-authentication security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-broken-authentication/audits/4BibTeX citation
@techreport{sickn33-sickn33-broken-authentication-2026,
author = {sickn33},
title = {broken-authentication security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-broken-authentication/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "broken-authentication security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/sickn33-broken-authentication/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-broken-authentication:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Prepare an Authentication Test Plan
Define scoped checks for login, lockout, password policy, and enumeration before a web application assessment.
Review Session Management
Assess cookie flags, session regeneration, timeout behavior, and logout handling for an application release.
Validate Remediation
Retest authentication fixes and document whether previous findings are resolved with clear evidence.
Try These Prompts
Start a Scoped Review
Create an authorized broken authentication test plan for [application]. Scope is [environment], test accounts are [accounts], and excluded areas are [limits].
Assess Session Controls
Review the session management controls for [application]. Focus on cookie flags, token regeneration, idle timeout, absolute timeout, and logout invalidation.
Evaluate MFA and Reset Flows
Assess MFA and password reset security for [application]. Use only authorized test accounts and summarize risks, evidence needed, and safe remediation guidance.
Produce an Executive Report
Turn these authentication test notes into a concise report with scope, findings, severity, business impact, evidence summary, and remediation steps.
Best Practices
- Confirm written authorization, target scope, and test accounts before any assessment.
- Prefer staging or lab environments when testing disruptive authentication behavior.
- Record evidence carefully and stop testing when controls show unsafe behavior.
Avoid
- Testing production users or real breached credentials without explicit approval.
- Running brute-force or bypass tests before defining limits and monitoring contacts.
- Reporting exploit steps without clear remediation and business impact.
Frequently Asked Questions
What does this skill assess?
It assesses password policy, account lockout, enumeration, sessions, MFA, and password reset controls.
Who should use it?
Use it only for authorized security testing by trained testers, application security teams, or approved auditors.
Can it test production systems?
Production testing requires explicit written approval, defined rate limits, test accounts, and monitoring coordination.
Does it replace a full penetration test?
No. It supports authentication review, but broader application logic, infrastructure, and monitoring still need separate assessment.
What evidence should testers collect?
Collect scoped request details, timestamps, affected controls, observed behavior, screenshots when appropriate, and remediation validation notes.
How should risky tests be handled?
Run risky tests in staging when possible, use test accounts, set stop conditions, and coordinate with system owners.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/broken-authenticationRef
01171b582d636c013315c5e0d969c64f8d9cdff2
Maintenance freshness
7/18/2026
Usage
5 downloads · 84 views
File structure
📄 SKILL.md