Versioned security assessment

Report ID: SA-ADD08203

6/30/2026, 12:33:23 PM

broken-authentication-testing security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
broken-authentication-testing
Version
v2
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/web-app/public/skills/broken-authentication
Coverage
1 Files scanned · 477 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The static backtick, URL, IP address, C2, and weak-crypto findings are mostly false positives caused by fenced Markdown examples and placeholder values. However, the skill gives operational guidance for brute force testing, credential stuffing, detection evasion, MFA bypass, JWT tampering, and reset-token abuse, so publication should require human review and stronger safety constraints.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 477 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 13 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 40 evidence locations

Capability review items (5)
High
SKILL.md:104-120SKILL.md:141-160
Offensive Credential Attack Guidance
The skill includes concrete workflows for brute force testing and credential stuffing, including Hydra usage, breached credential pairs, response analysis, and successful login detection. This is dual-use penetration testing content, but it can materially enable account takeover if used without authorization.
The lines explicitly describe automated login attacks and credential stuffing workflows. The document states authorization requirements elsewhere, but the attack steps are still operational.
High
SKILL.md:249-277SKILL.md:426-445
Authentication Bypass and Token Tampering Playbook
The skill documents MFA bypass approaches, API downgrade testing, OTP brute force, JWT none-algorithm tampering, and bearer token submission. These techniques can support valid assessments, but they also provide direct bypass methods against real accounts.
The cited sections contain explicit bypass and token modification instructions. The context is security testing, but the instructions are directly actionable.
High
SKILL.md:155-159SKILL.md:368-377SKILL.md:401-424
Rate Limit Evasion Guidance
The skill advises IP rotation, user-agent randomization, delays, X-Forwarded-For bypass testing, and per-attempt IP changes. This guidance can help validate defenses, but it also teaches evasion of controls that protect login endpoints.
The content directly discusses bypassing lockouts and rate limits with source IP manipulation. This is high-risk even when presented as an authorized test.
Medium
SKILL.md:197-225SKILL.md:291-314SKILL.md:447-467
Session Fixation and Password Reset Abuse Scenarios
The skill provides attack scenarios for fixed sessions, host header manipulation, reset-token user parameter changes, and resetting another user's password with a test token. These are valid test cases but expose sensitive abuse workflows.
The cited examples describe specific account takeover paths. The content remains framed as testing, so this is moderate to high dual-use risk rather than confirmed malicious intent.
Low
SKILL.md:187SKILL.md:222SKILL.md:371-376SKILL.md:457-465
Placeholder Network Values Are Not Exfiltration
The hardcoded URLs and IP addresses use placeholder domains or local/private addresses for test examples. I found no evidence that the skill sends data to an author-controlled endpoint.
The URLs point to target.com examples and the IPs are loopback or private examples. There is no author-controlled collection endpoint in the reviewed file.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:47-60SKILL.md:108-121SKILL.md:430-445
Static Backtick Command Findings Are Mostly False Positives
The external command detector flagged many fenced Markdown blocks as Ruby or shell backtick execution. The reviewed file is documentation, not executable Ruby code, so these locations do not show direct command execution by the skill.
The flagged backticks are Markdown code fences, not language-level execution syntax. The examples are still high-risk by content, but not because the skill executes commands.
Low
SKILL.md:3SKILL.md:432-444
C2 and Weak-Crypto Static Blockers Are Contextual False Positives
The C2 keyword detections correspond to bearer tokens in JWT examples, and the weak-crypto detections appear in authentication terminology and JWT algorithm discussion. I found no evidence of malware control logic or implemented weak cryptography.
The suspicious tokens are part of explanatory web security examples. The file does not contain executable malware logic or cryptographic implementation code.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable