Versioned security assessment

Report ID: SA-01171B58

7/6/2026, 10:52:49 PM

broken-authentication-testing security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
broken-authentication-testing
Version
v3
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/web-app/public/skills/broken-authentication
Coverage
1 Files scanned · 477 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

11 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most external-command detections are false positives caused by Markdown code fences, not executable backtick usage. Several network and blocker findings are confirmed because the skill provides actionable guidance for credential attacks, rate-limit evasion, MFA bypass, session fixation, and password reset account takeover testing. No prompt injection attempt was found in SKILL.md.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 477 Lines analyzed

24 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 13 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 40 evidence locations

Capability review items (13)
High
SKILL.md:222
Hardcoded URL
https://target.com/login?SESSIONID=attacker_session
The URL appears inside an attacker session-fixation workflow involving a victim login. This is actionable account takeover guidance if used outside an authorized lab.
High
SKILL.md:306
Hardcoded URL
https://target.com/reset?token=abc123&user=victim
The reset URL demonstrates changing a user parameter while using a valid reset token. That pattern can support password reset account takeover testing or abuse.
High
SKILL.md:465
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
The reset URL changes the email parameter to an admin account and asks whether an admin password can be reset. This is direct account takeover guidance.
Medium
SKILL.md:371
Hardcoded IP address
X-Forwarded-For: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
SKILL.md:372
Hardcoded IP address
X-Real-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
SKILL.md:373
Hardcoded IP address
X-Originating-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
SKILL.md:374
Hardcoded IP address
X-Client-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
SKILL.md:375
Hardcoded IP address
X-Remote-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
SKILL.md:376
Hardcoded IP address
True-Client-IP: 127.0.0.1
The IP appears under rate-limiting bypass headers. Even though it is an example value, the surrounding guidance teaches evasion of IP-based controls.
Medium
SKILL.md:413
Hardcoded IP address
X-Forwarded-For: 192.168.1.1
The private IP is used in an account lockout bypass example that rotates X-Forwarded-For values. The context is evasion of authentication rate limits.
Medium
SKILL.md:417
Hardcoded IP address
X-Forwarded-For: 192.168.1.2
The private IP is used in an account lockout bypass example that rotates X-Forwarded-For values. The context is evasion of authentication rate limits.
Low
SKILL.md:187
Python HTTP libraries
response = requests.get("https://target.com/login")
The Python example performs repeated HTTP requests to a target login endpoint to collect session tokens. This is expected security-testing behavior but still creates network activity against a target application.
Low
SKILL.md:187
Hardcoded URL
response = requests.get("https://target.com/login")
The hardcoded URL is a placeholder in a copyable token-collection example. It is not a hidden callback, but it normalizes active requests against a login endpoint.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (11)

RISK-001 High
SKILL.md:112
System reconnaissance
"/login:username=^USER^&password=^PASS^:Invalid credentials"
The Hydra form string supports automated password attempts against a login endpoint. It is actionable brute-force guidance despite the authorized-testing framing.
RISK-002 High
SKILL.md:263
System reconnaissance
- Previous valid OTP reuse
The OTP reuse item identifies a concrete MFA bypass condition. The use is dual-use and can support unauthorized access if misapplied.
RISK-003 High
SKILL.md:307
System reconnaissance
# Try changing user parameter while using valid token
The instruction to change a user parameter while using a valid token targets password reset authorization logic. This can support account takeover.
RISK-004 High
SKILL.md:260-261
Network reconnaissance
- Skip MFA step by direct URL access
The text recommends skipping the MFA step through direct URL access and response modification. This is actionable authentication bypass guidance.
RISK-005 High
SKILL.md:141-160
Credential Stuffing And Evasion Guidance
The skill instructs testing with breached credential pairs and includes detection evasion steps such as slow rates, IP rotation, randomized user agents, and delays.
The guidance explicitly combines credential stuffing with evasion techniques. Written authorization is mentioned elsewhere, but the operational abuse content is clear.
RISK-006 High
SKILL.md:253-277
MFA Bypass And OTP Attack Workflow
The skill describes OTP brute force, direct MFA step skipping, response modification, OTP reuse, and API version downgrade testing to bypass MFA controls.
The cited section provides multiple concrete MFA bypass techniques and validation steps. These techniques are dual-use but clearly actionable.
RISK-007 High
SKILL.md:216-225
Session Fixation Account Takeover Scenario
The skill gives an attacker workflow where a victim logs in with a fixed attacker-controlled session and the attacker gains an authenticated session.
The section is framed as an attacker scenario and explains the victim interaction needed for session takeover. This is direct exploitation context.
RISK-008 High
SKILL.md:305-314SKILL.md:464-466
Password Reset Account Takeover Testing
The skill includes reset-token user manipulation, host header injection, and admin email parameter tampering to test whether another account can be reset.
The cited steps target password reset authorization and email routing flaws that can lead to account takeover. The examples are specific and operational.
RISK-009 Medium
SKILL.md:90
System reconnaissance
# Compare responses for valid vs invalid usernames
The text instructs comparing valid and invalid username responses. This is useful for authorized testing but can enable username enumeration.
RISK-010 Medium
SKILL.md:91
System reconnaissance
# Invalid: "Invalid username" vs Valid: "Invalid password"
The text gives example differential errors for valid and invalid usernames. This can help enumerate accounts before credential attacks.
RISK-011 Medium
SKILL.md:286-287
Network reconnaissance
# Recovery process
The recovery-process checks can expose ways to disable MFA through account recovery. Legitimate testing is possible, but the business-logic abuse risk is real.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Credential stuffing and brute-force procedures include operational attack steps.
    Replace attack workflows with defensive checklists, safe rate-limit validation, and lab-only test account procedures.
  2. FIX-002
    High
    Detection evasion guidance covers IP rotation, user-agent randomization, and bypass headers.
    Remove evasion tactics and focus on verifying that controls detect or block these attempts.
  3. FIX-003
    High
    MFA, session fixation, and password reset sections include account takeover workflows.
    Rewrite examples to describe expected secure behavior, evidence to collect, and remediation without victim or admin takeover steps.
  4. FIX-004
    Medium
    Copyable command and request examples can be run against real services.
    Use clearly labeled lab targets, non-routable examples, and explicit authorization gates before active testing steps.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable