📦
Audit History
broken-authentication - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v4 Latest | Jul 6, 2026, 10:48 PM | 12 confirmed | 14 | No capability change |
| v3 | Jul 6, 2026, 10:48 PM | 12 confirmed | 14 | No capability change |
| v2 | Jun 30, 2026, 12:30 PM | No confirmed findings | 6 | External commandsNetwork access |
| v1 | Feb 25, 2026, 05:04 AM | No confirmed findings | 0 | Baseline |
Audit version 4 Latest
Jul 6, 2026, 10:48 PM
Most external-command detections are Markdown fence false positives, not executable backtick usage. The skill still contains high-risk authentication attack workflows, including brute-force testing, credential-stuffing evasion, MFA bypass, session fixation, JWT forgery, and password-reset account takeover techniques. Publication should require stronger authorization gating and removal or narrowing of offensive execution guidance.
1
Files scanned
482
Lines analyzed
28
Review items
0
False positives ignored
Confirmed security concerns (12)
High
System reconnaissance
"/login:username=^USER^&password=^PASS^:Invalid credentials"
The line is part of a Hydra form-based login attack command using username and password payload markers. This enables credential brute-force testing and is dangerous without authorization.
High
System reconnaissance
- Previous valid OTP reuse
The line names reuse of a previous valid OTP as an MFA bypass technique. That is a direct authentication bypass test with account takeover impact.
High
System reconnaissance
# Try changing user parameter while using valid token
The line instructs changing the user parameter while using a valid reset token. This is a password reset account takeover technique.
High
Network reconnaissance
- Skip MFA step by direct URL access
The line suggests skipping MFA through direct URL access. This is an authentication bypass technique that can lead to account takeover.
High
Credential Attack and Evasion Workflow
The skill provides brute-force and credential-stuffing procedures, including Hydra usage, breached credential pairs, and source IP or user-agent rotation guidance.
The cited sections explicitly cover brute force testing, credential stuffing, credential payloads, and lockout bypass via IP rotation. Authorization language exists, but the procedures are directly usable for account attack workflows.
High
MFA Bypass Workflow
The skill instructs OTP brute forcing, direct URL MFA skipping, response manipulation, empty OTP submission, OTP reuse, and API version downgrade testing.
The MFA section lists multiple concrete bypass methods and payload strategies. These are legitimate in a lab, but harmful if applied outside authorized scope.
High
Account Takeover Through Session and Reset Abuse
The skill describes session fixation and password reset token manipulation workflows that can transfer or reset another user account.
The cited sections describe fixed-session victim login and changing reset user parameters. These are clear account takeover paths when controls are vulnerable.
High
JWT Token Forgery Workflow
The skill walks through modifying a JWT to use the none algorithm, changing the role to admin, and submitting the modified bearer token.
The example gives a complete token forgery flow with role escalation and replay. It is clearly a security test, but it is operationally useful for unauthorized privilege escalation.
Medium
System reconnaissance
# Compare responses for valid vs invalid usernames
The line instructs comparing valid and invalid username responses. This is username enumeration testing and can disclose account existence if used against an unauthorized target.
Medium
System reconnaissance
# Invalid: "Invalid username" vs Valid: "Invalid password"
The line gives differential error messages for valid and invalid usernames. That is a concrete account enumeration signal.
Medium
Network reconnaissance
# Recovery process
The recovery-process section asks whether MFA can be disabled via email alone. This is a valid security test, but it also identifies account recovery bypass opportunities.
Low
System reconnaissance
username=valid&password=valid
The credentials appear inside a session fixation validation flow. It can be legitimate with test accounts, but it still supports checking whether a fixed session remains usable after login.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.1
The IP is used in an account lockout bypass example with X-Forwarded-For rotation. This directly supports repeated login attempts against a target.
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.2
The IP is the next rotated X-Forwarded-For value in the lockout bypass example. The context is evading authentication protections across attempts.
Medium
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
The URL adds an admin email parameter to a reset token to test account takeover. This is a concrete password reset abuse pattern despite using a placeholder host.
Medium
Hardcoded IP address
X-Forwarded-For: 127.0.0.1
The IP appears in a list of spoofed forwarding headers for rate-limit bypass testing. This can help evade account lockout or throttling controls if misused.
Medium
Hardcoded IP address
X-Real-IP: 127.0.0.1
The IP appears in a spoofed client IP header for rate-limit bypass testing. This can help evade throttling controls when applied to a vulnerable target.
Medium
Hardcoded IP address
X-Originating-IP: 127.0.0.1
The IP appears in an originating IP header used for rate-limit bypass testing. The context is explicit evasion of authentication rate controls.
Medium
Hardcoded IP address
X-Client-IP: 127.0.0.1
The IP appears in a client IP header used for rate-limit bypass testing. The technique can weaken brute-force defenses when a target trusts the header.
Medium
Hardcoded IP address
X-Remote-IP: 127.0.0.1
The IP appears in a remote IP header used for rate-limit bypass testing. This is an evasion technique against authentication rate controls.
Medium
Hardcoded IP address
True-Client-IP: 127.0.0.1
The IP appears in a True-Client-IP header used for rate-limit bypass testing. It can support bypass attempts if a target trusts forwarded IP values.
Low
Python HTTP libraries
response = requests.get("https://target.com/login")
The Python example uses requests in a loop to collect session cookies from a login URL. This is expected for scoped testing, but it can generate network traffic against a target if executed.
Low
Hardcoded URL
response = requests.get("https://target.com/login")
The hardcoded login URL appears inside a runnable HTTP request example. It is a placeholder, but it demonstrates live requests to an authentication endpoint.
Low
Hardcoded URL
https://target.com/login?SESSIONID=attacker_session
The URL is part of a session fixation attack scenario that sends a fixed session value to a victim. The host is illustrative, but the workflow is an account takeover technique.
Low
Hardcoded URL
https://target.com/reset?token=abc123&user=victim
The reset URL is used to demonstrate token and user parameter manipulation. It is a placeholder, but the surrounding workflow tests password reset abuse.
Low
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6
The reset link is used as an example token for password reset exploitation testing. The domain is illustrative, but the workflow can be harmful outside authorization.
Risk Factors
⚙️ External commands (40)
SKILL.md:49-62 SKILL.md:62-66 SKILL.md:66-72 SKILL.md:72-78 SKILL.md:78-83 SKILL.md:83-91 SKILL.md:91-95 SKILL.md:95-104 SKILL.md:104-110 SKILL.md:110-123 SKILL.md:123-127 SKILL.md:127-141 SKILL.md:141-147 SKILL.md:147-162 SKILL.md:162-168 SKILL.md:168-177 SKILL.md:177-181 SKILL.md:181-197 SKILL.md:197-203 SKILL.md:203-216 SKILL.md:216-220 SKILL.md:220-227 SKILL.md:227-233 SKILL.md:233-249 SKILL.md:249-255 SKILL.md:255-279 SKILL.md:279-283 SKILL.md:283-291 SKILL.md:291-297 SKILL.md:297-316 SKILL.md:316-335 SKILL.md:335-357 SKILL.md:357-372 SKILL.md:372-379 SKILL.md:379-407 SKILL.md:407-426 SKILL.md:426-432 SKILL.md:432-447 SKILL.md:447-453 SKILL.md:453-469
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceNetwork reconnaissanceNetwork reconnaissance
Audited by: codex
Jul 6, 2026, 10:48 PM
Most external-command detections are Markdown fence false positives, not executable backtick usage. The skill still contains high-risk authentication attack workflows, including brute-force testing, credential-stuffing evasion, MFA bypass, session fixation, JWT forgery, and password-reset account takeover techniques. Publication should require stronger authorization gating and removal or narrowing of offensive execution guidance.
1
Files scanned
482
Lines analyzed
28
Review items
0
False positives ignored
Confirmed security concerns (12)
High
System reconnaissance
"/login:username=^USER^&password=^PASS^:Invalid credentials"
The line is part of a Hydra form-based login attack command using username and password payload markers. This enables credential brute-force testing and is dangerous without authorization.
High
System reconnaissance
- Previous valid OTP reuse
The line names reuse of a previous valid OTP as an MFA bypass technique. That is a direct authentication bypass test with account takeover impact.
High
System reconnaissance
# Try changing user parameter while using valid token
The line instructs changing the user parameter while using a valid reset token. This is a password reset account takeover technique.
High
Network reconnaissance
- Skip MFA step by direct URL access
The line suggests skipping MFA through direct URL access. This is an authentication bypass technique that can lead to account takeover.
High
Credential Attack and Evasion Workflow
The skill provides brute-force and credential-stuffing procedures, including Hydra usage, breached credential pairs, and source IP or user-agent rotation guidance.
The cited sections explicitly cover brute force testing, credential stuffing, credential payloads, and lockout bypass via IP rotation. Authorization language exists, but the procedures are directly usable for account attack workflows.
High
MFA Bypass Workflow
The skill instructs OTP brute forcing, direct URL MFA skipping, response manipulation, empty OTP submission, OTP reuse, and API version downgrade testing.
The MFA section lists multiple concrete bypass methods and payload strategies. These are legitimate in a lab, but harmful if applied outside authorized scope.
High
Account Takeover Through Session and Reset Abuse
The skill describes session fixation and password reset token manipulation workflows that can transfer or reset another user account.
The cited sections describe fixed-session victim login and changing reset user parameters. These are clear account takeover paths when controls are vulnerable.
High
JWT Token Forgery Workflow
The skill walks through modifying a JWT to use the none algorithm, changing the role to admin, and submitting the modified bearer token.
The example gives a complete token forgery flow with role escalation and replay. It is clearly a security test, but it is operationally useful for unauthorized privilege escalation.
Medium
System reconnaissance
# Compare responses for valid vs invalid usernames
The line instructs comparing valid and invalid username responses. This is username enumeration testing and can disclose account existence if used against an unauthorized target.
Medium
System reconnaissance
# Invalid: "Invalid username" vs Valid: "Invalid password"
The line gives differential error messages for valid and invalid usernames. That is a concrete account enumeration signal.
Medium
Network reconnaissance
# Recovery process
The recovery-process section asks whether MFA can be disabled via email alone. This is a valid security test, but it also identifies account recovery bypass opportunities.
Low
System reconnaissance
username=valid&password=valid
The credentials appear inside a session fixation validation flow. It can be legitimate with test accounts, but it still supports checking whether a fixed session remains usable after login.
Capability review items (14)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.1
The IP is used in an account lockout bypass example with X-Forwarded-For rotation. This directly supports repeated login attempts against a target.
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.2
The IP is the next rotated X-Forwarded-For value in the lockout bypass example. The context is evading authentication protections across attempts.
Medium
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
The URL adds an admin email parameter to a reset token to test account takeover. This is a concrete password reset abuse pattern despite using a placeholder host.
Medium
Hardcoded IP address
X-Forwarded-For: 127.0.0.1
The IP appears in a list of spoofed forwarding headers for rate-limit bypass testing. This can help evade account lockout or throttling controls if misused.
Medium
Hardcoded IP address
X-Real-IP: 127.0.0.1
The IP appears in a spoofed client IP header for rate-limit bypass testing. This can help evade throttling controls when applied to a vulnerable target.
Medium
Hardcoded IP address
X-Originating-IP: 127.0.0.1
The IP appears in an originating IP header used for rate-limit bypass testing. The context is explicit evasion of authentication rate controls.
Medium
Hardcoded IP address
X-Client-IP: 127.0.0.1
The IP appears in a client IP header used for rate-limit bypass testing. The technique can weaken brute-force defenses when a target trusts the header.
Medium
Hardcoded IP address
X-Remote-IP: 127.0.0.1
The IP appears in a remote IP header used for rate-limit bypass testing. This is an evasion technique against authentication rate controls.
Medium
Hardcoded IP address
True-Client-IP: 127.0.0.1
The IP appears in a True-Client-IP header used for rate-limit bypass testing. It can support bypass attempts if a target trusts forwarded IP values.
Low
Python HTTP libraries
response = requests.get("https://target.com/login")
The Python example uses requests in a loop to collect session cookies from a login URL. This is expected for scoped testing, but it can generate network traffic against a target if executed.
Low
Hardcoded URL
response = requests.get("https://target.com/login")
The hardcoded login URL appears inside a runnable HTTP request example. It is a placeholder, but it demonstrates live requests to an authentication endpoint.
Low
Hardcoded URL
https://target.com/login?SESSIONID=attacker_session
The URL is part of a session fixation attack scenario that sends a fixed session value to a victim. The host is illustrative, but the workflow is an account takeover technique.
Low
Hardcoded URL
https://target.com/reset?token=abc123&user=victim
The reset URL is used to demonstrate token and user parameter manipulation. It is a placeholder, but the surrounding workflow tests password reset abuse.
Low
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6
The reset link is used as an example token for password reset exploitation testing. The domain is illustrative, but the workflow can be harmful outside authorization.
Risk Factors
⚙️ External commands (40)
SKILL.md:49-62 SKILL.md:62-66 SKILL.md:66-72 SKILL.md:72-78 SKILL.md:78-83 SKILL.md:83-91 SKILL.md:91-95 SKILL.md:95-104 SKILL.md:104-110 SKILL.md:110-123 SKILL.md:123-127 SKILL.md:127-141 SKILL.md:141-147 SKILL.md:147-162 SKILL.md:162-168 SKILL.md:168-177 SKILL.md:177-181 SKILL.md:181-197 SKILL.md:197-203 SKILL.md:203-216 SKILL.md:216-220 SKILL.md:220-227 SKILL.md:227-233 SKILL.md:233-249 SKILL.md:249-255 SKILL.md:255-279 SKILL.md:279-283 SKILL.md:283-291 SKILL.md:291-297 SKILL.md:297-316 SKILL.md:316-335 SKILL.md:335-357 SKILL.md:357-372 SKILL.md:372-379 SKILL.md:379-407 SKILL.md:407-426 SKILL.md:426-432 SKILL.md:432-447 SKILL.md:447-453 SKILL.md:453-469
Detected Patterns
System reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceSystem reconnaissanceNetwork reconnaissanceNetwork reconnaissance
Audited by: codex
Jun 30, 2026, 12:30 PM
Static command execution and network findings are mostly Markdown examples, not executable package code, so those scanner hits are false positives for embedded malware. The skill is still high risk because it gives actionable brute force, credential stuffing, MFA bypass, lockout bypass, and account takeover testing workflows, including evasion tactics. No prompt injection attempt was found in SKILL.md.
1
Files scanned
482
Lines analyzed
8
Review items
1
False positives ignored
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Actionable Brute Force and Credential Stuffing Guidance
The skill instructs users to run password guessing and credential stuffing tests, including Hydra usage, breached credential lists, and detection evasion tactics such as rotating source IPs and randomizing user agents. This is dual-use content that can enable unauthorized account compromise if used outside a written test scope.
The cited sections explicitly describe brute force tooling, breached credential inputs, and evasion behavior. The skill includes authorization language, so malicious intent is not confirmed, but the abuse potential is clear.
High
Authentication Bypass and Token Tampering Playbooks
The skill provides step-by-step testing for OTP bypass, direct MFA step skipping, response manipulation, JWT none algorithm abuse, and submission of modified authorization tokens. These workflows are actionable exploitation guidance for account privilege escalation.
The semantic context confirms exploitation workflows, not just abstract vulnerability descriptions. The examples are framed as testing, which keeps this below confirmed malicious intent.
High
Account Takeover Workflow Examples
The skill describes session fixation, password reset token manipulation, host header injection in reset flows, and changing reset parameters toward another account. These examples can guide unauthorized access if copied against real services.
The cited material gives concrete account takeover scenarios and parameter manipulation steps. Authorization constraints are present elsewhere, so this is high risk rather than confirmed malicious.
Medium
Production Network Interaction Examples
The skill includes examples that send HTTP requests to target applications and collect session cookies. These are expected for security testing, but they require explicit scope controls and could affect real systems if used carelessly.
The network behavior is documented in examples and appears intended for authorized assessment. Risk remains because the examples interact with authentication endpoints and session state.
Low
Markdown Code Fence Detected as Ruby Backtick Execution
The static analyzer flagged many fenced Markdown blocks as Ruby or shell backtick execution. SKILL.md is documentation and no executable Ruby file or package script is present, so these detections are false positives for embedded command execution.
The flagged patterns appear inside Markdown code fences or prose examples. No evidence of executable Ruby backtick calls was found in the only scanned file.
Low
Placeholder URLs and IP Headers Detected as Network Indicators
Hardcoded URLs and IP addresses are placeholder target examples and HTTP header examples, not evidence of calls to attacker-controlled infrastructure. They still indicate that the skill teaches network-facing authentication tests.
The URLs use generic target.com examples and the IP addresses are local or private header values. This supports a false positive for exfiltration or command-and-control infrastructure.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Weak Crypto and C2 Keyword Matches Are Contextual False Positives
Static matches for weak cryptography and C2 keywords appear in authentication testing context, such as JWT algorithm testing and bearer token examples. No evidence found of malware, command-and-control behavior, or cryptographic implementation code.
The suspicious strings are documentation examples for authentication weaknesses. The file contains no runnable cryptographic library implementation or C2 client.
Risk Factors
⚙️ External commands (5)
🌐 Network access (5)
Detected Patterns
Detection Evasion in Credential AttacksRate Limit Bypass Header Guidance
Audited by: codex
Feb 25, 2026, 05:04 AM
This is a legitimate security education skill for testing authentication vulnerabilities. All static findings are false positives - the skill contains documentation and examples showing testing methodologies, not malicious code. The skill explicitly requires written authorization and is designed for authorized security testing professionals.
1
Files scanned
482
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude