Versioned security assessment

Report ID: SA-F2AB5723

6/30/2026, 12:30:18 PM

broken-authentication security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
broken-authentication
Version
v2
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/broken-authentication
Coverage
1 Files scanned · 482 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static command execution and network findings are mostly Markdown examples, not executable package code, so those scanner hits are false positives for embedded malware. The skill is still high risk because it gives actionable brute force, credential stuffing, MFA bypass, lockout bypass, and account takeover testing workflows, including evasion tactics. No prompt injection attempt was found in SKILL.md.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 482 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 5 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 5 evidence locations

Capability review items (6)
High
SKILL.md:106-162SKILL.md:333-357
Actionable Brute Force and Credential Stuffing Guidance
The skill instructs users to run password guessing and credential stuffing tests, including Hydra usage, breached credential lists, and detection evasion tactics such as rotating source IPs and randomizing user agents. This is dual-use content that can enable unauthorized account compromise if used outside a written test scope.
The cited sections explicitly describe brute force tooling, breached credential inputs, and evasion behavior. The skill includes authorization language, so malicious intent is not confirmed, but the abuse potential is clear.
High
SKILL.md:255-279SKILL.md:428-447
Authentication Bypass and Token Tampering Playbooks
The skill provides step-by-step testing for OTP bypass, direct MFA step skipping, response manipulation, JWT none algorithm abuse, and submission of modified authorization tokens. These workflows are actionable exploitation guidance for account privilege escalation.
The semantic context confirms exploitation workflows, not just abstract vulnerability descriptions. The examples are framed as testing, which keeps this below confirmed malicious intent.
High
SKILL.md:218-226SKILL.md:297-316SKILL.md:449-468
Account Takeover Workflow Examples
The skill describes session fixation, password reset token manipulation, host header injection in reset flows, and changing reset parameters toward another account. These examples can guide unauthorized access if copied against real services.
The cited material gives concrete account takeover scenarios and parameter manipulation steps. Authorization constraints are present elsewhere, so this is high risk rather than confirmed malicious.
Medium
SKILL.md:181-189SKILL.md:233-249
Production Network Interaction Examples
The skill includes examples that send HTTP requests to target applications and collect session cookies. These are expected for security testing, but they require explicit scope controls and could affect real systems if used carelessly.
The network behavior is documented in examples and appears intended for authorized assessment. Risk remains because the examples interact with authentication endpoints and session state.
Low
SKILL.md:49-83SKILL.md:110-123SKILL.md:432-447
Markdown Code Fence Detected as Ruby Backtick Execution
The static analyzer flagged many fenced Markdown blocks as Ruby or shell backtick execution. SKILL.md is documentation and no executable Ruby file or package script is present, so these detections are false positives for embedded command execution.
The flagged patterns appear inside Markdown code fences or prose examples. No evidence of executable Ruby backtick calls was found in the only scanned file.
Low
SKILL.md:189SKILL.md:224SKILL.md:372-379SKILL.md:459-467
Placeholder URLs and IP Headers Detected as Network Indicators
Hardcoded URLs and IP addresses are placeholder target examples and HTTP header examples, not evidence of calls to attacker-controlled infrastructure. They still indicate that the skill teaches network-facing authentication tests.
The URLs use generic target.com examples and the IP addresses are local or private header values. This supports a false positive for exfiltration or command-and-control infrastructure.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (1)
Low
SKILL.md:428-447SKILL.md:181-189
Weak Crypto and C2 Keyword Matches Are Contextual False Positives
Static matches for weak cryptography and C2 keywords appear in authentication testing context, such as JWT algorithm testing and bearer token examples. No evidence found of malware, command-and-control behavior, or cryptographic implementation code.
The suspicious strings are documentation examples for authentication weaknesses. The file contains no runnable cryptographic library implementation or C2 client.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable