Versioned security assessment
Report ID: SA-01171B58
7/6/2026, 10:48:22 PM
broken-authentication security assessment v4
Skill Security Certification Report
Audit model: codex Latest published report
- Skill name
- broken-authentication
- Version
- v1.1
- Maintainer
- sickn33
- Coverage
- 1 Files scanned · 482 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
12 confirmed security findings require attention.
Installation context
Check the current Skill page
This page summarizes report evidence only. The Skill page provides the canonical install advisory.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most external-command detections are Markdown fence false positives, not executable backtick usage. The skill still contains high-risk authentication attack workflows, including brute-force testing, credential-stuffing evasion, MFA bypass, session fixation, JWT forgery, and password-reset account takeover techniques. Publication should require stronger authorization gating and removal or narrowing of offensive execution guidance.
Report position
Latest published report
Latest refers to the report sequence, not to artifact currentness.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
1 Files scanned · 482 Lines analyzed
26 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Commit and path bound
Artifact
Content and tree hashes bound
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 13 evidence locations
Filesystem access
May read or write local files.
Not recorded by this audit
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 40 evidence locations
Capability review items (14)
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.1
The IP is used in an account lockout bypass example with X-Forwarded-For rotation. This directly supports repeated login attempts against a target.
High
Hardcoded IP address
X-Forwarded-For: 192.168.1.2
The IP is the next rotated X-Forwarded-For value in the lockout bypass example. The context is evading authentication protections across attempts.
Medium
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6&email=admin@example.com
The URL adds an admin email parameter to a reset token to test account takeover. This is a concrete password reset abuse pattern despite using a placeholder host.
Medium
Hardcoded IP address
X-Forwarded-For: 127.0.0.1
The IP appears in a list of spoofed forwarding headers for rate-limit bypass testing. This can help evade account lockout or throttling controls if misused.
Medium
Hardcoded IP address
X-Real-IP: 127.0.0.1
The IP appears in a spoofed client IP header for rate-limit bypass testing. This can help evade throttling controls when applied to a vulnerable target.
Medium
Hardcoded IP address
X-Originating-IP: 127.0.0.1
The IP appears in an originating IP header used for rate-limit bypass testing. The context is explicit evasion of authentication rate controls.
Medium
Hardcoded IP address
X-Client-IP: 127.0.0.1
The IP appears in a client IP header used for rate-limit bypass testing. The technique can weaken brute-force defenses when a target trusts the header.
Medium
Hardcoded IP address
X-Remote-IP: 127.0.0.1
The IP appears in a remote IP header used for rate-limit bypass testing. This is an evasion technique against authentication rate controls.
Medium
Hardcoded IP address
True-Client-IP: 127.0.0.1
The IP appears in a True-Client-IP header used for rate-limit bypass testing. It can support bypass attempts if a target trusts forwarded IP values.
Low
Python HTTP libraries
response = requests.get("https://target.com/login")
The Python example uses requests in a loop to collect session cookies from a login URL. This is expected for scoped testing, but it can generate network traffic against a target if executed.
Low
Hardcoded URL
response = requests.get("https://target.com/login")
The hardcoded login URL appears inside a runnable HTTP request example. It is a placeholder, but it demonstrates live requests to an authentication endpoint.
Low
Hardcoded URL
https://target.com/login?SESSIONID=attacker_session
The URL is part of a session fixation attack scenario that sends a fixed session value to a victim. The host is illustrative, but the workflow is an account takeover technique.
Low
Hardcoded URL
https://target.com/reset?token=abc123&user=victim
The reset URL is used to demonstrate token and user parameter manipulation. It is a placeholder, but the surrounding workflow tests password reset abuse.
Low
Hardcoded URL
https://target.com/reset?token=a1b2c3d4e5f6
The reset link is used as an example token for password reset exploitation testing. The domain is illustrative, but the workflow can be harmful outside authorization.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (12)
RISK-001 High
System reconnaissance
"/login:username=^USER^&password=^PASS^:Invalid credentials"
The line is part of a Hydra form-based login attack command using username and password payload markers. This enables credential brute-force testing and is dangerous without authorization.
RISK-002 High
System reconnaissance
- Previous valid OTP reuse
The line names reuse of a previous valid OTP as an MFA bypass technique. That is a direct authentication bypass test with account takeover impact.
RISK-003 High
System reconnaissance
# Try changing user parameter while using valid token
The line instructs changing the user parameter while using a valid reset token. This is a password reset account takeover technique.
RISK-004 High
Network reconnaissance
- Skip MFA step by direct URL access
The line suggests skipping MFA through direct URL access. This is an authentication bypass technique that can lead to account takeover.
RISK-005 High
Credential Attack and Evasion Workflow
The skill provides brute-force and credential-stuffing procedures, including Hydra usage, breached credential pairs, and source IP or user-agent rotation guidance.
The cited sections explicitly cover brute force testing, credential stuffing, credential payloads, and lockout bypass via IP rotation. Authorization language exists, but the procedures are directly usable for account attack workflows.
RISK-006 High
MFA Bypass Workflow
The skill instructs OTP brute forcing, direct URL MFA skipping, response manipulation, empty OTP submission, OTP reuse, and API version downgrade testing.
The MFA section lists multiple concrete bypass methods and payload strategies. These are legitimate in a lab, but harmful if applied outside authorized scope.
RISK-007 High
Account Takeover Through Session and Reset Abuse
The skill describes session fixation and password reset token manipulation workflows that can transfer or reset another user account.
The cited sections describe fixed-session victim login and changing reset user parameters. These are clear account takeover paths when controls are vulnerable.
RISK-008 High
JWT Token Forgery Workflow
The skill walks through modifying a JWT to use the none algorithm, changing the role to admin, and submitting the modified bearer token.
The example gives a complete token forgery flow with role escalation and replay. It is clearly a security test, but it is operationally useful for unauthorized privilege escalation.
RISK-009 Medium
System reconnaissance
# Compare responses for valid vs invalid usernames
The line instructs comparing valid and invalid username responses. This is username enumeration testing and can disclose account existence if used against an unauthorized target.
RISK-010 Medium
System reconnaissance
# Invalid: "Invalid username" vs Valid: "Invalid password"
The line gives differential error messages for valid and invalid usernames. That is a concrete account enumeration signal.
RISK-011 Medium
Network reconnaissance
# Recovery process
The recovery-process section asks whether MFA can be disabled via email alone. This is a valid security test, but it also identifies account recovery bypass opportunities.
RISK-012 Low
System reconnaissance
username=valid&password=valid
The credentials appear inside a session fixation validation flow. It can be legitimate with test accounts, but it still supports checking whether a fixed session remains usable after login.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighCredential attack procedures include brute-force commands, breached credential workflows, and evasion tactics.Replace executable attack steps with defensive validation checklists, safe lab examples, and rate-limit verification guidance.
- FIX-002HighMFA, session fixation, JWT forgery, and password reset sections provide operational account takeover workflows.Reframe these sections as control checks with expected secure behavior and remove step-by-step exploit replay instructions.
- FIX-003MediumNetwork testing guidance can be applied to real systems without an explicit runtime authorization gate.Require clear confirmation of written authorization, target scope, and test accounts before any network-facing testing steps.
- FIX-004LowExamples use public-looking domains and realistic account identifiers.Use reserved documentation domains, local lab targets, and non-sensitive placeholder identities throughout the examples.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- 01171b582d636c013315c5e0d969c64f8d9cdff2
- Content hash
- 429997be34ffd6b1a2f5fbe26e45ba82ea711b835578da09c3289db917ca5edf
- Tree hash
- aaf2ac8338841ab038221cd768f835c58b3df8aa66dabedf49157eef5ae7c288
- Skill path
- skills/sickn33/broken-authentication
- Audit payload hash
- c1c2370e15004d09702e28a2f07f9367
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable