From appsec
This skill should be used when the user asks to "check for access control issues", "analyze authorization", "find IDOR vulnerabilities", "audit CORS configuration", "check for privilege escalation", or mentions "access control", "authorization", "IDOR", "CORS", "JWT tampering", or "directory traversal" in a security context. Maps to OWASP Top 10 2021 A01: Broken Access Control.
npx claudepluginhub florianbuetow/claude-code --plugin appsecThis skill uses the workspace's default tool permissions.
Analyze source code for broken access control vulnerabilities including missing
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Identifies anti-debugging checks like IsDebuggerPresent, NtQueryInformationProcess in Windows binaries; suggests bypasses via patches/hooks/scripts for malware analysis, CTFs, authorized RE.
Analyze source code for broken access control vulnerabilities including missing authorization checks, insecure direct object references, CORS misconfiguration, JWT manipulation, directory traversal, and privilege escalation.
Read ../../shared/schemas/flags.md for the full flag specification. This skill
supports all cross-cutting flags. Key flags for this skill:
--scope determines which files to analyze (default: changed)--depth standard reads code and checks middleware chains--depth deep traces authorization across call graphs and middleware stacks--severity filters output (access control issues are often high or critical)Read ../../shared/frameworks/owasp-top10-2021.md, section A01:2021 - Broken
Access Control, for the full category description, common vulnerabilities, and
prevention guidance.
Key CWEs in scope:
Read references/detection-patterns.md for the full catalog of code patterns,
search heuristics, language-specific examples, and false positive guidance.
Parse flags and resolve the file list per ../../shared/schemas/flags.md.
Filter to files likely to contain access control logic:
**/routes/**, **/controllers/**, **/handlers/**)**/middleware/**, **/middlewares/**)**/auth/**, **/authz/**, **/policies/**, **/guards/**)**/api/**, **/endpoints/**)Detect scanners per ../../shared/schemas/scanners.md:
semgrep — primary scanner for access control patternsbandit — Python-specific authorization issuesbrakeman — Rails mass assignment and authorization bypassesRecord which scanners are available and which are missing.
If semgrep is available, run with rules targeting access control:
semgrep scan --config auto --json --quiet <target>
Filter results to rules matching access control, authorization, CORS, JWT, and IDOR patterns. Normalize output to the findings schema.
Regardless of scanner availability, perform manual code analysis:
When --depth deep, additionally trace:
Format output per ../../shared/schemas/findings.md using the AC prefix
(e.g., AC-001, AC-002).
Include for each finding:
These are the high-signal patterns specific to broken access control. Each
maps to a detection pattern in references/detection-patterns.md.
Routes without authorization middleware — Endpoints that handle sensitive data or mutations but have no auth middleware in their chain.
Direct object references without ownership — Database lookups using
req.params.id or similar without filtering by the authenticated user.
CORS wildcard or reflection — Access-Control-Allow-Origin: * or
reflecting the Origin header without validation, especially with credentials.
JWT claims used without verification — Reading JWT payload without verifying signature, or trusting client-supplied role/permission claims.
Path traversal via user input — File operations using user-supplied paths without canonicalization or allowlist validation.
Missing function-level access control — Admin endpoints accessible to regular users, or API actions without role verification.
Forced browsing to predictable URLs — Sequential IDs or predictable resource paths without authorization checks.
Horizontal privilege escalation — Users can access other users' data by changing an identifier, with no server-side ownership verification.
| Scanner | Coverage | Command |
|---|---|---|
| semgrep | IDOR, missing auth middleware, CORS, JWT issues | semgrep scan --config auto --json --quiet <target> |
| bandit | Python authorization patterns | bandit -r <target> -f json -q |
| brakeman | Rails mass assignment, authorization | brakeman -q -f json -o /dev/stdout |
Fallback (no scanner): Use Grep with patterns from references/detection-patterns.md
to find route definitions, database queries with user-controlled IDs, CORS headers,
and JWT decode calls. Report findings with confidence: medium.
Relevant semgrep rule categories:
python.django.security.audit.unvalidated-*javascript.express.security.audit.missing-auth-*java.spring.security.audit.missing-authorizationgeneric.cors.security.wildcard-originUse the findings schema from ../../shared/schemas/findings.md.
AC (e.g., AC-001)access-controlowaspA01A01:2021E (Elevation of Privilege) or I (Information Disclosure)Severity guidance for this category: