violin/skills/access-control/SKILL.md

name, description, version, author, license, metadata

name	description	version	author	license	metadata
access-control	Use when an authorized engagement's PTT or hypothesis identifies authentication bypass, JWT weakness, IDOR, or broken authorization. Select it through the Violin receipt flow, then load the matching playbook for controlled validation and evidence.	1.0.0	Violin	MIT	hermes tags related_skills pentest access-control auth owasp pentest web-attacks

Access Control Vulnerabilities

Overview

On-demand reference skill for broken-access-control vuln classes. The pentest orchestrator routes here when a discovery endpoint or PTT entry matches authentication/authorization weakness. Each class is a self-contained playbooks/<class>.md loaded via read_file only when needed.

When to Use

• Authentication Bypass, JWT Attacks, or IDOR / broken access control identified or scoped.
• An endpoint pattern (e.g. /api/user/{id}, /admin) maps to an authz boundary.

Playbook Routing

Class	Playbook
Authentication Bypass	playbooks/auth-bypass.md
JWT Attacks	playbooks/jwt-attacks.md
IDOR / Broken Access Control	playbooks/idor-access-control.md

Common Pitfalls

• Read-only token analysis first; never forge tokens to mutate data without explicit authorization.
• Redact actual credentials/sessions in chat and evidence; store minimal proof under $ENG_DIR/evidence/.
• Read the playbook's ## Stop Conditions and ## Blocked Actions before exploit validation.

Verification Checklist

• Engagement bootstrapped (violin_guard.py check-bootstrap exit 0)
• Playbook loaded for the matched class only
• Evidence written under $ENG_DIR/evidence/