testing-api-for-mass-assignment-vulnerability
testing-api-for-mass-assignment-vulnerability is a Penetration testing & red team skill for AI agents, published by mukul975 in the Anthropic-Cybersecurity-Skills repository on GitHub. Skillspace rates testing-api-for-mass-assignment-vulnerability A (90/100) and it passed the safety scan; a judge model has also reviewed it.
Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if the server binds these to the data model without filtering. Part of OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving mass assignment testing, parameter binding abuse, auto-binding vulnerability, or API over-posting.
- Grade
- A
- Quality
- 90 / 100
- Safety
- Passed
- GitHub stars
- 25,639
Placed #2 of 6 in the judged category final for Penetration testing & red team.
This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.
Our review
- Architecture
- 100 / 100
- Maturity
- Packaged: licensed, with a version or references
- Security scan
- Low-risk patterns
- License
- Apache-2.0
- Adoption
- Adopted by 0 other repositories, in 1 collections
- Scope
- Portable: works in any project. General OWASP API security testing methodology.
Judge review
Placed #2 of 6 in the judged category final for Penetration testing & red team.
- Trigger
75 75 - Instructions
88 88 - Specificity
92 92 - Safety
88 88 - Disclosure
55 55 - Maintenance
55 55
Concrete and current (OWASP API3:2023), gated behind an explicit written-authorization requirement, and backed by real runnable field-fuzzing Python.
What the scanner flagged
- mentions secrets in text
Not checked yet
- No blind task eval yet
- Sibling files (scripts, references) not fetched; security scan covers SKILL.md only
Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.