SSkillEngineering
Route Auth Sweep (Claude Code)
claude codesecurityAPIengineeringfree
Sample outputCaptured sample. Not a live run.
Routes enumerated: 25
CRITICAL
usersRoute.ts:12 GET /users/:id — trusts body id
reachable by: any signed-in user
leaks: other users' personal data
CRITICAL
ordersRoute.ts:20 GET /orders/:id — unscoped query
reachable by: any signed-in user
leaks: other users' order history
MEDIUM
productsRoute.ts:50 — missing rate limit
usersRoute.ts:30 — missing CSRF
VERIFIED SAFE
20 routes gate correctly
(list: login, logout, signup, healthcheck, ...)
the checklist must total 25
Generated from this listing's real file at upload. The full output is in your download.
⛨Free, and yours to run in your own tools. No account needed.
TypeSkillCategoryEngineeringRuns onClaude CodeLicenseStandard license
⛨Human-reviewedEvery listing checked before it goes live
⛨Source-stampedCarries a visible line saying where it came from
⛨Real reviewsOnly verified buyers can rate it
A Claude Code skill that enumerates every API route and checks each one gates before querying: authentication, ownership scoping, role checks, rate limiting, CSRF on mutations, and webhook signature verification. Built around the finding that matters most, which is not a missing login but a route that authenticates you and then trusts an id from the request to decide whose record to return.
- ✓1 .md (SKILL.md) file (6 KB), instant download
- ✓Runs on Claude Code
- ✓Version 1.0.0, all v1.x updates included free
