What problem does it solve? Web applications often accept sensitive values like userId, role, price, XP, permissions, ownership, status, reward, and timestamps directly from request payloads, letting attackers forge identity, escalate privileges, or manipulate prices. This Skill guides an agent to systematically audit endpoints and verify the server derives these values from the session or database rather than trusting the client. ## Core Features & Use Cases - Authority Value Classification: Enumerates every field an endpoint accepts and labels each as non-sensitive input or an authority value (identity, permission, value, state, order). - Derive-vs-Accept Verification: Traces where each authority value comes from — session token, database, server-side calculation, or the raw request body. - Mass Assignment & Forgery Testing: Sends fields the UI never submits (e.g., role=admin, price=0, xp=99999) to confirm whether the server binds and persists them. - Use Case: While reviewing a checkout endpoint, you discover the handler reads price from the request body. The Skill walks you through forging price=0, confirming the free checkout, and reporting it with a confidence-scaled finding. ## Quick Start Audit the checkout and profile endpoints for client-supplied authority values like role, price, and userId, and report any the server accepts from the request body.
