mass-assignment-anti-pattern

What problem does it solve?

This Skill protects applications from privilege escalation and unauthorized data modification by detecting and preventing mass assignment vulnerabilities, where user input is directly mapped to sensitive object properties.

Core Features & Use Cases

• Vulnerability Detection: Identifies insecure code patterns where user-supplied data is directly used to update application models or objects.
• Secure Coding Guidance: Provides clear "BAD" and "GOOD" code examples demonstrating how to implement allowlists or Data Transfer Objects (DTOs) for safe property binding.
• Use Case: When reviewing a user profile update API, this skill can flag if the API directly binds incoming JSON fields to the User model, potentially allowing an attacker to set isAdmin: true.

Quick Start

Use the mass-assignment-anti-pattern skill to review the provided Python code for insecure direct object updates.