auth-vulnerabilities_skill

Overview

This skill helps you find and understand authentication and authorization defects commonly produced by AI-generated code. It highlights insecure password storage, broken session management, and access control bypasses, and explains why AI suggests unsafe patterns like MD5 or predictable session IDs. The goal is to teach practical fixes and detection cues so you can harden AI-suggested code before deployment.

How this skill works

The skill inspects code patterns and examples to identify insecure password handling (plaintext, MD5/SHA1), weak session implementations (predictable IDs, missing expiration, insecure cookies), and missing authorization checks. It explains the root causes—training data bias, simplicity shortcuts, and lack of security reasoning—and maps each issue to a secure alternative and configuration recommendations. It also provides short, concrete remediation steps and realistic attack scenarios to prioritize fixes.

When to use it

• Review AI-suggested auth code before merging to production
• Audit legacy code that mirrors AI-recommended patterns
• Train teams to recognize common AI-generated auth anti-patterns
• Assess pull requests with quick heuristics for password/session flaws
• Integrate into secure code review or CI linting guidance

Best practices

• Never accept plaintext or fast hashes; require bcrypt/Argon2 with per-password salt and a cost factor
• Use cryptographically secure session IDs, server-side session stores (Redis), and set httpOnly, secure, and sameSite cookies
• Enforce session expiration, renewal, IP/user-agent consistency, and rate limiting on auth endpoints
• Separate authentication (identity) from authorization (permissions); always check resource-level permissions server-side
• Prefer managed auth providers (Clerk, Auth0) or vetted libraries to reduce custom-auth risks

Example use cases

• Detect AI code that stores passwords with hashlib.md5 or plain strings and recommend bcrypt/Argon2
• Identify session code creating IDs from username+timestamp and replace with crypto.randomBytes
• Flag endpoints that require login but do not check resource ownership or roles
• Add middleware templates that validate sessions, renew TTLs, and enforce cookie security flags
• Create training snippets showing attack vectors: session hijack, fixation, and authorization bypass