Strix•功能级授权缺陷
Strix 功能级授权缺陷测试手册,覆盖操作级权限失效、管理功能越权与 API 操作绕过;触发名:strix-broken-function-level-authorization
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-broken-function-level-authorization --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Broken Function Level Authorization (BFLA) BFLA is action-level authorization failure: callers invoke functions (endpoints, mutations, admin tools) they are not entitled to. It appears when enforcement differs across transports, gateways, roles, or when services trust client hints. Bind subject × action at the service that performs the action. ## Attack Surface - Vertical authz: privileged/admin/staff-only actions reachable by basic users - Feature gates: toggles enforced at edge/UI, not at core services - Transport drift: REST vs GraphQL vs gRPC vs WebSocket with inconsistent checks - Gateway trust: backends trust X-User-Id/X-Role injected by proxies/edges - Background workers/jobs performing actions without re-checking authz ## High-Value Actions - Role/permission changes, impersonation/sudo, invite/accept into orgs - Approve/void/refund/credit issuance, price/plan overrides - Export/report generation, data deletion, account suspension/reactivation - Feature flag toggles, quota/grant adjustments, license/seat changes - Security settings: 2FA reset, email/phone verification overrides ## Reconnaissance ### Surface Enumeration - Admin/staff consoles and APIs, support tools, intern
- Attack Surface
- High-Value Actions
- Reconnaissance
- Surface Enumeration
- Signals
- Key Vulnerabilities
- Verb Drift and Aliases
- Edge vs Core Mismatch
- Feature Flag Bypass
- Batch Job Paths
- Content-Type Paths
- Advanced Techniques
- GraphQL
- gRPC
What does the Strix•功能级授权缺陷 skill do?
Strix 功能级授权缺陷测试手册,覆盖操作级权限失效、管理功能越权与 API 操作绕过;触发名:strix-broken-function-level-authorization
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-broken-function-level-authorization --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.