Agent skill · security · sickn33
django-access-review
Use when reviewing Django or DRF access control: trace authorization flows, IDOR risks, object permissions, query scoping and tenant isolation before proposing a verified fix.
Why this skill is useful
Provides domain-specific knowledge on identifying access control vulnerabilities in Django applications, including specific investigation commands and methodologies.
What it needs
About 7k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
<!-- Reference material based on OWASP Cheat Sheet Series (CC BY-SA 4.0) https://cheatsheetseries.owasp.org/ --> Django Access Control & IDOR Review Find access control vulnerabilities by investigating how the codebase answers one question: Can User A access, modify, or delete User B's data? When to Use You need to review Django or DRF code for access control gaps, IDOR risk, or object-level authorization failures. The task involves confirming whether one user can access, modify, or delete another user's data. You want an investigation-driven authorization review instead of generic pattern matching. Philosophy: Investigation Over Pattern Matching Do NOT scan for predefined vulnerable patterns. Instead: 1. Understand how authorization works in THIS codebase 2. Ask questions about specific data flows 3. Trace code to find where (or if) access checks happen 4. Report only what you've confirmed through investigation Every codebase implements authorization differently. Your job is to understand this specific implementation, then find gaps. --- Phase 1: Understand the Authorization Model Before looking for bugs, answer these questions about the codebase: How is authorization enforced? Research the codebase to find: Investigation commands Do not proceed until you understand the authorization model. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/django-access-review--f24941