agentmods.dev

bac-analyzer

bac-analyzer is a skill for Claude Code, Codex from SecurityTalent/bugskill-ai. It costs 75 tokens per session (1,600 once invoked), scanned A, original, MIT.

A passive security analyzer that reviews saved web traffic, such as browser or proxy recordings, for possible access-control problems. IDOR is a flaw where changing an object identifier may expose someone else’s data.

In plain words
What is it for?
Analyzing HAR, Caido JSON, or Burp XML traffic and looking for possible broken access control or IDOR vulnerabilities.
Why use it?
It helps spot suspicious authorization patterns without actively attacking the application. It also produces test cases and reports for follow-up checks.

Skill for Claude CodeCodex

not rated 5 18d ago A scan 75 tokens original MIT
View the source file SecurityTalent/bugskill-ai
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/securitytalent/bugskill-ai/bac-analyzer
Any agent
npx skills add SecurityTalent/bugskill-ai --skill bac-analyzer
Clone the repo
git clone --depth 1 https://github.com/SecurityTalent/bugskill-ai

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for bac-analyzer

README.md
[![agentmods](https://agentmods.dev/badge/skills/securitytalent/bugskill-ai/bac-analyzer.svg)](https://agentmods.dev/skills/securitytalent/bugskill-ai/bac-analyzer)
Your own site
<a href="https://agentmods.dev/skills/securitytalent/bugskill-ai/bac-analyzer"><img src="https://agentmods.dev/badge/skills/securitytalent/bugskill-ai/bac-analyzer.svg" alt="Measured on agentmods" height="20"></a>
Per session 75 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,600 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00075 $0.01600
Opus 5 $0.00037 $0.00800
Sonnet 5 $0.00015 $0.00320
Haiku 4.5 $0.00007 $0.00160

Measured 4d ago against content hash 2ea00c1fc8fe, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

bac-analyzer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

The scan reads SKILL.md. This mod also ships 8 executable files (scripts/analyze.sh, scripts/detect-ids.py, scripts/extract-auth.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- Copy-paste curl commands
Awesome-Claude-Code-Agent-Skills/bac-analyzer/SKILL.md · 232 lines

How it starts

The opening of the file, as written. The whole thing — 232 lines — stays where its author put it; the contents beside it link to each section on GitHub.

BAC Analyzer - Passive Traffic Analysis for IDOR/BAC Vulnerabilities

Triggers

  • "analyze traffic"
  • "check for IDOR"
  • "BAC analysis"
  • "analyze HAR"
  • "analyze Caido"
  • "broken access control"
  • "IDOR scan"

Description

Passive traffic analyzer that examines captured HTTP traffic (HAR, Caido JSON, Burp XML) to identify potential Broken Access Control (BAC) and Insecure Direct Object Reference (IDOR) vulnerabilities. Generates test cases and reports.

Input Formats

  • HAR - HTTP Archive format (browser DevTools, Caido export)
  • Caido JSON - Native Caido export format
  • Burp XML - Burp Suite proxy history export
  • Caido API - Direct pull from running Caido instance

Installation

# No external dependencies required - uses Python stdlib
chmod +x ~/.openclaw/workspace/skills/bac-analyzer/scripts/*.sh
chmod +x ~/.openclaw/workspace/skills/bac-analyzer/scripts/*.py

# Optional: Add to PATH
export PATH="$PATH:~/.openclaw/workspace/skills/bac-analyzer/scripts"

Usage

Basic Analysis

# Analyze HAR file
./analyze.sh traffic.har

# Analyze Caido export
./analyze.sh caido-export.json

# Analyze Burp XML
./analyze.sh burp-history.xml

Options

# Generate HTML report
./analyze.sh traffic.har -o report.html

# Tests only (no full report)
./analyze.sh traffic.har --tests-only

# JSON output
./analyze.sh traffic.har --json -o results.json

# Pull from Caido API (requires CAIDO_URL env var)
./analyze.sh --caido

# Verbose output
./analyze.sh traffic.har -v

Direct Script Usage

# Parse specific format
python3 parse-har.py input.har -o parsed.json

# Detect IDs in parsed traffic
python3 detect-ids.py parsed.json -o ids.json

# Extract auth contexts
python3 extract-auth.py parsed.json -o auth.json

# Generate test cases
python3 generate-tests.py ids.json auth.json -o tests.json

# Generate HTML report
python3 report.py results.json -o report.html

What It Detects

ID Patterns

  • Integer IDs: /users/123, ?user_id=456
  • UUIDs: /docs/550e8400-e29b-41d4-a716-446655440000
  • MongoDB ObjectIds: /items/507f1f77bcf86cd799439011
  • Base64 Encoded: /api/dXNlcl8xMjM= (decodes to user_123)
  • Short Hashes: /files/a1b2c3d4
  • Composite IDs: /org/123/user/456

Read the full file on GitHub · 232 lines

Files

What ships with it

12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 232 lines · 75 tokens per session scan A 2ea00c1fc8fe

Subscribe to this mod's changes

bac-analyzer is a skill published in the GitHub repository SecurityTalent/bugskill-ai (5 stars, last pushed 18d ago), licensed MIT. It adds 75 tokens to every session and 1,600 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Securityai-skillai-skill-scannerai-skill-securityhackerone-reportspublic-bug-reportsvulnerability-reports
Related

Other skills, from other repositories

srt-whiteboard-animation

将 SRT 字幕做成暖米黄纸张底的白板手绘动画：读字幕→输出配图策略→确认后生成统一风格线稿→按叙事语义标注分区→预览台调整→渲染 MP4。编排沿用分区遮罩揭示（annotation.json / sequence / startMs / protectedRegions），但每个区域内的落墨换成 stream 的连续笔迹（骨架/网格 ink→color）。当用户提供 SRT 字幕并要求"字幕做成白板手绘/流式笔迹视频""SRT 生成白板动画""按字幕分镜画手绘"时触发。.

geeklee/srt-whiteboard-animation · 156 tokens

user-research-cookiy

End-to-end user research assistant — qualitative and quantitative. Use this skill whenever the user mentions user research, user interviews, discussion guides, interview guides, research plans, qualitative research, quantitative research, user surveys, survey design, usability studies, participant recruitment…

cookiy-ai/user-research-skill · 154 tokens

seo

Deterministic LLM-first SEO audits for websites, blog posts, and GitHub repositories. Use this when the user asks to "perform SEO analysis", "run SEO audit", "analyze SEO", "check technical SEO", "review schema", "Core Web Vitals", "E-E-A-T", "hreflang", "GEO", "AEO", or GitHub repository SEO optimization. For…

Bhanunamikaze/Agentic-SEO-Skill · 105 tokens

playwright-best-practices

Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions…

currents-dev/playwright-best-practices-skill · 214 tokens

open-map-stack

Use textual agent instructions for GIS and geospatial work: source discovery and provenance, vector/raster/point-cloud pipelines, CRS and metric analysis, spatial SQL, routing and isochrones, QGIS projects, tile generation, and web maps. Use advanced tools and formats such as OSM, Overture, STAC, Sentinel/Landsat…

jaakla/openmapstack · 169 tokens

globalpercent

GlobalPercent — build a global-macro-probability panel for an investment research system. Merges public probability data from prediction markets (Polymarket + Kalshi), classifies every market into macro modules (monetary policy / macro economy / AI / etc.), and shows the whole market's expected-probability state at a…

simonlin1212/globalpercent · 134 tokens