Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Sefyu24/master-iam-skills --skill review-access-controlgit clone --depth 1 https://github.com/Sefyu24/master-iam-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sefyu24/master-iam-skills/review-access-control)<a href="https://agentmods.dev/skills/sefyu24/master-iam-skills/review-access-control"><img src="https://agentmods.dev/badge/skills/sefyu24/master-iam-skills/review-access-control/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sefyu24/master-iam-skills/review-access-control"><img src="https://agentmods.dev/badge/skills/sefyu24/master-iam-skills/review-access-control.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00191 | $0.02189 |
| Opus 5.5 | $0.00076 | $0.00876 |
| Sonnet 5.5 | $0.00038 | $0.00438 |
| Haiku 4.5 | $0.00019 | $0.00219 |
Grade A, and why
review-access-control scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Review Access Control
Turn business access rules into evidence, permission decisions, and tests. Give a practical identity and access management (IAM) result instead of generic security advice.
Set the boundary
- Work only on systems and artifacts that the user is authorized to inspect.
- Use source review, local tests, and user-approved test environments.
- Do not attempt to bypass controls on a live service.
- Do not expose credentials, tokens, secrets, or unnecessary personal data.
- Treat this as focused access-control work, not a complete security or compliance assessment.
- Do not claim that an application is secure because the review found no weakness.
- Keep authentication, session, authorization, and general application-security observations separate.
- If the user requests only a review, do not modify code.
- If the user requests a fix, make the smallest durable change and add a denied-path test.
Choose the outcome
Use one or more paths:
- Inspect: Find access-control weaknesses and support each conclusion with evidence.
- Model: Define actors, protected resources, actions, policy inputs, enforcement points, lifecycle rules, and tests.
- Learn: Explain IAM through the decisions present in a lab, design, or implementation.
Read guides/clear-technical-english.md before producing a user-facing answer.
Read only the files that the task needs. Paths inside a guide or template are relative to that file.
| Need | Read or use |
|---|---|
| Inspection checks | guides/review-playbook.md |
| Severity and confidence | guides/finding-severity.md |
| Permission design, access models, and policy points | guides/permission-modeling.md |
| Role analysis, role design, and role mining | guides/role-design-and-mining.md |
| Short identity overview | guides/identity-context.md |
| IAM objects, identity governance, and access principles | guides/iam-foundations.md |
| Authentication, sessions, single sign-on, and federation | guides/authentication-and-federation.md |
| Lifecycle events, provisioning, access reviews, and stale access | guides/lifecycle-and-governance.md |
| Service accounts, workloads, and artificial intelligence (AI) agents | guides/non-human-identities-and-agents.md |
| Standards, versions, and licenses | guides/public-sources.md |
| Term definitions | guides/glossary.md |
| Review report | templates/review-report.md |
| Permission map | templates/permission-map.md |
| Authorization threat model | templates/authorization-threat-model.md |
| Verification plan | templates/verification-plan.md |
What ships with it
17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 289 B
- guides/authentication-and-federation.md 8.0 KB
- guides/clear-technical-english.md 1.1 KB
- guides/finding-severity.md 7.1 KB
- guides/glossary.md 8.9 KB
- guides/iam-foundations.md 6.0 KB
- guides/identity-context.md 5.4 KB
- guides/lifecycle-and-governance.md 6.8 KB
- guides/non-human-identities-and-agents.md 8.8 KB
- guides/permission-modeling.md 11 KB
- guides/public-sources.md 11 KB
- guides/review-playbook.md 15 KB
- guides/role-design-and-mining.md 6.7 KB
- templates/authorization-threat-model.md 2.3 KB
- templates/permission-map.md 2.7 KB
- templates/review-report.md 3.3 KB
- templates/verification-plan.md 4.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +18 lines · +88 tokens per session d2c1ffdfdd84
- 1mo ago First seen · 139 lines · 103 tokens per session scan A a43dbf580d58
review-access-control is a skill published in the GitHub repository Sefyu24/master-iam-skills (14 stars, last pushed yesterday), licensed MIT. It adds 191 tokens to every session and 2,189 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
configuring-ldap-security-hardening
Harden LDAP directory services against common attacks including credential harvesting, LDAP injection, anonymous binding, and channel binding bypass. Covers LDAPS enforcement, channel binding, LDAP si.
blind-sqli
Blind SQL injection under hostile WAF — manual bypass playbook for when sqlmap fails because common tokens (SUBSTRING, IF, AND, WHERE, single quotes) are filtered. Covers token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, and exponential-probe binary search. Loaded on…
hpp
HTTP Parameter Pollution — parser discrepancies between proxy/server/app, WAF bypass, auth/ACL bypass, injection delivery.
php-type-juggling
PHP type juggling and magic hash attacks — exploit loose comparison (==) with 0e-prefixed hash collisions and NULL returns to bypass authentication.
race-condition
Race condition / TOCTOU exploitation — concurrent and parallel-request attacks against web applications that check then act, write session state before validating it, or perform slow operations that widen the race window. Covers single-endpoint races (double-spend, coupon abuse, balance overflow) and multi-endpoint…
verb-tampering
HTTP verb/method tampering — auth bypass via HEAD/OPTIONS/arbitrary methods, X-HTTP-Method-Override, TRACE/PUT/DELETE exposure, framework routing flaws.