xalgorix/xalgorix is a self-hosted AI penetration-testing tool in which an LLM agent performs reconnaissance, looks for vulnerabilities, and coordinates exploitation, while a separate verifier re-tests findings before reporting them. It is for security teams, ethical hackers, and bug bounty work using a private, bring-your-own-LLM setup. The catalogue skills extend the agent's pentesting workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xalgorix/xalgorix --skill authentication-session-testinggit clone --depth 1 https://github.com/xalgorix/xalgorixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xalgorix/xalgorix/authentication-session-testing)<a href="https://agentmods.dev/skills/xalgorix/xalgorix/authentication-session-testing"><img src="https://agentmods.dev/badge/skills/xalgorix/xalgorix/authentication-session-testing/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xalgorix/xalgorix/authentication-session-testing"><img src="https://agentmods.dev/badge/skills/xalgorix/xalgorix/authentication-session-testing.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.01801 |
| Opus 5.5 | $0.00021 | $0.00720 |
| Sonnet 5.5 | $0.00011 | $0.00360 |
| Haiku 4.5 | $0.00005 | $0.00180 |
Grade A, and why
authentication-session-testing scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Authentication and Session Testing
Purpose
Test the entire account and session lifecycle as a state machine, not just login. Every lifecycle transition (register, verify, login, MFA, reset, recovery, email change, role change, logout) is a boundary where revocation, binding, or downgrade logic is forgotten.
Entry Conditions
- The target has any account lifecycle: signup, login, password reset, MFA, profile/email change, or log-out-other-sessions features
- You hold at least one valid account (ideally two, plus control of a second email address)
Step 0: Find the REAL Session Token
Apps set many cookies (analytics, CSRF, consent). Delete cookies one at a time and re-request a protected page - the one whose removal logs you out is the session token. Test only that one for the flaws below.
Session Lifecycle Matrix
Capture a valid session token, then perform each lifecycle event in a SEPARATE session and replay the old token against a protected route. Record status + body differential for each:
| Event | Question | Evidence to capture |
|---|---|---|
| Logout | is the old token dead server-side? | old cookie replay after logout |
| Password change | are other sessions revoked? | old session still valid after change |
| Password reset | does reset invalidate all sessions? | old session after reset completes |
| MFA change / enrollment | are sessions re-verified? | old session after MFA enrollment |
| Role change (up or down) | does privilege apply to existing sessions? | old session reaching admin route after downgrade |
| Account disable / deletion | immediate revocation? | old session after admin-side disable |
| Email change | does notification + re-verification occur? | old session after email change |
A stale token still working after logout is a server-side revocation failure (critical for stolen-session scenarios) - prove it with a state-changing request, not a cached GET.
Session Token Handling
- Fixation: record the cookie value BEFORE authenticating; log in; compare. If the identifier does not rotate on privilege elevation, a pre-set cookie survives login and can be fixed onto a victim.
- Replay across context: replay the token from a different IP / User-Agent / device fingerprint. Accepted with no re-auth or alert = unbound session.
- Parallel sessions: same account from two machines - both stay valid with no notification is often in-scope for sensitive apps.
- Client-side session data: base64/JSON-decode cookies. If user=, role=, email=, isAdmin= live inside, tamper with another user value and replay - the server may trust it blindly.
- Entropy: flip one byte at a time to find which segment is actually validated; a short validated segment is brute-forceable. Run Sequencer-style randomness analysis over thousands of tokens when feasible.
- Cookie hardening: HttpOnly, Secure, SameSite, Domain scope, Max-Age. Missing flags are hardening observations - not findings alone; pair them with a demonstrated attack (XSS token theft, subdomain leak) before reporting.
- Leakage: session value in URLs, Referer headers to external hosts, analytics/error beacons.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago First seen · 148 lines · 53 tokens per session scan A 7ba970622830
authentication-session-testing is a skill published in the GitHub repository xalgorix/xalgorix (1,222 stars, last pushed yesterday), licensed Apache-2.0. It adds 53 tokens to every session and 1,801 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-29.
Other skills, from other repositories
bypassing-authentication-with-forced-browsing
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
identity-auth
Test identity, authentication, authorization, and sessions.
business-logic
Test workflows, state transitions, pricing, and concurrency.
configuring-multi-factor-authentication-with-duo
Deploy Cisco Duo multi-factor authentication across enterprise applications, VPN, RDP, and SSH access points. This skill covers Duo integration methods, adaptive authentication policies, device trust.
security-review
Security Code Review: Reviews code for security vulnerabilities including authentication (OAuth2, JWT), authorization (RBAC, roles), API security, data protection, payment security, and common attack vectors. Use whenever the user wants a security review, penetration test analysis, threat model, or mentions OAuth2…
testing-api-authentication-weaknesses
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and…