go-vuln-auth-bypassUse when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation i...
Install via ClawdBot CLI:
clawdbot install yhy0/go-vuln-auth-bypassGrade Limited — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Generated Mar 21, 2026
During upgrades of Kubernetes admission webhooks in cloud-native platforms like Rancher, webhooks may be temporarily disabled or set to fail-open, allowing unauthorized requests to bypass security checks. This scenario targets DevOps teams managing clusters, where misconfigured failurePolicy or namespaceSelector can lead to privilege escalation or resource manipulation.
In Go-based microservices using JWT for authentication, improper validation of token algorithms or claims can allow attackers to forge tokens and bypass access controls. This scenario applies to SaaS companies and fintech firms relying on OAuth/JWT, where missing checks on alg or audience fields expose APIs to unauthorized access.
Misconfigured Role-Based Access Control in Kubernetes can leak permissions across namespaces, enabling tenants to access or modify resources belonging to others. This scenario targets cloud service providers and enterprises using platforms like Kyverno, where overly permissive ClusterRoles or ServiceAccount tokens pose risks in shared environments.
In distributed Go applications using gRPC, missing or misordered interceptors for authentication can leave critical methods unprotected, allowing internal or external attackers to bypass authorization. This scenario affects tech companies building microservices architectures, where inconsistent interceptor application leads to security vulnerabilities.
Web applications implementing OAuth flows may fail to validate state parameters, enabling CSRF attacks that allow attackers to hijack user sessions or gain unauthorized access. This scenario is common in e-commerce and social media platforms where OAuth is used for third-party integrations, leading to account takeover risks.
Offer ongoing security audits for cloud-native applications, focusing on authentication and authorization flaws in Go code. Revenue is generated through monthly or annual subscriptions, with tiered pricing based on codebase size and compliance requirements, targeting mid to large enterprises.
Provide specialized penetration testing services for Kubernetes and Go applications, identifying vulnerabilities like those in the skill. Revenue comes from project-based engagements or retainer contracts, appealing to companies in regulated industries needing compliance certifications.
Conduct training workshops for developers and DevOps teams on secure coding practices for Go and cloud-native security. Revenue is generated from course fees and corporate training packages, helping organizations build internal expertise to prevent common bypass issues.
💬 Integration Tip
Integrate this skill into CI/CD pipelines to automatically scan Go code for authentication bypass patterns during builds, ensuring early detection of vulnerabilities.
Scored Apr 19, 2026
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Sentry API integration with managed authentication. Monitor errors, issues, and application performance. Use this skill when users want to list issues, retrieve events, manage projects, teams, or releases in Sentry. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Sentry connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Sentry action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Sentry examples; they add no Sentry capability - Sentry is not an event source, a trigger cannot read Sentry data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Host static files on subdomains with optional authentication. Use when you need to serve HTML, images, CSS, JS, or any static content on a dedicated subdomain. Supports file upload, basic auth, quota management, and automatic SSL via Caddy. Commands include sf sites (create/list/delete), sf upload (files/directories), sf files (list/delete).
Download YouTube videos by URL in various resolutions using a pay-per-use API with credit-based authentication and no charge on failed downloads.