# Authz Check

Verify that an endpoint checks ownership, not just authentication.

- Repository: https://github.com/Archive228/loopkit (756 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-07-14
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Archive228/loopkit --skill authz-check -g -a claude-code -y`
Codex: `npx skills add Archive228/loopkit --skill authz-check -g -a codex -y`
Cursor: `npx skills add Archive228/loopkit --skill authz-check -g -a cursor -y`
Gemini CLI: `npx skills add Archive228/loopkit --skill authz-check -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Archive228/loopkit`

## Description

Verify that an endpoint checks ownership, not just authentication. Use on any handler that reads or mutates user data.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Authz Check
The most common security hole: the code checks you're logged IN, but not that you OWN the thing.
- For every resource access: does it verify the current user is allowed THIS specific record? `WHERE id = ? AND owner_id = current_user`, not just `WHERE id = ?`.
- IDOR test: swap the ID in the request to another user's. Does it leak/allow?
- Admin/privileged actions: is the role checked server-side, every time, not just hidden in the UI?
- Default deny: new endpoints should require explicit authorization, not be open by oversight.
Output each handler that authenticates but doesn't authorize, with the missing check.