Individual skill

academic-platform-audit

Security assessment methodology for academic portals, Computer-Based Testing (CBT), and online examination platforms. Focuses on OWASP WSTG Business Logic testing, Question Bank information disclosure, server-side timer integrity, IDOR on submissions, and defensive mitigations.

skills/security/academic-platform-audit/SKILL.md

Read pinned source

Source commit 961a0dd3d2d2f66a07a416ade3b1d4473b64802e

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: No
Repository scan complete: No
Skill scan complete: No
Observed behavior: Not checked yet
Last checked: Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 1,013
Repository last updated: Nov 5, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

ai-agent Repository topic
appsec Repository topic
bug-bounty Repository topic
cybersecurity Repository topic
devsecops Repository topic
exploit-validation Repository topic
hermes-agent Repository topic
infosec Repository topic
llm-security Repository topic
nuclei Repository topic
security Derived category
testing Derived category
research Derived category
security-application Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 4,502 bytes
SKILL.mdcore · 4,502 bytes
references/methodology-and-scenarios.mddoc · 3,225 bytes

Read excerpt


# Academic & Examination Platform Security Assessment Playbook

## 1. Overview & Scope
This skill provides a structured methodology for auditing Computer-Based Testing (CBT), Learning Management Systems (LMS), and online examination portals. These applications frequently manage high-stakes evaluation data, student records, and timed workflows that depend heavily on state machine integrity.

### Primary Vulnerability Classes (OWASP WSTG)
- **WSTG-ATHZ-04**: Insecure Direct Object References (IDOR / BOLA) on question banks and student answers.
- **WSTG-INFO-05**: Sensitive Data Exposure in Single Page Application (SPA) client bundles and un-rendered JSON states.
- **WSTG-BUSL-01/02**: Business Logic Flaws & State Machine bypasses in multi-stage exam workflows.
- **WSTG-BUSL-08**: Client-Side Timing & Clock Manipulation vs Server-Side Epoch Timestamp enforcement.

---

## 2. Assessment Methodology