auditing-grpc-service-authorizationlisted

Audit a gRPC service for a method a caller can reach without the authorization the service assumes an interceptor enforces, after the interceptor coverage and the channel credentials are resolved. Covers authorization installed on the unary interceptor while the streaming chain omits it, a per-method authorization gap reachable at the wrong privilege, server reflection enabled in production exposing the full API, a plaintext channel with metadata trusted unverified, an absent message-size or recursion-depth limit inviting decode denial of service, and a transcoding gateway that does not apply the same auth filter as native gRPC. Use when reviewing service and interceptor registration, method handlers, and channel setup, not the certificate-validation mechanics the transport skill owns. A caller with forged or absent metadata is the source, a service method acting without an authorization check is the sink, and an interceptor that does not cover the method or stream is the bug.
UnboundCompute/security-agent-skills · ★ 4 · API & Backend · score 80

Install: claude install-skill UnboundCompute/security-agent-skills

# Auditing gRPC service authorization: the method the interceptor does not cover A gRPC service usually centralizes authorization in an interceptor, and the bug is a method the interceptor does not actually cover. The classic shape is an auth interceptor installed on the unary chain while the streaming chain runs without it, so a streaming RPC is callable with no credentials. You audit it by resolving which interceptors are registered and which methods and stream types they actually gate, then checking each method the check assumes is covered. The other half is the channel: a plaintext or insecure channel, metadata trusted without verification, missing message and recursion limits, and a transcoding gateway that fronts the service without the same auth filter. Certificate-validation mechanics belong to the transport skill; this skill owns whether a reachable method is authorized. ## When to use - You are reviewing a gRPC server's service registration, interceptor chain, and method handlers. - The service enforces authorization in an interceptor, or is fronted by a transcoding gateway. - You want to know whether a caller can reach a method without the authorization the service assumes. ## Scope check Audit only services you own or are authorized to assess, and call a method only against an endpoint in scope, an unauthorized RPC drives real service state. Adjudicate on the registration and the handlers. If you can't name the authorization, stop. ## The loop 1. **Resolve