This tool is a runtime security auditor for the Abilities API in content management systems. It is designed for developers and site administrators who need to proactively manage and secure user permissions across their site's ecosystem. The scanner operates during site execution to provide a real-time assessment of the security posture defined by installed extensions.

• Runtime Ability Scanning: Actively inspects every registered user ability from plugins and themes as the site runs, providing an up-to-date security analysis.
• Misconfiguration Detection: Flags common security issues such as open permission callbacks, weak capability assignments, and missing input validation on sensitive data fields.
• Overexposure Reporting: Identifies abilities that are unnecessarily exposed through REST APIs or AI agent connections without proper access controls.
• Risk Scoring and Prioritization: Presents findings in the admin area with a clear severity ranking and an overall risk score, helping users focus on the most critical fixes first.
• Secure and Self-Contained Operation: Designed with security in mind, it uses controlled capabilities for access, stores results per-user, and leaves no data behind upon removal.