Authentication Flow Reviewer
Audit authentication code for JWT, session, OAuth2, and MFA vulnerabilities
What You Can Do
You can submit authentication and authorization code implementations for deep security analysis. The skill examines JWT implementations, session management patterns, password hashing strategies, MFA mechanisms, and OAuth2/OIDC configurations to identify structural vulnerabilities, configuration weaknesses, and implementation flaws that could lead to account compromise or unauthorized access. It produces severity-rated vulnerability reports with reproducible attack scenarios and specific remediation steps.
Features
identifies signature verification gaps, key management issues, expiration handling flaws, and algorithm coercion attacks
detects token storage risks, invalidation gaps, fixation vulnerabilities, and insecure cookie configurations
reviews hashing algorithms, salt usage, iteration counts, and storage patterns against current standards
uncovers bypass vectors, recovery code weaknesses, timing attack risks, and enforcement gaps
validates state parameters, redirect URI security, token endpoint protection, and scope handling
analyzes permission checks, role inheritance models, and attribute-based access control (ABAC) implementation gaps
categorizes findings by exploitability and impact with specific remediation guidance
Example Output
Example 1: JWT Vulnerability Report
Finding: Weak Key Management (High Severity)
- Issue: RS256 algorithm configured but private key stored in environment variable with read access across multiple services
- Attack Scenario: Service compromise allows attacker to sign arbitrary JWTs with any claims
- Remediation: Migrate keys to secure vault (HashiCorp, AWS KMS). Rotate immediately. Implement key versioning for algorithm rotation.
Example 2: Session Management Issue
Finding: Missing Session Invalidation on Logout (Medium Severity)
- Issue: Session tokens remain valid for full expiration period even after user-initiated logout
- Attack Scenario: Attacker gains token and can maintain access indefinitely if user logs out thinking they've terminated the session
- Remediation: Implement token blacklist or short-lived refresh token rotation on logout.
Example 3: OAuth2 Configuration Gap
Finding: Insufficient Redirect URI Validation (High Severity)
- Issue: Redirect URI accepts wildcard subdomains (*.example.com) allowing open redirect to attacker-controlled subdomains
- Attack Scenario: Attacker registers subdomain and captures authorization codes
- Remediation: Use exact string matching for redirect URIs. Reject wildcard patterns.
What's Included
- SKILL.md: Complete authentication security audit framework and vulnerability taxonomy
- JWT Checklist: Signature algorithms, key management, expiration, and token structure validation points
- Session Security Template: Token storage, invalidation, rotation, and cookie configuration review template
- OAuth2/OIDC Flow Diagram: Reference architecture for state validation, authorization code, and token endpoint security
- Severity Scoring Framework: CVSS-aligned ratings and remediation priority guidance
Who It's For
- Security engineers and AppSec teams — conducting pre-deployment code reviews and threat modeling sessions
- Backend/API developers — validating custom authentication implementations before production release
- DevOps/platform engineers — auditing identity service configurations and access control policies
- Security architects — assessing third-party authentication system integrations and OAuth2/OIDC flows
- Compliance and risk teams — documenting authentication security controls for audit and certification
Best For
- Custom JWT implementation reviews and signature verification audits
- Session management and token storage architecture assessments
- OAuth2/OIDC flow validation and redirect URI configuration audits
- MFA mechanism bypass risk analysis and enforcement gap identification
- Password storage and hashing algorithm compliance reviews
- Authorization logic and permission check implementation verification
- Pre-deployment security assessments for authentication-critical features
You might also like
Query your local Screenpipe instance to retrieve screen recordings, audio transcriptions, UI element accessibility trees, keyboard/mouse input logs, and productivity analytics. You can search by keywords, filter by content type (audio, OCR, accessibility, input), set time ranges, and extract structured data about your applications, meetings, and work sessions without sending data to external servers.
by az9713
This skill automates the detailed calculations required for electrical system design, converting connected loads to demand loads, sizing conductors and equipment per NEC standards, and analyzing voltage drop across feeders and branch circuits. You input project parameters and receive complete load schedules, equipment recommendations with ampacity ratings, conductor specifications, and code citations—eliminating manual calculation errors and enabling faster design iterations for permit-ready documentation.
by az9713
You can conduct comprehensive slope stability analyses that integrate site characterization, soil/rock properties, and quantitative calculations to evaluate both simple and complex slope geometries. The framework helps you identify critical failure mechanisms, calculate safety factors, assess groundwater and seismic effects, and develop technically defensible remediation recommendations suitable for permitting, design decisions, and stakeholder communication.
by az9713
You can systematically design test cases for any feature or system by analyzing requirements or code to extract test parameters, values, and business constraints. The skill generates a PICT model, executes pairwise testing logic to minimize test case count while maximizing coverage, and delivers a formatted test matrix with expected results—reducing manual test design effort while ensuring comprehensive scenario coverage.
by az9713
This skill deconstructs your writing samples to identify the specific patterns, personality markers, emotional range, language quirks, and formatting habits that make your voice uniquely yours. You'll receive a detailed voice DNA profile that includes your core communication style, signature phrases, emotional tone, formality level, and what you actively avoid—creating a blueprint that AI systems can use to replicate your authentic voice consistently across projects, platforms, and content types.
by az9713
You can decompose complex timber structures into analyzable load paths, trace forces from applied loads through members to supports, and calculate governing demands for each structural element. This skill helps you identify critical design points, apply appropriate load factors and duration adjustments, and create defensible design documentation that satisfies code officials and peer reviewers.
by az9713
You can compare building materials across embodied carbon, water usage, recyclability, supply chain impacts, and lifecycle costs—all grounded in industry standards like EN 15804 and ISO 14040/44. This skill transforms material selection from intuition-based guessing into data-driven specification, producing analysis outputs ready for client presentations, value engineering discussions, and regulatory compliance documentation.
by az9713
You can accelerate HVAC design workflows by inputting building parameters—envelope characteristics, occupancy data, climate conditions, and existing systems—and receiving calculated heating/cooling loads, equipment sizing recommendations, and zone-by-zone analysis. Claude organizes complex building data into actionable design parameters and specification summaries for client review, permit submission, and professional validation against ASHRAE and ACCA standards.
by az9713