Authentication Flow Reviewer
Audit authentication code for JWT, session, OAuth2, and MFA vulnerabilities
What You Can Do
You can submit authentication and authorization code implementations for deep security analysis. The skill examines JWT implementations, session management patterns, password hashing strategies, MFA mechanisms, and OAuth2/OIDC configurations to identify structural vulnerabilities, configuration weaknesses, and implementation flaws that could lead to account compromise or unauthorized access. It produces severity-rated vulnerability reports with reproducible attack scenarios and specific remediation steps.
Features
identifies signature verification gaps, key management issues, expiration handling flaws, and algorithm coercion attacks
detects token storage risks, invalidation gaps, fixation vulnerabilities, and insecure cookie configurations
reviews hashing algorithms, salt usage, iteration counts, and storage patterns against current standards
uncovers bypass vectors, recovery code weaknesses, timing attack risks, and enforcement gaps
validates state parameters, redirect URI security, token endpoint protection, and scope handling
analyzes permission checks, role inheritance models, and attribute-based access control (ABAC) implementation gaps
categorizes findings by exploitability and impact with specific remediation guidance
Example Output
Example 1: JWT Vulnerability Report
Finding: Weak Key Management (High Severity)
- Issue: RS256 algorithm configured but private key stored in environment variable with read access across multiple services
- Attack Scenario: Service compromise allows attacker to sign arbitrary JWTs with any claims
- Remediation: Migrate keys to secure vault (HashiCorp, AWS KMS). Rotate immediately. Implement key versioning for algorithm rotation.
Example 2: Session Management Issue
Finding: Missing Session Invalidation on Logout (Medium Severity)
- Issue: Session tokens remain valid for full expiration period even after user-initiated logout
- Attack Scenario: Attacker gains token and can maintain access indefinitely if user logs out thinking they've terminated the session
- Remediation: Implement token blacklist or short-lived refresh token rotation on logout.
Example 3: OAuth2 Configuration Gap
Finding: Insufficient Redirect URI Validation (High Severity)
- Issue: Redirect URI accepts wildcard subdomains (*.example.com) allowing open redirect to attacker-controlled subdomains
- Attack Scenario: Attacker registers subdomain and captures authorization codes
- Remediation: Use exact string matching for redirect URIs. Reject wildcard patterns.
What's Included
- SKILL.md: Complete authentication security audit framework and vulnerability taxonomy
- JWT Checklist: Signature algorithms, key management, expiration, and token structure validation points
- Session Security Template: Token storage, invalidation, rotation, and cookie configuration review template
- OAuth2/OIDC Flow Diagram: Reference architecture for state validation, authorization code, and token endpoint security
- Severity Scoring Framework: CVSS-aligned ratings and remediation priority guidance
Who It's For
- Security engineers and AppSec teams — conducting pre-deployment code reviews and threat modeling sessions
- Backend/API developers — validating custom authentication implementations before production release
- DevOps/platform engineers — auditing identity service configurations and access control policies
- Security architects — assessing third-party authentication system integrations and OAuth2/OIDC flows
- Compliance and risk teams — documenting authentication security controls for audit and certification
Best For
- Custom JWT implementation reviews and signature verification audits
- Session management and token storage architecture assessments
- OAuth2/OIDC flow validation and redirect URI configuration audits
- MFA mechanism bypass risk analysis and enforcement gap identification
- Password storage and hashing algorithm compliance reviews
- Authorization logic and permission check implementation verification
- Pre-deployment security assessments for authentication-critical features
You might also like
You can perform deep audits of your project dependencies across multiple package ecosystems, identifying security vulnerabilities with CVSS scores, outdated versions, license incompatibilities, and unused packages. The skill generates a prioritized upgrade roadmap that balances security urgency, stability risk, and effort cost—helping you reduce supply chain risk and technical debt without destabilizing production.
You can transform raw geotechnical field data into professional-grade site investigation reports that include soil classification using USCS standards, bearing capacity calculations, settlement predictions, and specific foundation design recommendations. The skill organizes stratigraphic information across multiple boring locations, cross-references laboratory test results, and produces defensible conclusions compliant with IBC, ASCE 7, and local building codes—suitable for building officials, structural engineers, and construction teams.
by az9713
You can conduct comprehensive safety impact assessments for any transportation design intervention—from intersection redesigns to speed reduction corridors. The skill guides you through hazard identification, risk quantification using established methodologies (conflict studies, crash prediction models), and evidence-based mitigation development. You'll produce defensible safety documentation suitable for audits, litigation, and project approvals.
by az9713
Quickly evaluate pavement design scenarios using AASHTO 1993 methodology to calculate required structural thickness for flexible (asphalt) and rigid (concrete) pavements. Analyze traffic loading by computing Equivalent Single Axle Loads (ESALs), assess subgrade conditions through CBR interpretation, and compare multiple design alternatives with different material combinations to optimize cost and performance. Generate preliminary design documentation with technical justification for client presentations and design reports.
by az9713
This skill cross-references your residential design specifications against jurisdiction-specific building codes (IBC, IRC, local amendments) to identify code violations, ambiguous details inspectors will challenge, and compliance documentation gaps. You can validate designs across multiple jurisdictions, evaluate design trade-offs (fire-rating vs. acoustic performance), and generate compliance narratives that support permit applications—all before formal submission.
by az9713
You can input room dimensions, functional requirements, and design constraints to receive optimized furniture layouts with documented traffic flow patterns and compliance verification. Claude analyzes competing spatial demands—usable area, sightlines, egress, zoning—and produces data-driven plans that satisfy functional, regulatory, and aesthetic objectives simultaneously. This accelerates initial space planning and helps identify conflicts before costly revisions.
by az9713
This skill deconstructs your writing samples to identify the specific patterns, personality markers, emotional range, language quirks, and formatting habits that make your voice uniquely yours. You'll receive a detailed voice DNA profile that includes your core communication style, signature phrases, emotional tone, formality level, and what you actively avoid—creating a blueprint that AI systems can use to replicate your authentic voice consistently across projects, platforms, and content types.
by az9713
Query your local Screenpipe instance to retrieve screen recordings, audio transcriptions, UI element accessibility trees, keyboard/mouse input logs, and productivity analytics. You can search by keywords, filter by content type (audio, OCR, accessibility, input), set time ranges, and extract structured data about your applications, meetings, and work sessions without sending data to external servers.
by az9713