Authentication Flow Reviewer
Audit authentication code for JWT, session, OAuth2, and MFA vulnerabilities
What You Can Do
You can submit authentication and authorization code implementations for deep security analysis. The skill examines JWT implementations, session management patterns, password hashing strategies, MFA mechanisms, and OAuth2/OIDC configurations to identify structural vulnerabilities, configuration weaknesses, and implementation flaws that could lead to account compromise or unauthorized access. It produces severity-rated vulnerability reports with reproducible attack scenarios and specific remediation steps.
Features
identifies signature verification gaps, key management issues, expiration handling flaws, and algorithm coercion attacks
detects token storage risks, invalidation gaps, fixation vulnerabilities, and insecure cookie configurations
reviews hashing algorithms, salt usage, iteration counts, and storage patterns against current standards
uncovers bypass vectors, recovery code weaknesses, timing attack risks, and enforcement gaps
validates state parameters, redirect URI security, token endpoint protection, and scope handling
analyzes permission checks, role inheritance models, and attribute-based access control (ABAC) implementation gaps
categorizes findings by exploitability and impact with specific remediation guidance
Example Output
Example 1: JWT Vulnerability Report
Finding: Weak Key Management (High Severity)
- Issue: RS256 algorithm configured but private key stored in environment variable with read access across multiple services
- Attack Scenario: Service compromise allows attacker to sign arbitrary JWTs with any claims
- Remediation: Migrate keys to secure vault (HashiCorp, AWS KMS). Rotate immediately. Implement key versioning for algorithm rotation.
Example 2: Session Management Issue
Finding: Missing Session Invalidation on Logout (Medium Severity)
- Issue: Session tokens remain valid for full expiration period even after user-initiated logout
- Attack Scenario: Attacker gains token and can maintain access indefinitely if user logs out thinking they've terminated the session
- Remediation: Implement token blacklist or short-lived refresh token rotation on logout.
Example 3: OAuth2 Configuration Gap
Finding: Insufficient Redirect URI Validation (High Severity)
- Issue: Redirect URI accepts wildcard subdomains (*.example.com) allowing open redirect to attacker-controlled subdomains
- Attack Scenario: Attacker registers subdomain and captures authorization codes
- Remediation: Use exact string matching for redirect URIs. Reject wildcard patterns.
What's Included
- SKILL.md: Complete authentication security audit framework and vulnerability taxonomy
- JWT Checklist: Signature algorithms, key management, expiration, and token structure validation points
- Session Security Template: Token storage, invalidation, rotation, and cookie configuration review template
- OAuth2/OIDC Flow Diagram: Reference architecture for state validation, authorization code, and token endpoint security
- Severity Scoring Framework: CVSS-aligned ratings and remediation priority guidance
Who It's For
- Security engineers and AppSec teams — conducting pre-deployment code reviews and threat modeling sessions
- Backend/API developers — validating custom authentication implementations before production release
- DevOps/platform engineers — auditing identity service configurations and access control policies
- Security architects — assessing third-party authentication system integrations and OAuth2/OIDC flows
- Compliance and risk teams — documenting authentication security controls for audit and certification
Best For
- Custom JWT implementation reviews and signature verification audits
- Session management and token storage architecture assessments
- OAuth2/OIDC flow validation and redirect URI configuration audits
- MFA mechanism bypass risk analysis and enforcement gap identification
- Password storage and hashing algorithm compliance reviews
- Authorization logic and permission check implementation verification
- Pre-deployment security assessments for authentication-critical features
You might also like
Design earth retention systems by inputting soil properties, site geometry, and regulatory requirements. Claude calculates lateral earth pressures using Coulomb, Rankine, and Mononobe-Okabe methods, verifies factors of safety for internal and external stability, compares competing retention concepts (gravity walls, cantilever, anchored, sheet-pile, soil-nail), and generates cost-benefit analysis and regulatory documentation packages ready for permit submission.
by az9713
You can rapidly synthesize disparate urban site information—demographics, infrastructure, ecology, regulations, and spatial typologies—into explicit design frameworks. Claude helps you extract actionable insights that directly inform concept development, phasing strategies, and design interventions, bridging the gap between site investigation and design synthesis by creating clear connections between existing conditions and design opportunities.
by az9713
You can input earth retention system parameters—wall type, soil properties, loading conditions, and geometry—and Claude will perform comprehensive stability analysis including bearing capacity, sliding resistance, and overturning checks. The skill generates professional engineering reports with calculated factors of safety, design narratives, and permit-ready documentation that aligns with ASCE 7, ACI 318, and local building code requirements across gravity walls, cantilever walls, soldier pile systems, sheet pile walls, and MSE walls.
by az9713
You can systematically analyze raw XYZ survey coordinates to identify meaningful patterns, validate data quality, and detect surveying errors before they impact design phases. This skill helps you interpret slope gradients, drainage patterns, and terrain complexity while generating constraint reports that communicate site limitations to design teams. You'll produce professional topographic analyses that reveal drainage zones, stability issues, and access constraints invisible in raw measurements.
by az9713
You can submit architectural design documents, floor plans, and project parameters to receive a comprehensive compliance analysis that cross-references IBC, local amendments, zoning ordinances, and ADA accessibility requirements. Claude identifies specific gaps, cites applicable code sections, explains why each gap matters, and provides concrete remediation strategies—all before formal design review submission when corrections are costly and schedule-impacting.
by az9713
You can accelerate HVAC design workflows by inputting building parameters—envelope characteristics, occupancy data, climate conditions, and existing systems—and receiving calculated heating/cooling loads, equipment sizing recommendations, and zone-by-zone analysis. Claude organizes complex building data into actionable design parameters and specification summaries for client review, permit submission, and professional validation against ASHRAE and ACCA standards.
by az9713
This skill enables you to rapidly produce structural analyses for timber members, including bending, shear, compression, and combined stress calculations. You can determine lateral load capacity for shear walls, design connections, evaluate code compliance against NDS standards, assess serviceability limits, and generate calculation frameworks suitable for permit submission and engineer stamping.
by az9713
You can perform deep audits of your project dependencies across multiple package ecosystems, identifying security vulnerabilities with CVSS scores, outdated versions, license incompatibilities, and unused packages. The skill generates a prioritized upgrade roadmap that balances security urgency, stability risk, and effort cost—helping you reduce supply chain risk and technical debt without destabilizing production.
