skills.rest
foutoucour
foutoucourCOMMUNITY
Explore all skills by this author →
𝕏@jordiriera_cgGitHub

auth-review

Identify authentication and authorization design gaps in codebases using OAuth, JWT, RBAC, and session management.

Updated Mar 24, 2026
Search Tags:#authorization#security#authentication#oauth#jwt#rbac#abac
One-click install
npx skills add https://github.com/foutoucour/guitar-match --skill auth-review-foutoucour
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-review
Source: https://github.com/foutoucour/guitar-match/tree/main/.claude/skills/security/auth-review
Command: npx skills add https://github.com/foutoucour/guitar-match --skill auth-review-foutoucour

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams identify weaknesses in how authentication and authorization are designed and implemented, reducing risk of credential compromise and privilege escalation.

Core Features & Use Cases

  • Review JWT configuration, token lifetimes, and refresh flows.
  • Map OAuth, SSO, and API-key mechanisms across services.
  • Assess RBAC/ABAC implementations and centralized policy checks.

Quick Start

Audit the project’s authentication and authorization design by enumerating its mechanisms, roles, and access controls, then summarize gaps and recommended fixes.

Frequently Asked Questions about auth-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit JWT configuration and token lifetimes in my codebase?▼

To audit JWT configuration, review token lifetimes, refresh flows, and explicit token handling to identify design gaps and ensure secure session management within your codebase.

What are common authorization design gaps in OAuth and RBAC implementations?▼

Common authorization design gaps include decentralized policy checks, improper token expiry, and insecure session management across OAuth and RBAC implementations in web and API services.

Does this authentication review process work with both web and API services?▼

Yes, the authentication review process applies to codebases implementing OAuth, JWT, RBAC, and session management across both web and API services to identify design weaknesses.

How do I assess centralized authorization checks and policy engines for privilege escalation risks?▼

Assess centralized authorization checks by mapping RBAC and ABAC implementations, verifying policy enforcement, and documenting gaps that could allow privilege escalation or credential compromise.

What is the best way to review SSO and API-key mechanisms across multiple services?▼

The best way to review SSO and API-key mechanisms is to enumerate authentication flows across services, map access controls, and summarize identified gaps with recommended fixes.

When should I perform an authorization audit on my codebase?▼

Perform an authorization audit when implementing OAuth, JWT, RBAC, or session management to ensure proper token handling, secure expiry, and centralized policy checks before deployment.

Related Skills

Explore More Software Engineering Skills→
jason-c-devjason-c-dev
1

aws-observability-setup

Configures CloudWatch, CloudTrail, AWS Config, and Security Hub across accounts and regions.

Community
Intermediate
masta-g3masta-g3
1

test-coverage

Analyze test coverage and identify gaps with recommended tests.

Community
Intermediate
eliottbusinesseliottbusiness

requesting-code-review

Automate pre-commit code review with static analysis and security scanning.

Community
Advanced
bpnrockstarbpnrockstar

active-directory

Execute full-phased Active Directory penetration testing from network recon to domain dominance.

Community
Advanced