skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

auth-sec

Route security findings to authentication, authorization, session, or identity-protocol skills.

5|2|Updated May 16, 2026
Search Tags:#authorization#authentication#OAuth#JWT#CORS#CSRF#session security
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill auth-sec-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-sec
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/auth-sec
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill auth-sec-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you quickly decide whether a finding is rooted in authentication mechanics, session handling, object-level authorization, or identity protocols so you stop guessing and choose the correct next steps.

Core Features & Use Cases

  • Authentication vs. authorization routing: Determines whether the main issue is login/session flow, object permission boundaries, or cross-origin/browser trust.
  • Protocol-focused next hops: Guides you to deeper skills for JWT/OAuth/OIDC/SAML, CSRF, and CORS based on observed behaviors.
  • Engagement planning: Establishes a testing sequence that moves from trust boundaries to protocol details once the model is clear.

Quick Start

Use the auth-sec router to select the most relevant deeper skill after you identify whether your target issue is login/session, object authorization, token misuse, or cross-origin request handling.

Frequently Asked Questions about auth-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I know if a security issue is authentication or authorization?▼

Authentication involves verifying login and session flow, while authorization checks object permission boundaries. This Skill routes your finding by mapping observed symptoms to the correct security testing path for targeted investigation.

When do I need to test OAuth and JWT token configuration problems?▼

Test OAuth and JWT configurations when you observe identity protocol misuse or token handling anomalies. This Skill maps those behaviors to deeper investigation skills for analyzing claims, redirects, and token trust boundaries.

What is the best way to route cross-origin request handling issues like CSRF and CORS?▼

The best way is to route CSRF and CORS issues through cross-origin browser trust analysis. This Skill guides you to deeper skills for targeted investigation of browser-mediated request forgery and cross-origin resource sharing scenarios.

How do I plan a security testing sequence for session boundary vulnerabilities?▼

Plan your sequence by moving from trust boundaries to protocol details. This Skill establishes an engagement testing sequence that starts with session handling and identity boundaries before investigating deeper token and protocol mechanics.

Can I use this to test SAML and OIDC identity protocol misuse?▼

Yes, you can use this to test SAML and OIDC protocols. It determines whether your issue is identity-protocol misuse and routes you to deeper skills for targeted investigation of token configuration, claims, and trust boundaries.

Related Skills

Explore More Education & Research Skills→
yaklangyaklang
1.6k

auth-sec

Map authentication and authorization test scope for web and API targets.

Official
Intermediate
ok-helloworldok-helloworld
241

auth-sec

Route authentication and authorization testing to the appropriate sub-skill.

Community
Intermediate
elementalsoulselementalsouls
3.3k

hunt-cors

Detect CORS misconfigurations allowing credentialed cross-origin reads with browser PoCs.

Community
Advanced
utsavthakurutsavthakur

auth-sec

Analyze authentication and authorization workflows for OAuth, JWT, SAML, CORS, CSRF, and SSO weaknesses.

Community
Advanced