Route web authentication and authorization issues to the correct security testing workflow.
npx skills add https://github.com/lNwNl/Methodos --skill auth-sec-lnwnl
Please help me install this Agent Skill. Skill: auth-sec Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/auth-sec Command: npx skills add https://github.com/lNwNl/Methodos --skill auth-sec-lnwnl
This Skill helps you quickly determine whether a vulnerability primarily stems from authentication mechanics, session handling, or authorization boundaries, so you test the correct layer first instead of wasting cycles on unrelated exploit paths.
Use the auth-sec skill to decide whether your target requires login/session validation, object authorization testing, or token/OAuth/SSO and browser boundary checks by answering which of those boundaries the observed behavior most closely implicates.
High-intent search queries and answers about installing and using this skill.
Authentication versus authorization triage determines if a weakness stems from login session handling, identity entry points, or object-level access boundaries like BOLA. Scoping observed behaviors to the specific layer prevents wasted testing on unrelated exploit paths.
Testing JWT and OAuth protocol misconfigurations is needed when observed behaviors implicate token handling, SSO federation, or browser trust boundary failures. Selecting targeted testing routes investigation to protocol-specific risks across these authenticated request flows.
Scope object-level authorization testing by routing investigation to missing permission checks across tenants, roles, and resource ownership. This focuses BOLA and IDOR vulnerability detection on boundaries where access controls fail to validate the requesting user.
Yes, this approach helps test CORS and CSRF browser trust boundary failures by selecting targeted testing for their interaction with authenticated requests. It routes investigation to common browser trust boundary issues alongside token and federation protocol checks.
The best way to route SAML federated identity flow testing is by evidence-based scoping to select the next specialized security skill. This targets protocol misconfiguration risks specific to SAML within the broader authentication-security workflow map.
Authentication testing focuses on the wrong attack surface when vulnerabilities are not correctly triaged between session handling, authorization boundaries, and protocol risks. Evidence-based scoping selects the correct testing route to avoid wasting cycles on unrelated paths.
dapperdiversIdentify exposed services, technologies, directories, and TLS configurations on web applications.
bbrowningAutomate security reviews of JWT, OAuth 2.0/2.1, PKCE, and token exchange code.
yaklangMap authentication and authorization test scope for web and API targets.
rajyeole6Integrate SAST, DAST, and dependency scanning into CI/CD pipelines.
