skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

auth-sec

Route authentication and authorization testing to the appropriate sub-skill.

241|28|Updated May 20, 2026
Search Tags:#authorization#authentication#OAuth#JWT#CORS#CSRF#session security
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill auth-sec-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auth-sec
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/auth-sec
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill auth-sec-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you identify and reason about authentication and authorization weaknesses by separating login mechanics, session handling, object-level access control, and identity protocol trust boundaries so you test the right layer first.

Core Features & Use Cases

  • Authentication flow decisioning: choose whether issues are primarily login/session problems or authorization boundary problems based on observed behavior and threat model.
  • Authorization coverage mapping: focus on object-level authorization failures such as IDOR/BOLA/BFLA and cross-tenant or cross-origin access issues before moving deeper.
  • Protocol and browser-boundary guidance: route analysis toward OAuth/JWT, OAuth OIDC misconfiguration, CSRF protections, CORS policy risks, and SAML assertion validation issues when those patterns appear.

Quick Start

Use the auth-sec skill to route your testing of a target’s login, session, and authorization behavior by telling it what endpoints, flows, and suspected weaknesses you observed.

Frequently Asked Questions about auth-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for authentication and authorization vulnerabilities in a web application?▼

Authentication and authorization vulnerabilities are tested by separating login mechanics, session handling, object-level access control, and identity protocol trust boundaries to evaluate the correct layer first based on observed endpoint behavior.

What is the best way to identify broken object-level authorization like IDOR or BFLA?▼

Broken object-level authorization like IDOR or BFLA is identified by mapping authorization coverage across functions and tenants, focusing testing on object-level access control failures before performing deeper protocol analysis.

How does JWT and OAuth misconfiguration analysis work for session security?▼

JWT and OAuth misconfiguration analysis works by routing evaluation toward identity protocol trust boundaries, assessing token validation, OIDC configurations, and SAML assertion issues when those specific patterns appear in the target flow.

Can I assess CORS and CSRF browser trust boundaries using a structured security assessment?▼

CORS and CSRF browser trust boundaries can be assessed using a structured evaluation that routes analysis toward cross-origin access issues and session handling protections when suspicious browser boundary behaviors are observed.

When do I need to separate authentication bypass testing from authorization boundary testing?▼

Authentication bypass testing must be separated from authorization boundary testing when observed behavior indicates login mechanics differ from object-level access control, ensuring the correct sub-skill is selected before deeper analysis.

Does this security assessment approach work for cross-tenant access control vulnerabilities?▼

This security assessment approach works for cross-tenant access control vulnerabilities by explicitly mapping authorization coverage across tenants and evaluating object-level access issues within multi-tenant environments.

Related Skills

Explore More Software Engineering Skills→
yu13130122297yu13130122297

scout

Identify uncertainties in research framing, datasets, metrics, and baselines.

Community
Intermediate
Prohao42Prohao42
120

authbypass-authentication-flaws

Identify and bypass authentication flaws in web applications.

Community
Advanced
wjgoarxivwjgoarxiv
29

autoresearch:security

Automate security audits with STRIDE, OWASP Top-10, and attack surface mapping.

Community
Advanced
AbdullahMalik17AbdullahMalik17
9

configuring-better-auth

Configure OAuth 2.1 and OIDC authentication with Better Auth and MCP.

Community
Advanced