What problem does it solve? OAuth and OIDC implementations often hide subtle flaws in redirect URI validation, state/nonce binding, PKCE enforcement, and token audience checks, and unstructured testing produces false positives or inconclusive results. This Skill provides a disciplined, evidence-gated workflow for verifying these controls on your own authorized clients and callback domains. ## Core Features & Use Cases - Protocol Modeling: Builds a baseline model of issuer, client_id, grant type, redirect URI allowlist, state/nonce, PKCE, and token audience by capturing a real authorization flow via Chrome or Burp. - Minimal Single-Variable Verification: Tests registered callback path/encoding/fragment variants, cross-session state/nonce/PKCE binding, and audience/issuer/account-linking rejection logic using only owned test clients. - Evidence and Triage Discipline: Records sanitized authorization timelines, per-parameter differential evidence, and routes related findings to SAML, session, or open-redirect specialist flows. - Use Case: During an authorized assessment of your own web application's social login, use this Skill to verify whether a modified callback path is strictly rejected and whether the state parameter is correctly bound to the initiating session. ## Quick Start Ask the agent to run the hunt-oauth flow against your own registered OAuth test client and callback domain to verify redirect URI, state, and PKCE enforcement.
