skills.rest
marquesfelip
marquesfelipCOMMUNITY
Explore all skills by this author →
GitHub

oauth-security

Review OAuth2/OIDC integrations for flow choices, validation, and token handling.

Updated Mar 29, 2026
Search Tags:#security#oauth#oidc#oauth2#pkce#redirect-uri#token-exchange
One-click install
npx skills add https://github.com/marquesfelip/agents-and-skills --skill oauth-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth-security
Source: https://github.com/marquesfelip/agents-and-skills/tree/main/skills/oauth-security
Command: npx skills add https://github.com/marquesfelip/agents-and-skills --skill oauth-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secure OAuth2 / OIDC integrations by guiding safe token exchange, redirect validation, and provider trust boundaries, reducing misconfigurations and risk.

Core Features & Use Cases

  • Guidance on choosing flow (Authorization Code with PKCE, client credentials) and when to apply.
  • Best practices for CSRF protection via state, PKCE, nonce, token storage, and JWKS validation.
  • Example security review scenarios: code reviews for OAuth implementations, provider trust boundaries, and vulnerability checks.

Quick Start

Review an OAuth2/OIDC integration in your codebase and provide a security-focused evaluation with concrete mitigations.

Frequently Asked Questions about oauth-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review OAuth2 integrations for security vulnerabilities?▼

Implement OAuth2 PKCE and CSRF protection by selecting the Authorization Code flow with PKCE for web and mobile apps. Validate the state parameter for CSRF defense and ensure proper nonce handling for ID tokens.

What is the best way to verify OIDC ID token signatures?▼

Verify OIDC ID token signatures using JWKS-based validation. Ensure proper issuer and audience validation, and verify nonce handling to maintain provider trust boundaries and secure token exchange.

When do I use client credentials vs authorization code flow for API security?▼

Use client credentials flow for machine-to-machine API services, and Authorization Code with PKCE for user-facing web and mobile apps. Choose based on whether the client requires delegated user access or direct service access.

Does OAuth token storage need JWKS validation and redirect URI checks?▼

Yes, secure OAuth token storage requires JWKS validation for signature verification and strict redirect URI validation. These steps prevent token interception and ensure safe provider trust boundaries.

Why does my OAuth2 redirect validation fail during a security review?▼

OAuth2 redirect validation fails when redirect URIs are not strictly matched or allowed to vary dynamically. Enforce exact string matching for redirect URIs to prevent open redirect vulnerabilities and token leakage.

Related Skills

Explore More Software Engineering Skills→
kagentikagenti
292

auth:otel-oauth2-exporter

Configure the OpenTelemetry Collector with OAuth2 client credentials for trace export.

Official
Intermediate
xalgordxalgord
846

oauth2-oidc

Probe OAuth2/OIDC flows for PKCE bypass and token handling misconfigurations.

Community
Advanced
tachiiri-orgtachiiri-org

setup-idp-auth0

Configure Auth0 identity provider integration for authentication and token validation.

Official
Advanced
riparinoriparino
1

offensive-oauth

Identify OAuth flows and validate security posture across web, mobile, and SPA applications.

Community
Advanced