skills.rest
jasonraimondi
jasonraimondiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

oauth2-specialist

Analyze OAuth2 implementations for vulnerabilities and RFC compliance.

20|Updated Jun 9, 2022
Search Tags:#code-review#oauth2#security-review#token-security#PKCE#vulnerability-analysis#RFC6749
One-click install
npx skills add https://github.com/jasonraimondi/dotfiles --skill oauth2-specialist
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: oauth2-specialist
Source: https://github.com/jasonraimondi/dotfiles/tree/main/claude/dot-claude/skills/oauth2-specialist
Command: npx skills add https://github.com/jasonraimondi/dotfiles --skill oauth2-specialist

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps engineering teams detect OAuth2 security gaps early in PRs and ensure RFC compliance across implementations, reducing the risk of critical vulnerabilities in authentication flows.

Core Features & Use Cases

  • Code review checklist for OAuth2 changes (PKCE enforcement, redirect URI validation, token storage, revocation, state handling).
  • RFC compliance validation against RFC6749, RFC7636, RFC7009, RFC7519, RFC8693.
  • Educational critique with concrete remediation suggestions and threat-model style explanations.
  • Security test guidance to generate and evaluate tests for proposed changes.

Quick Start

Provide a security-focused review of an OAuth2 implementation changes in a PR, referencing RFC standards and offering concrete remediation steps.

Frequently Asked Questions about oauth2-specialist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review an OAuth2 implementation for security vulnerabilities in a PR?▼

OAuth2 RFC compliance validation checks implementations against RFC6749, RFC7636, RFC7009, RFC7519, and RFC8693 to ensure protocol conformity. It verifies PKCE, token rotation, and state parameters match specification requirements to prevent authentication bypass vulnerabilities.

What is OAuth2 RFC compliance validation and which standards are checked?▼

OAuth2 RFC compliance validation checks implementations against RFC6749, RFC7636, RFC7009, RFC7519, and RFC8693 to ensure protocol conformity. It verifies PKCE, token rotation, and state parameters match specification requirements to prevent authentication bypass vulnerabilities.

How do I validate PKCE usage and redirect URI handling in my OAuth2 server?▼

Validating PKCE usage and redirect URI handling requires checking that code challenges and verifiers are enforced during authorization flows, and that redirect URIs use exact string matching. This prevents authorization code interception and malicious redirection attacks.

Can I use a security review checklist for OAuth2 token storage and revocation changes?▼

Yes, you can use an OAuth2 security review checklist for token storage and revocation changes to systematically verify secure storage mechanisms, validate token rotation policies, and ensure proper revocation endpoint implementation to mitigate token theft risks.

How do I generate security tests for proposed OAuth2 flow modifications?▼

Generating security tests for OAuth2 flow modifications involves evaluating proposed changes against threat models, validating PKCE and state parameters, and creating test cases that verify token revocation and redirect URI validation resist known attack vectors.

When should I not rely on automated OAuth2 code review for vulnerability analysis?▼

Automated OAuth2 code review may be insufficient when dealing with complex custom grant types, non-standard deployment configurations, or nuanced architectural threat modeling that requires manual contextual analysis beyond standard RFC compliance checks.

Related Skills

Explore More Software Engineering Skills→
alysonhoweralysonhower
1

clavix-review

Analyze code changes and generate criteria-driven review reports with severity levels.

Community
Advanced
vanman2024vanman2024
10

fastapi-auth-patterns

Implement JWT, OAuth2, and RBAC authentication patterns in FastAPI applications.

Community
Advanced
YukiIto1999YukiIto1999

testing-oauth2-implementation-flaws

Simulate OAuth2 and OpenID Connect attacks to detect security flaws.

Community
Advanced
slantviewslantview
1

security-auditor

Audit code and dependencies for vulnerabilities and OWASP compliance.

Community
Advanced