Auth audit

Skill fusengine/agents/plugins/security-expert/skills/auth-audit

Redefining development through cognitive automation and collaborative agent systems.

Install

npx -y skills add fusengine/agents --skill auth-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

22 stars22 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Audit authentication and authorization patterns. Checks JWT, sessions, OAuth2, PKCE implementations for security best practices and common vulnerabilities. Use when: auditing JWT, session, OAuth2/PKCE, password, or MFA implementations for security vulnerabilities.

SKILL.md

1.4 KB, as published. Nobody here has run it

Auth Audit Skill

Overview

Comprehensive audit of authentication and authorization implementations.

Audit Categories

Category	Checks
JWT	Signing algo, expiration, refresh, storage
Sessions	Storage, expiry, regeneration, fixation
OAuth2	PKCE, state param, redirect validation
Passwords	Hashing algo, strength rules, reset flow
MFA	Implementation, backup codes, recovery

Workflow

Detect auth implementation (JWT, sessions, OAuth)
Scan for known anti-patterns
Verify cryptographic choices
Check token/session lifecycle
Audit authorization logic (RBAC, ABAC)

Common Vulnerabilities

JWT signed with none algorithm
JWT secret too short (< 256 bits)
No token expiration or too long
Refresh tokens stored in localStorage
Session fixation after login
Missing CSRF protection
OAuth without PKCE for public clients
Missing state parameter in OAuth flow