agentsclimarketplace

Auth security reviewer

Skill lteawoo/skills/skills/auth-security-reviewer

A collection of practical AI agent skills for app development and code workflows.

Install
npx -y skills add lteawoo/skills --skill auth-security-reviewer

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Review security risks around login, sessions, tokens, authorization checks, admin boundaries, and secret exposure. Use it for changes involving auth or sensitive data handling.

SKILL.md

2.7 KB, as published. Nobody here has run it

Auth Security Reviewer

Purpose

Identify security vulnerabilities and operational risks around authentication, authorization boundaries, and sensitive data handling.

Core Principles

  1. Evaluate authentication and authorization separately.
  2. Check bypass paths and failure paths before the success path.
  3. Do not trust client-side validation.
  4. Review sensitive data across storage, transport, logs, and responses.
  5. Keep admin boundaries distinct from regular user capabilities.
  6. Do not overstate assumptions; describe the conditions required for exploitation.

Inputs

  • Auth-related code or changes
  • Login flow and session or token design
  • Permission model or role definitions
  • Environment variables and secret handling approach
  • Related APIs, middleware, guards, or route configuration
  • Known concerns or prior incidents, if available

Review Workflow

  1. Separate authentication boundaries from authorization boundaries.
  2. Map the flow for login, sessions, and token issuance, verification, expiry, and refresh.
  3. Confirm where permission checks happen across routes, APIs, and service layers.
  4. Inspect admin-only features, resource ownership checks, and direct object access risks.
  5. Check whether secrets, tokens, or personal data are exposed through storage, logs, or responses.
  6. Document exploitable failure paths and any further validation that is required.

Output Format

Security Review Summary

  • Review scope
  • Core security boundaries

Authentication Review

  • Login and session flow
  • Token issuance, expiration, and refresh handling
  • Authentication bypass risk

Authorization Review

  • Roles or permission model
  • Permission checks per endpoint or service
  • Resource ownership validation

Sensitive Data Review

  • How secrets are stored and injected
  • Exposure in logs, responses, or client storage
  • Environment-variable or configuration risks

Key Findings

  • Vulnerable areas
  • Exploitation conditions
  • Recommended remediation direction

Additional Validation

  • Security tests to add
  • Manual review scenarios
  • Assumptions that still need confirmation

When Information Is Missing

  • If the auth structure is unclear, separate confirmed facts from assumptions based on the current code.
  • If the permission model is undocumented, judge it from the actual enforcement points.
  • If security impact looks high but evidence is incomplete, do not down-rank it to "needs confirmation" without stating the risk conditions.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.