Oauth audit

Personal skills collection for Claude

Install

npx -y skills add Lu1sDV/skillsmd --skill oauth-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when auditing OAuth 2.0 / OIDC implementations against RFC 9700 (OAuth Security BCP), reviewing client or authorization-server code, evaluating PKCE / state / redirect-URI handling, hardening token exchange and refresh flows, or triaging suspected OAuth vulnerabilities (CWE-352 CSRF, CWE-287 broken auth).

SKILL.md

6.0 KB, ~1.4k tokens by cl100k_base, as published. Nobody here has run it

OAuth 2.0 / OIDC Security Audit

Formal review workflow for OAuth 2.0 and OpenID Connect implementations. Maps every finding to a normative source (RFC 9700 §, OWASP, CWE) and produces a severity-rated report — not a generic "best practices" summary.

Quick Reference

What	Details
Primary spec	RFC 9700 — OAuth 2.0 Security Best Current Practice (Jan 2025)
Adjacent specs	RFC 6749 (core), RFC 6750 (bearer), RFC 7636 (PKCE), RFC 9207 (`iss` mix-up), RFC 8414 (AS metadata), RFC 7009 (revocation)
OWASP	A07:2025 Authentication Failures, A01:2025 Broken Access Control
CWE	CWE-352 (CSRF), CWE-287 (broken auth), CWE-601 (open redirect), CWE-384 (session fixation)
Deprecated grants	Implicit (`response_type=token`), Resource Owner Password Credentials
Always required for public clients	PKCE with `S256` (never `plain`)
Mix-up defence	RFC 9207 `iss` parameter or per-AS distinct redirect URIs

When to Use

Reviewing an OAuth/OIDC client integration (login-with-Google/GitHub/Azure, mobile, SPA, CLI)
Auditing an authorization-server or resource-server implementation
Triaging a suspected OAuth-related vulnerability or incident
Hardening token storage, refresh-token rotation, or scope handling
Pre-launch security gate before exposing a new OAuth client publicly

When NOT to use:

Pure session-cookie auth without OAuth — use a generic auth-review skill
SAML / WS-Fed federation — different spec family
API-key / HMAC-signed request auth — out of scope

Prerequisites

Read access to the codebase implementing the OAuth flow
Knowledge of which provider(s) are integrated and the registered redirect URIs
For AS audits: access to AS configuration / metadata endpoint
Authorisation to review the system (internal review or signed engagement)

Workflow

Produce a severity-rated finding report mapped to RFC 9700 sections, OWASP Top 10, and CWE. Keep SKILL.md as the operating workflow; load references/jwt-security.md only when JWT signature, key-selection, token-purpose, cookie, or claim-validation depth is needed.

1. Scope the Review

Before reading any code, establish:

Role under review: client, authorization server, resource server, or combination
Client type: public (SPA, mobile, native, CLI — cannot keep a secret) or confidential (server-side with stored secret)
Grant types in use: authorization code, authorization code + PKCE, client credentials, device code, refresh token. Flag implicit / ROPC immediately as findings.
Provider trust model: single AS, multiple AS, federated, BYO-IDP
Token surfaces: where access tokens, ID tokens, and refresh tokens are stored, transmitted, and logged

Record this in the report header — every finding must be evaluated against this scope.

2. Locate the OAuth Surface

Identify in the codebase:

Authorization request construction (where response_type, state, code_challenge, scope are assembled)
Redirect URI registration list and runtime validation
Callback / token-exchange endpoint
Token storage (memory, cookie, localStorage, server session, DB)
Refresh-token rotation / revocation logic
ID-token signature, iss, aud, nonce, and exp validation
Logout / revocation calls to the AS

Use grep patterns: state=, code_challenge, redirect_uri, Bearer , localStorage.*token, id_token, jwks, client_secret.

3. Evaluate Against the Checklist

Load references/audit-checklist.md for the detailed checklist, rating rubric, BAD/GOOD state example, report template, and common audit mistakes. Apply the checklist IDs exactly and cite every finding with code location plus RFC/CWE/OWASP references.

4. Report

Use the report template in references/audit-checklist.md. No finding is complete without: checklist ID, code location, RFC section, and CWE or OWASP mapping.

Hand-offs

For JWT signature / claim validation depth (alg confusion, kid/JWKS handling, claim validation, token-purpose confusion, cookie hardening, lifetime), load references/jwt-security.md. Treat it as a heuristic pattern catalog; final OAuth findings still need the required RFC/CWE/OWASP citation from this skill's report rules.
For session-fixation, cookie security, CSRF on non-OAuth endpoints, hand off to a generic web-auth review.
For SSRF in token-introspection / JWKS-fetch, hand off to ssrf-testing.
For broader OWASP Top 10 sweep, hand off to a general security-review skill — this skill is OAuth-only by design.