Browser Auth Flow
- 599 installs
- 67k repo stars
- Updated August 4, 2026
- ruvnet/ruflo
browser-auth-flow is a Ruflo browser plugin skill that adversarially probes web authentication for CSRF, redirect, cookie, and OAuth issues for developers who need structured auth security findings before release.
About
browser-auth-flow is a skill in ruvnet/ruflo's ruflo-browser plugin that probes a site's authentication flow and writes structured findings.md inside an RVF container. It opens a recorded browser session, drives login like browser-login, then runs configurable probes for missing CSRF tokens, cross-origin redirect leaks, weak session cookies, and OAuth state or nonce problems. Captured tokens and PII stay quarantined behind aidefence_scan gates and are never returned unredacted. Output includes per-probe severity ratings and a pass, warn, or fail verdict, with sessions indexed under tag auth-probe for regression baselines. Typical trajectories run 15–40 steps. Developers invoke it for pre-deployment auth audits, suspected token leaks, or establishing ongoing auth regression checks—not for exploitation or automated remediation.
- browser-auth-flow
Browser Auth Flow by the numbers
- 599 all-time installs (skills.sh)
- +7 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #659 of 4,347 Backend & APIs skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
npx skills add https://github.com/ruvnet/ruflo --skill browser-auth-flowAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 599 |
|---|---|
| repo stars | ★ 67k |
| Last updated | August 4, 2026 |
| Repository | ruvnet/ruflo ↗ |
How do you audit a web login flow?
Use browser-auth-flow for development tasks
Who is it for?
Developers auditing new or changed authentication flows who need structured, human-reviewable security findings before shipping.
Skip if: Skip browser-auth-flow when you need exploitation, credential stuffing, or automated fixes without surfacing findings to a human first.
When should I use this skill?
User provides a login URL and asks to probe auth, check CSRF or OAuth config, or audit redirect and session cookie security.
What you get
findings.md with per-probe severities, pass/warn/fail verdict, and indexed auth-probe browser session
- findings.md
- indexed auth-probe browser session
By the numbers
- Supports 4 authentication probes: csrf, redirect, cookie, and oauth
- Typical auth probe trajectories use 15–40 browser steps
- Produces findings.md with per-probe severity and a pass/warn/fail verdict
Files
Browser Auth Flow
Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured findings.md inside the RVF container.
When to use
- Pre-deployment audit of a new auth flow.
- Investigating a suspected token leak or redirect issue.
- Establishing a baseline for ongoing regression checks.
Steps
1. Open a recorded session via browser-record. 2. Drive the auth flow as in browser-login (credentials come from --credentials <handle> referencing browser-cookies if the run is a re-auth probe). 3. Run probes:
- `csrf`: inspect the login POST in the trajectory; verify a same-origin token field is present and non-empty.
- `redirect`: watch
browser_get-urlafter each nav for cross-origin redirects with auth state in the URL or fragment. Flag any token-bearing URL that crosses an origin boundary. - `cookie`: walk
document.cookieviabrowser_eval. For each cookie, checkSecure,HttpOnly,SameSite, expiry, and entropy of the value. Flag missing flags or short tokens. Pass each throughaidefence_scanto flag PII embedded in cookie values. - `oauth`: if the flow involves a third-party provider, capture the authorization request, verify
stateandnonceare present and high-entropy, verifyredirect_urimatches the registered callback domain.
4. Quarantine any token / credential / PII captured during probing — it stays inside the RVF container's findings, never returns to the model unredacted (aidefence_is_safe gate from browser-extract applies if you read the findings back). 5. Write `findings.md` with one section per probe, severity rating per finding, and a verdict (pass / warn / fail). 6. Index the session in browser-sessions with tag: auth-probe so future audits compare against it.
Caveats
- This skill probes; it does not exploit. Do not chain follow-up requests using a captured token.
- Credentials must come from a vaulted handle or interactive entry. Never hardcode them in the field map.
- Some probes require multiple page loads. Trajectory step count for an auth probe typically lands at 15–40 steps; budget accordingly.
- The output is structured for human review. Do not auto-act on findings without surfacing them to the user first.
Related skills
Lark Openapi ExplorerInstantly explore, test, and generate calls against the full Lark (Feishu) OpenAPI surface without leaving their agent workflow.493k
Lark EventConsume real-time events from Lark/Feishu as structured NDJSON streams inside AI agent workflows.387k16kLark Openapi ExplorerWhen an existing Lark/Feishu skill or CLI command cannot fulfill a specific requirement and they need to discover and invoke the exact native OpenAPI endpoint.386k16k
Just ScrapeQuickly search, crawl, extract structured JSON, or monitor web pages without writing custom scraping code.245k41Lark AppsQuery the current visibility and permission scope of a Lark (Feishu) app without writing HTTP client code.235k16k
Design An InterfaceGenerate multiple radically different interface or API designs in parallel before committing to one.188k198kHow it compares
Pick browser-auth-flow for adversarial auth probing with findings.md output; use browser-login when you only need to vault cookies for reuse without security analysis.
FAQ
What probes does browser-auth-flow run?
browser-auth-flow runs csrf, redirect, cookie, and oauth probes against a driven login flow. CSRF checks login POST tokens, redirect watches for cross-origin auth state in URLs, cookie audits Secure, HttpOnly, and SameSite flags, and oauth verifies state, nonce, and redirect_uri
Does browser-auth-flow exploit captured authentication tokens?
No—browser-auth-flow probes without exploitation. Credentials come from vaulted handles or interactive entry, captured secrets stay inside the RVF container findings, and the skill requires human review before acting on any result.