Auth Sec
- 2.4k installs
- 1.5k repo stars
- Updated June 16, 2026
- yaklang/hack-skills
auth-sec is an agent skill that >-.
About
Authentication and Authorization Router This is the routing entry point for authentication sessions and authorization boundaries Use it to decide whether the issue is mainly login mechanics object level authorization browser trust boundaries or identity protocols such as OAuth JWT SAML before going deeper The target includes login registration password reset 2FA sessions JWT OAuth or SSO You suspect object authorization flaws cross tenant access cross origin reads CSRF or protocol misconfiguration You need to decide whether to test authentication or authorization first Authentication Bypass authbypass authentication flaws SKILL md login bypass password reset 2FA enumeration brute force protections IDOR Broken Object Authorization idor broken object authorization SKILL md IDOR BOLA BFLA missing object permissions JWT OAuth Token Attacks jwt oauth token attacks SKILL md algorithm confusion key trust issues claim abuse token forgery OAuth OIDC Misconfiguration oauth oidc misconfiguration SKILL md redirect URI state nonce PKCE account binding CSRF Cross Site Request Forgery csrf cross site request forgery SKILL md CSRF tokens SameSite JSON CSRF login CSRF CORS Cross
- Entry P1 category router for authentication and authorization. Use when
- testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF,
- and enterprise SSO weaknesses before any deeper auth topic skill.
- Follow auth-sec SKILL.md steps and documented constraints.
- Follow auth-sec SKILL.md steps and documented constraints.
Auth Sec by the numbers
- 2,358 all-time installs (skills.sh)
- +143 installs in the week ending Aug 4, 2026 (Skillselion tracking)
- Ranked #403 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
auth-sec capabilities & compatibility
- Capabilities
- entry p1 category router for authentication and · testing login flows, sessions, object authorizat · and enterprise sso weaknesses before any deeper · follow auth sec skill.md steps and documented co
- Use cases
- orchestration
What auth-sec says it does
Entry P1 category router for authentication and authorization. Use when
testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF,
and enterprise SSO weaknesses before any deeper auth topic skill.
npx skills add https://github.com/yaklang/hack-skills --skill auth-secAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 2.4k |
|---|---|
| repo stars | ★ 1.5k |
| Security audit | 3 / 3 scanners passed |
| Last updated | June 16, 2026 |
| Repository | yaklang/hack-skills ↗ |
When should an agent use auth-sec and what problem does it solve?
>-
Who is it for?
Developers invoking auth-sec as documented in the skill source.
Skip if: Skip when requirements fall outside auth-sec documented scope.
When should I use this skill?
>-
What you get
Outputs aligned with the auth-sec SKILL.md workflow and stated deliverables.
- routed skill recommendation
- auth surface classification
Files
Authentication and Authorization Router
This is the routing entry point for authentication, sessions, and authorization boundaries.
Use it to decide whether the issue is mainly login mechanics, object-level authorization, browser trust boundaries, or identity protocols such as OAuth/JWT/SAML before going deeper.
When to Use
- The target includes login, registration, password reset, 2FA, sessions, JWT, OAuth, or SSO
- You suspect object authorization flaws, cross-tenant access, cross-origin reads, CSRF, or protocol misconfiguration
- You need to decide whether to test authentication or authorization first
Skill Map
- Authentication Bypass: login bypass, password reset, 2FA, enumeration, brute-force protections
- IDOR Broken Object Authorization: IDOR, BOLA, BFLA, missing object permissions
- JWT OAuth Token Attacks: algorithm confusion, key trust issues, claim abuse, token forgery
- OAuth OIDC Misconfiguration: redirect URI, state, nonce, PKCE, account binding
- CSRF Cross Site Request Forgery: CSRF tokens, SameSite, JSON CSRF, login CSRF
- CORS Cross Origin Misconfiguration: reflected Origin, credentialed cross-origin reads, allowlist bypass
- SAML SSO Assertion Attacks: assertion wrapping, signature validation, audience, ACS boundaries
Recommended Flow
1. First confirm the authentication model and session boundaries 2. Then confirm object-level and function-level authorization 3. Then move to token, cross-origin, and protocol details 4. If enterprise federation exists, continue with OAuth, OIDC, or SAML topics
Related Categories
- api-sec
- Default credentials, username variants, wordlist sizing, and port focus are consolidated in authbypass-authentication-flaws
Related skills
Setup Matt Pocock SkillsScaffold the per-repo configuration that Matt Pocock’s engineering agent skills rely on so they understand the issue tracker, triage labels, and domain documentation la495k196k
Lark AppsConnect Claude, Cursor or custom agents directly to Lark (Feishu) for messaging, document automation, approval workflows and enterprise data access.402k
CavemanSlash token usage by roughly 75% while keeping every technical detail intact when working with Claude Code, Cursor or similar agents.391k94.7k
Lark Skill MakerQuickly turn any Lark/Feishu OpenAPI call or multi-step workflow into a reusable agent skill with its own SKILL.md.386k16k
Running Claude Code Via Litellm CopilotRun Claude Code at a fraction of the cost by routing requests through LiteLLM to the GitHub Copilot Chat API.270k72
Codex PetGenerate a complete Codex Pet spritesheet and metadata from one reference image without needing an OpenAI key or Codex Pro.246k10How it compares
Start with auth-sec to pick the right auth playbook; jump to leaf skills when the flaw class is already known.
FAQ
What is auth-sec?
>-
When should I use auth-sec?
>-
Is auth-sec safe to install?
Review the Security Audits panel on this page before production use.