Oauth Oidc Misconfiguration
- 2.3k installs
- 1.5k repo stars
- Updated June 16, 2026
- yaklang/hack-skills
oauth-oidc-misconfiguration is an agent skill that >-.
About
SKILL OAuth and OIDC Misconfiguration Redirects PKCE Scopes and Token Binding AI LOAD INSTRUCTION Use this skill when the target uses OAuth 2 0 or OpenID Connect and you need a focused misconfiguration checklist redirect URI validation state and nonce handling PKCE enforcement token audience and account binding mistakes The app supports Login with Google GitHub Microsoft Okta or other IdPs You see authorize callback redirect_uri code state nonce or code_challenge Mobile or SPA clients rely on OAuth or OIDC flows For token cryptography and JWT header abuse also load jwt oauth token attacks jwt oauth token attacks SKILL md The oauth oidc misconfiguration agent skill provides documented workflows prerequisites triggers and safety guidance from its SKILL md source Agents load it when user requests match the description and follow step by step instructions without inventing capabilities It integrates with standard agent tooling for the tasks inputs outputs and failure modes described in the repository documentation
- OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation,
- > **AI LOAD INSTRUCTION**: Use this skill when the target uses OAuth 2.0 or OpenID Connect and you need a focused miscon
- - The app supports `Login with Google`, GitHub, Microsoft, Okta, or other IdPs
- Follow oauth-oidc-misconfiguration SKILL.md steps and documented constraints.
- Follow oauth-oidc-misconfiguration SKILL.md steps and documented constraints.
Oauth Oidc Misconfiguration by the numbers
- 2,348 all-time installs (skills.sh)
- +127 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #422 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
oauth-oidc-misconfiguration capabilities & compatibility
- Capabilities
- oauth and oidc misconfiguration testing playbook · > **ai load instruction**: use this skill when t · the app supports `login with google`, github, · follow oauth oidc misconfiguration skill.md step
- Use cases
- orchestration
What oauth-oidc-misconfiguration says it does
OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.
> **AI LOAD INSTRUCTION**: Use this skill when the target uses OAuth 2.0 or OpenID Connect and you need a focused misconfiguration checklist: redirect URI validation, state and nonce handling, PKCE en
- The app supports `Login with Google`, GitHub, Microsoft, Okta, or other IdPs
npx skills add https://github.com/yaklang/hack-skills --skill oauth-oidc-misconfigurationAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 2.3k |
|---|---|
| repo stars | ★ 1.5k |
| Security audit | 3 / 3 scanners passed |
| Last updated | June 16, 2026 |
| Repository | yaklang/hack-skills ↗ |
When should an agent use oauth-oidc-misconfiguration and what problem does it solve?
>-
Who is it for?
Developers invoking oauth-oidc-misconfiguration as documented in the skill source.
Skip if: Skip when requirements fall outside oauth-oidc-misconfiguration documented scope.
When should I use this skill?
>-
What you get
Outputs aligned with the oauth-oidc-misconfiguration SKILL.md workflow and stated deliverables.
- Misconfiguration finding list
- Redirect and PKCE test notes
- Token binding review summary
Files
SKILL: OAuth and OIDC Misconfiguration — Redirects, PKCE, Scopes, and Token Binding
AI LOAD INSTRUCTION: Use this skill when the target uses OAuth 2.0 or OpenID Connect and you need a focused misconfiguration checklist: redirect URI validation, state and nonce handling, PKCE enforcement, token audience, and account binding mistakes.
1. WHEN TO LOAD THIS SKILL
Load when:
- The app supports
Login with Google, GitHub, Microsoft, Okta, or other IdPs - You see
authorize,callback,redirect_uri,code,state,nonce, orcode_challenge - Mobile or SPA clients rely on OAuth or OIDC flows
For token cryptography and JWT header abuse, also load:
- jwt oauth token attacks
2. HIGH-VALUE MISCONFIGURATION CHECKS
| Theme | What to Check |
|---|---|
state handling | missing, static, predictable, or not bound to user session |
redirect_uri validation | prefix match, open redirect chaining, path confusion, localhost leftovers |
| PKCE | missing for public clients, code verifier not enforced, downgraded flow |
OIDC nonce | missing or not validated on ID token return |
| token audience and issuer | weak aud / iss checks, cross-client token reuse |
| account binding | callback binds attacker identity to victim session |
| scope handling | broader scopes granted than the user or client should receive |
3. QUICK TRIAGE
1. Map the full flow: authorize, callback, token exchange, logout. 2. Replay callback flows with altered state, nonce, and redirect_uri. 3. Compare SPA, mobile, and web clients for weaker validation. 4. Check whether one provider account can be rebound to another local account.
4. RELATED ROUTES
- CORS or cross-origin token exposure: cors cross origin misconfiguration
- XML federation or enterprise SSO: saml sso assertion attacks
- CSRF-heavy login or binding bugs: csrf cross site request forgery
Related skills
Setup Matt Pocock SkillsScaffold the per-repo configuration that Matt Pocock’s engineering agent skills rely on so they understand the issue tracker, triage labels, and domain documentation la495k196k
Lark AppsConnect Claude, Cursor or custom agents directly to Lark (Feishu) for messaging, document automation, approval workflows and enterprise data access.402k
CavemanSlash token usage by roughly 75% while keeping every technical detail intact when working with Claude Code, Cursor or similar agents.391k94.7k
Lark Skill MakerQuickly turn any Lark/Feishu OpenAPI call or multi-step workflow into a reusable agent skill with its own SKILL.md.386k16k
Running Claude Code Via Litellm CopilotRun Claude Code at a fraction of the cost by routing requests through LiteLLM to the GitHub Copilot Chat API.270k72
Codex PetGenerate a complete Codex Pet spritesheet and metadata from one reference image without needing an OpenAI key or Codex Pro.246k10FAQ
What is oauth-oidc-misconfiguration?
>-
When should I use oauth-oidc-misconfiguration?
>-
Is oauth-oidc-misconfiguration safe to install?
Review the Security Audits panel on this page before production use.