[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GQ2CTHCBYK98B1HB28792":3,"skill-same:01M71GQ2CTHCBYK98B1HB28792":58},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":25,"linkOnly":26,"markdownContent":27,"markdownBody":28,"frontMatter":29,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":36,"ownerDescription":6,"updatedAt":37,"install":38,"resources":51},"01M71GQ2CTHCBYK98B1HB28792","security-auth-flow-review",null,"lookatitude\u002Fguild","lookatitude","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F524917?v=4","01M71GJ2KGXFSJZKAZC5P1ZXXM","Miguel Pinto","01M71GJ2MH4SH9WJKP8M7XZZ0P",8,"MIT","https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Fsecurity-auth-flow-review\u002FSKILL.md",[],[18,19,20,21,22,23,24],"review","security","auth","flow","security auth","auth flow","security auth flow review","2026-11-10 10:12:30",false,"---\nname: security-auth-flow-review\ndescription: Reviews an authentication \u002F authorization flow (OAuth2 \u002F OIDC \u002F session \u002F token \u002F SAML) — threat-maps the flow, finds weaknesses, lists fixes. Output: `auth-review.md` with step-by-step flow, threat map, and remediation. Pulled by the `security` specialist. TRIGGER: \"review the auth flow for X\", \"audit the OAuth implementation in X\", \"security review of the login flow\", \"check the session handling in X\", \"audit the token lifecycle of X\", \"review the OIDC integration with X\". DO NOT TRIGGER for: writing the auth flow from scratch (backend group owns), general threat modeling across a service (use `security-threat-modeling`), dependency CVE audit (use `security-dependency-audit`), secret scanning (use `security-secrets-scan`), UX of the sign-in screen (frontend-design \u002F mobile group), compliance attestation only.\nwhen_to_use: The parent `security` specialist pulls this skill when the task requires auditing an existing or proposed auth flow end-to-end. Also fires on explicit user request.\ntype: specialist\n---\n\n# security-auth-flow-review\n\nThe auth flow is the door; step through it like an attacker, not like a user.\n\n## What you do\n\nWalk the flow step by step, from client initiation to revocation, annotating each step with the secret material, the redirect, the state carried, and the failure path. Then threat-map it — misused redirects, token replay, fixation, scope escalation — and write remediations.\n\n- Reconstruct the flow diagram end-to-end: client → IdP → callback → session → refresh → logout → revocation.\n- Check redirect URI allowlists, state \u002F PKCE, nonce, ID token validation, audience \u002F issuer.\n- Validate session storage (HttpOnly, Secure, SameSite, idle \u002F absolute timeout, rotation on privilege change).\n- Inspect token lifecycle: access \u002F refresh TTL, rotation, revocation server-side, clock skew tolerance.\n- Cover the negative paths: stolen refresh token, leaked authorization code, CSRF on login, logout on shared device.\n- Map each finding to a concrete fix (code or config), a severity, and an owner.\n\n## Output shape\n\nA markdown file `auth-review.md`:\n\n1. **Flow diagram** — step-by-step with data flowing.\n2. **Components** — IdP, authz server, resource server, client, session store.\n3. **Threat map** — per step: threat · control · status · finding.\n4. **Findings** — severity · description · repro · fix · owner.\n5. **Token lifecycle** — issuance · storage · rotation · revocation rules.\n6. **Test plan** — cases to add (happy, CSRF, replay, revocation).\n\n## Anti-patterns\n\n- Rubber-stamp review — \"looks fine\" with no step-by-step walk.\n- Testing only the happy path — the attacker lives in the negative paths.\n- Ignoring token lifecycle — long-lived refresh tokens with no rotation are a classic breach fuel.\n- Missing redirect URI exact-match check — open redirect enables auth code theft.\n- No revocation plan — \"rotate secrets\" works until you need to kick a specific user.\n- Skipping IdP configuration audit — client-side hardening is wasted if the IdP is mis-set.\n\n## Handoff\n\nReturn the review doc path to the invoking `security` specialist. Fixes typically chain to the owning service specialist (backend \u002F mobile); new test cases chain to `qa-test-strategy`. If the flow needs redesign, escalate to `architect-systems-design`. This skill does not dispatch.\n","# security-auth-flow-review\n\nThe auth flow is the door; step through it like an attacker, not like a user.\n\n## What you do\n\nWalk the flow step by step, from client initiation to revocation, annotating each step with the secret material, the redirect, the state carried, and the failure path. Then threat-map it — misused redirects, token replay, fixation, scope escalation — and write remediations.\n\n- Reconstruct the flow diagram end-to-end: client → IdP → callback → session → refresh → logout → revocation.\n- Check redirect URI allowlists, state \u002F PKCE, nonce, ID token validation, audience \u002F issuer.\n- Validate session storage (HttpOnly, Secure, SameSite, idle \u002F absolute timeout, rotation on privilege change).\n- Inspect token lifecycle: access \u002F refresh TTL, rotation, revocation server-side, clock skew tolerance.\n- Cover the negative paths: stolen refresh token, leaked authorization code, CSRF on login, logout on shared device.\n- Map each finding to a concrete fix (code or config), a severity, and an owner.\n\n## Output shape\n\nA markdown file `auth-review.md`:\n\n1. **Flow diagram** — step-by-step with data flowing.\n2. **Components** — IdP, authz server, resource server, client, session store.\n3. **Threat map** — per step: threat · control · status · finding.\n4. **Findings** — severity · description · repro · fix · owner.\n5. **Token lifecycle** — issuance · storage · rotation · revocation rules.\n6. **Test plan** — cases to add (happy, CSRF, replay, revocation).\n\n## Anti-patterns\n\n- Rubber-stamp review — \"looks fine\" with no step-by-step walk.\n- Testing only the happy path — the attacker lives in the negative paths.\n- Ignoring token lifecycle — long-lived refresh tokens with no rotation are a classic breach fuel.\n- Missing redirect URI exact-match check — open redirect enables auth code theft.\n- No revocation plan — \"rotate secrets\" works until you need to kick a specific user.\n- Skipping IdP configuration audit — client-side hardening is wasted if the IdP is mis-set.\n\n## Handoff\n\nReturn the review doc path to the invoking `security` specialist. Fixes typically chain to the owning service specialist (backend \u002F mobile); new test cases chain to `qa-test-strategy`. If the flow needs redesign, escalate to `architect-systems-design`. This skill does not dispatch.\n",{},"main","2e58b0360ca51ca3c96ca8e015ef5aba5738803d","skills\u002Fspecialists\u002Fsecurity-auth-flow-review",0,"https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild","https:\u002F\u002Fgithub.com\u002Flookatitude","https:\u002F\u002Flookatitude.com","2026-11-06 03:55:18",{"source":7,"skillName":5,"commands":39,"prompt":49,"zipAvailable":50},[40,43,46],{"tool":41,"command":42},"npx","npx skills add lookatitude\u002Fguild --skill security-auth-flow-review",{"tool":44,"command":45},"bunx","bunx skills add lookatitude\u002Fguild --skill security-auth-flow-review",{"tool":47,"command":48},"pnpm","pnpm dlx skills add lookatitude\u002Fguild --skill security-auth-flow-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Fsecurity-auth-flow-review\u002FSKILL.md",true,[52],{"path":53,"resourceType":54,"resourceTypeDesc":55,"sizeBytes":56,"sourceHtmlUrl":57},"evals.json","REFERENCE","参考文档",655,"https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Fsecurity-auth-flow-review\u002Fevals.json",[59,71,81,101,119,130],{"skillNo":60,"name":61,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":25},"01M71GQQ1ZAND0XQBS4GTSWYFK","technical-writer-user-manual","https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Ftechnical-writer-user-manual\u002FSKILL.md",[],[65,66,67,68,69,70],"writer","technical","technical writer","technical writer user manual","manual","user",{"skillNo":72,"name":73,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":25},"01M71GQMQ71DQNH4A7REXRVFCB","technical-writer-release-notes","https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Ftechnical-writer-release-notes\u002FSKILL.md",[],[77,65,78,79,80,66,67],"release","notes","technical writer release notes","release notes",{"skillNo":82,"name":83,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":96,"publishedAt":25},"01M71GQJQT9G8QHE0A9SN01VE4","technical-writer-api-docs","https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Ftechnical-writer-api-docs\u002FSKILL.md",[86,91],{"categoryNo":87,"categoryName":88,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":92,"categoryName":93,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[97,66,67,98,99,100,65],"technical writer api docs","docs","api docs","api",{"skillNo":102,"name":103,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":112,"publishedAt":25},"01M71GQH3T5F23M2M298WXVAQ5","social-media-platform-post","https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Fsocial-media-platform-post\u002FSKILL.md",[106,109],{"categoryNo":107,"categoryName":108,"taxonomyType":89,"taxonomyTypeDesc":90},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":110,"categoryName":111,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000035","市场营销",[113,114,115,116,117,118],"social media platform post","post","Media","platform","social","social media",{"skillNo":120,"name":121,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":126,"publishedAt":25},"01M71GQFS4MJ4S8ZRK7KQNNPJE","social-media-engagement-templates","https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Fsocial-media-engagement-templates\u002FSKILL.md",[124,125],{"categoryNo":107,"categoryName":108,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":110,"categoryName":111,"taxonomyType":94,"taxonomyTypeDesc":95},[117,127,115,128,129,118],"engagement","social media engagement templates","templates",{"skillNo":131,"name":132,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":140,"publishedAt":25},"01M71GQEPZ5GX6NBFQ9H0W5E0C","social-media-content-calendar","https:\u002F\u002Fgithub.com\u002Flookatitude\u002Fguild\u002Fblob\u002Fmain\u002Fskills\u002Fspecialists\u002Fsocial-media-content-calendar\u002FSKILL.md",[135,136,137],{"categoryNo":107,"categoryName":108,"taxonomyType":89,"taxonomyTypeDesc":90},{"categoryNo":110,"categoryName":111,"taxonomyType":94,"taxonomyTypeDesc":95},{"categoryNo":138,"categoryName":139,"taxonomyType":94,"taxonomyTypeDesc":95},"01JBSEEDCAT000000000000036","内容创作者",[141,142,117,118,143,144,115],"calendar","content calendar","social media content calendar","content"]