auth-audit · diff
git:20260705.ba8ee52 to git:20260729.3b91eed
14 added, 1 removed. Audit A to A.
---
name: auth-audit
- description: "Audit authentication and authorization patterns. Checks JWT, sessions, OAuth2, PKCE implementations for security best practices and common vulnerabilities. Use when: auditing JWT, session, OAuth2/PKCE, password, or MFA implementations for security vulnerabilities."
+ description: "Use when auditing JWT, session, OAuth2/PKCE, password, or MFA implementations for security vulnerabilities and best-practice deviations."
argument-hint: "[--jwt] [--session] [--oauth]"
user-invocable: true
---
+
+ <objective>
+ This skill audits authentication and authorization implementations end to end: JWT signing
+ algorithm, expiration, refresh, and storage; session storage, expiry, regeneration, and
+ fixation; OAuth2 PKCE, state parameter, and redirect validation; password hashing algorithm,
+ strength rules, and reset flow; and MFA implementation, backup codes, and recovery.
+
+ It runs a fixed workflow — detect the auth implementation, scan for known anti-patterns,
+ verify cryptographic choices, check token/session lifecycle, and audit authorization logic
+ (RBAC/ABAC) — checking for vulnerabilities such as JWT signed with `none`, undersized JWT
+ secrets, missing/too-long token expiration, refresh tokens in localStorage, session fixation,
+ missing CSRF protection, and OAuth flows missing PKCE or the `state` parameter.
+ </objective>
# Auth Audit Skill
## Overview
Comprehensive audit of authentication and authorization implementations.
## Audit Categories
| Category | Checks |
|----------|--------|
| JWT | Signing algo, expiration, refresh, storage |
| Sessions | Storage, expiry, regeneration, fixation |
| OAuth2 | PKCE, state param, redirect validation |
| Passwords | Hashing algo, strength rules, reset flow |
| MFA | Implementation, backup codes, recovery |
## Workflow
1. **Detect** auth implementation (JWT, sessions, OAuth)
2. **Scan** for known anti-patterns
3. **Verify** cryptographic choices
4. **Check** token/session lifecycle
5. **Audit** authorization logic (RBAC, ABAC)
## Common Vulnerabilities
- JWT signed with `none` algorithm
- JWT secret too short (< 256 bits)
- No token expiration or too long
- Refresh tokens stored in localStorage
- Session fixation after login
- Missing CSRF protection
- OAuth without PKCE for public clients
- Missing `state` parameter in OAuth flow
## References
- [Auth Patterns](references/auth-patterns.md)
- [Auth Checklist](references/templates/auth-checklist.md)