auditing-device-code-and-pkce-flows SKILL.md skillA
auditing-device-code-and-pkce-flows from unboundcompute/security-agent-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add unboundcompute/security-agent-skills/auditing-device-code-and-pkce-flows@git:20260821.57dfaf1Pins git:20260821.57dfaf1 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- unboundcompute/security-agent-skills
- Path
skills/auditing-device-code-and-pkce-flows/SKILL.md- Versions recorded
- 1
- Latest version
- git:20260821.57dfaf1, committed Aug 21, 2026
- Size
- 9,855 bytes
- Repository stars
- 26
- License
- MIT
Audit the server side of the authorization-code-with-proof-key and device-authorization grants for bugs that let a stolen or guessed code become a token. Covers a token endpoint that issues without checking the proof-key verifier at all, that accepts the plain challenge method or a challenge-absent downgrade, or that binds the verifier to the client rather than to the specific code; and a device grant whose short user code is brute-forceable because polling is unthrottled, whose device code is…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Auditing proof-key and device-code grants: when a code becomes a token without proof The proof-key exchange and the device-authorization grant both exist to close one gap: a authorization code, on its own, can be intercepted, and a short user code can be guessed. Each grant adds a proof that binds the token request to the party that actually started the flow, a verifier that only the real client knows, or a device code that only the real device holds. The server side is where that proof is enforced, and where it is quietly not. When the token endpoint issues without checking the verifier, honors a downgraded challenge, or hands tokens for a device code it never bound to a client, an intercepted or guessed code becomes a live token. You find these by reading the issuance path and asking what proof it demands before it mints a token. ## When to use - The code implements or wraps a token endpoint that redeems an authorization code, or a device-authorization grant. - A public client (one that cannot hold a secret) relies on the proof key as its protection against code interception. …
Read the whole file at its exact version.
How to install
mdr add unboundcompute/security-agent-skills/auditing-device-code-and-pkce-flows@sha256:9d259c45f1194c7aThe line at the top of this page pins the label git:20260821.57dfaf1, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_jrgbp252weslvedz)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Aug 21, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (9855 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
unboundcompute/security-agent-skills · 26 stars · license MIT · pushed 2026-09-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_jrgbp252weslvedz GET https://markdownregistry.com/api/v1/resolve?ref=unboundcompute/security-agent-skills/auditing-device-code-and-pkce-flows GET https://markdownregistry.com/api/v1/blob/9d259c45f1194c7ae16b812154e2f12966e492dff2fae4d554d43ef67a47f02d
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.