New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security Review

by doorkeeper-gem in doorkeeper-gem/doorkeeper

Verify that code changes do not introduce OAuth security vulnerabilities.

MITAuto-check passedBackend & APIs

Install Security Review

skills CLI
$ npx skills add doorkeeper-gem/doorkeeper --skill security-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install doorkeeper-gem/doorkeeper security-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/doorkeeper-gem/doorkeeper.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.agents/skills/security-review .claude/skills/security-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-review
GitHub stars
5.5k
Token cost
~1.4k tokens
SKILL.md length
507 words
Files
1
Skills in repo
6
Repo updated
First seen
Licence
MIT

At a glance

Verify that code changes do not introduce OAuth security vulnerabilities.

  • Works in 3 steps: Run security-related specs: bundle exec… → Check if Brakeman would flag the change:… → Verify no token values appear in test…
  • Modifying token handling
  • SKILL.md covers Constant-Time Comparisons, Token Leakage Prevention, Redirect URI Validation (RFC… and Client Authentication (RFC…, plus 7 more sections
  • Calls bundle and gem

What it does

Security Review is an agent skill from doorkeeper-gem/doorkeeper. Verify that code changes do not introduce OAuth security vulnerabilities. Use when modifying token handling, client authentication, scope validation, redirect URI checks, secret comparison, or grant flows in Doorkeeper.

Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering OAuth and OpenID Connect, Security review and Authentication. The repository describes itself as: Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. The licence is MIT.

When your agent uses it

  • Modifying token handling
  • Client authentication
  • Scope validation
  • Redirect URI checks

Example prompts

  • “/security-review”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. Run security-related specs: bundle exec rspec spec/requests/flows/ spec/lib/oauth/
  2. Check if Brakeman would flag the change: gem install brakeman && brakeman --no-pager
  3. Verify no token values appear in test output or logs

What it can do on your machine

Read from SKILL.md and the folder at commit 80f4eba. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • bundle
    • gem

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Review loads about 1.4k tokens when it runs. Until then it costs about 59 tokens; SKILL.md has 507 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~59
When it runs · the whole SKILL.md, loaded when a task matches
~1.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from doorkeeper-gem/doorkeeper at commit 80f4eba, republished under its MIT licence (© doorkeeper-gem). 507 words, ~1,365 tokens.

Download SKILL.mdSave it as .claude/skills/security-review/SKILL.md (or your agent's skills folder).
name
security-review
description
Verify that code changes do not introduce OAuth security vulnerabilities. Use when modifying token handling, client authentication, scope validation, redirect URI checks, secret comparison, or grant flows in Doorkeeper.

Security Review

When implementing or reviewing changes to Doorkeeper, use this skill to verify that changes do not introduce security vulnerabilities. Doorkeeper is an OAuth 2 provider library — security is the primary constraint.

Constant-Time Comparisons

All comparisons of secrets MUST use ActiveSupport::SecurityUtils.secure_compare or equivalent, never ==:

  • Token values
  • Client secrets
  • PKCE code challenge verification
  • Refresh tokens
  • Any cryptographic digest comparison

Check: grep for == near variables named token, secret, code_challenge, refresh_token. If found, replace with secure_compare.

Reference: The codebase already uses secure_compare in lib/doorkeeper/secret_storing/base.rb. Follow that pattern.

Token Leakage Prevention

Tokens and secrets must never appear in:

  • Log output (Rails parameter filtering should exclude them)
  • Error response bodies (beyond what RFC 6749 requires)
  • URL query parameters for sensitive values (except where RFC requires, e.g., authorization codes)
  • Exception messages that might be captured by error reporters

Check: Doorkeeper registers Doorkeeper.setup_filter_parameters (in lib/doorkeeper.rb) which adds client_secret, authentication_token, access_token, and refresh_token to Rails.application.config.filter_parameters, plus code when the authorization_code grant flow is enabled. Verify any newly-introduced sensitive parameter is covered by that list.

Redirect URI Validation (RFC 6749 §3.1.2, RFC 8252 §7)

  • Redirect URIs must be compared using exact string matching
  • Exception: loopback redirects (127.0.0.1, [::1]) allow port variation per RFC 8252 §7.3
  • Fragment components (#) are forbidden
  • Relative URIs are forbidden
  • The urn:ietf:wg:oauth:2.0:oob redirect is special-cased

Reference: lib/doorkeeper/oauth/helpers/uri_checker.rb and lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

Client Authentication (RFC 6749 §2.3)

  • A client MUST NOT use more than one authentication method per request
  • The codebase enforces this via Doorkeeper::Request.validate_client_authentication! — ensure new auth methods participate in this check
  • Confidential clients must always authenticate; public clients use none
  • by_uid_and_secret must be the resolution path — don't bypass it

Reference: lib/doorkeeper/client_authentication/ and lib/doorkeeper/request.rb

Grant Code Single-Use (RFC 6749 §4.1.2)

  • Authorization codes MUST be single-use
  • If a code is presented twice, all tokens issued from that code must be revoked
  • Race conditions are handled via database locking (lock!)

Reference: lib/doorkeeper/oauth/authorization_code_request.rb — InvalidGrantReuse handling

Show full SKILL.md (202 more words)Show less

Scope Validation

  • Requested scopes must be a subset of configured server scopes
  • Per-application scopes further restrict what a client can request
  • scopes_by_grant_type can restrict scopes per flow
  • Dynamic scopes (if enabled) must still match the configured delimiter pattern

Reference: lib/doorkeeper/oauth/helpers/scope_checker.rb

PKCE (RFC 7636)

  • When force_pkce is true, code_challenge is mandatory
  • S256 is the recommended (and often required) challenge method
  • Code verifier comparison must use the correct transform (SHA256 + base64url for S256, plain for plain)
  • Note: the codebase currently uses == for PKCE comparison — this is a known issue

Input Validation

  • All user-supplied parameters must be validated before use
  • grant_type, response_type, response_mode must match registered values
  • Token endpoint enforces application/x-www-form-urlencoded content type (when enforce_content_type is enabled)
  • Multiple values for scope in the same request must be rejected at the authorization endpoint

Revocation (RFC 7009)

  • Token revocation should return 200 even for invalid tokens (to avoid information leakage)
  • Revoking a refresh token should also revoke associated access tokens
  • Client authentication is required for revocation (default behavior)

Patterns to Avoid

ruby
# BAD: String comparison on secrets
token == stored_token

# GOOD: Constant-time comparison
ActiveSupport::SecurityUtils.secure_compare(token, stored_token)

# BAD: Token in error message
raise "Invalid token: #{token}"

# GOOD: Generic error
raise Doorkeeper::Errors::InvalidToken

# BAD: Redirect URI with partial matching
uri.start_with?(registered_uri)

# GOOD: Exact match (already handled by URIChecker)
Doorkeeper::OAuth::Helpers::URIChecker.valid_for_authorization?(uri, registered_uris)

# BAD: Skipping client authentication
# Never bypass validate_client_authentication! for token-endpoint requests

# GOOD: All token requests go through client auth
# Request.client_authentication_method calls validate_client_authentication!(request) internally
Doorkeeper::Request.client_authentication_method(request)

After Making Changes

  1. Run security-related specs: bundle exec rspec spec/requests/flows/ spec/lib/oauth/
  2. Check if Brakeman would flag the change: gem install brakeman && brakeman --no-pager
  3. Verify no token values appear in test output or logs

© doorkeeper-gem, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .agents/skills/security-review of doorkeeper-gem/doorkeeper.

Open the folder on GitHubat commit 80f4eba

Compare with similar skills

Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Review this skilldoorkeeper-gem/doorkeeper5.5k—~1.4kAutomated safety check: PassMIT
Security PatternsCloudAI-X/claude-workflow-v21.4k—~3.6kAutomated safety check: NotesMIT
Clickup Security Basicsjeremylongshore/tons-of-skills-marketplace2.8k—~1kAutomated safety check: PassMIT
Better Auth Security Best PracticesEpicenterHQ/epicenter4.8k—~896Automated safety check: PassCustom licence
Cb Security HardeningBlkLeg/CircuitBreaker201—~2.1kAutomated safety check: PassMIT
OmniRoute Authenticationdiegosouzapw/OmniRoute74k—~1.8kAutomated safety check: PassMIT

Similar skills

  • Security Patterns

    CloudAI-X/claude-workflow-v2

    Implements authentication, authorization, encryption, secrets management, and security hardening patterns.

    1.4k GitHub stars~3.6k tokensUpdated 3 days ago
    Backend & APIsAuto-check: notes

  • Clickup Security Basics

    jeremylongshore/tons-of-skills-marketplace

    Harden ClickUp credentials, OAuth callbacks, Workspace boundaries, webhooks, logging, and incident response with least-privilege controls.

    2.8k GitHub stars~1k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Better Auth Security Best Practices

    EpicenterHQ/epicenter

    Better Auth security hardening: rate limits, secrets, CSRF, trusted origins, cookies, sessions, OAuth tokens, and audit logging.

    4.8k GitHub stars~896 tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Cb Security Hardening

    BlkLeg/CircuitBreaker

    Enforces Circuit Breaker security hardening conventions across backend, frontend, Docker, and nginx.

    201 GitHub stars~2.1k tokensUpdated 4 days ago
    Backend & APIsAuto-check passed

  • OmniRoute Authentication

    diegosouzapw/OmniRoute

    Documents how OmniRoute authenticates requests: Bearer credentials for the API, management-password login with session cookies, CSRF tokens and optional OIDC for the dashboard.

    74k GitHub stars~1.8k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Open Redirect Testing

    NeoTheCapt/RedteamAgent

    Test for unvalidated redirects — URL parameters, login flows, OAuth callbacks that redirect to attacker-controlled domains

    142 GitHub stars~608 tokensUpdated 2 mo ago
    Backend & APIsAuto-check passed

More from doorkeeper-gem/doorkeeper

  • Antipattern Prevention

    doorkeeper-gem/doorkeeper

    Avoid common Ruby and Rails antipatterns that degrade maintainability and performance.

    5.5k GitHub stars~1.1k tokensUpdated 2 days ago
    Auto-check passed

  • Code Quality

    doorkeeper-gem/doorkeeper

    Maintain code health and architecture standards when implementing features or refactoring Doorkeeper.

    5.5k GitHub stars~1.2k tokensUpdated 2 days ago
    Auto-check passed

  • Dependency Safety

    doorkeeper-gem/doorkeeper

    Ensure gems are safe, necessary, and properly constrained when adding, updating, or reviewing dependencies in Doorkeeper.

    5.5k GitHub stars~931 tokensUpdated 2 days ago
    Auto-check passed

  • Testing

    doorkeeper-gem/doorkeeper

    Write correct and complete RSpec tests for Doorkeeper. An agent skill from doorkeeper-gem/doorkeeper.

    5.5k GitHub stars~1.6k tokensUpdated 2 days ago
    Auto-check passed

  • Rfc Compliance

    doorkeeper-gem/doorkeeper

    Verify OAuth protocol implementations stay aligned with relevant RFCs.

    5.5k GitHub stars~1.7k tokensUpdated 2 days ago
    Auto-check passed

Categories

Questions about Security Review

What does Security Review do?

Verify that code changes do not introduce OAuth security vulnerabilities. Security Review is an agent skill from doorkeeper-gem/doorkeeper. Verify that code changes do not introduce OAuth security vulnerabilities.

When should I use Security Review?

Security Review fits situations like: modifying token handling; client authentication; scope validation; redirect URI checks.

How do I install Security Review in Claude Code?

Run `npx skills add doorkeeper-gem/doorkeeper --skill security-review -a claude-code`. Or copy the skill folder (.agents/skills/security-review in doorkeeper-gem/doorkeeper) into .claude/skills/security-review in your project. Claude Code loads it when a task matches its description.

How do I install Security Review in Codex?

Run `npx skills add doorkeeper-gem/doorkeeper --skill security-review -a codex`. Or copy the skill folder (.agents/skills/security-review in doorkeeper-gem/doorkeeper) into .agents/skills/security-review in your project. Codex loads it when a task matches its description.

Can I use Security Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add doorkeeper-gem/doorkeeper --skill security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-review, .gemini/skills/security-review, .github/skills/security-review and .opencode/skills/security-review in your project.

What does Security Review need to run?

Going by SKILL.md and its folder, Security Review needs the command-line tools its instructions call (bundle and gem).

Does Security Review access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Security Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security Review use?

Security Review is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Review use?

About 1.4k tokens (SKILL.md is roughly 5.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Review?

Skills that share tags, products or a category with Security Review: Security Patterns (CloudAI-X/claude-workflow-v2, 1.4k stars), Clickup Security Basics (jeremylongshore/tons-of-skills-marketplace, 2.8k stars), Better Auth Security Best Practices (EpicenterHQ/epicenter, 4.8k stars) and Cb Security Hardening (BlkLeg/CircuitBreaker, 201 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Review?

doorkeeper-gem (a GitHub organization) maintains it in doorkeeper-gem/doorkeeper, which has 5,523 GitHub stars. The repository holds 6 skills in this directory. The repository was last updated on October 7, 2026.

Source: doorkeeper-gem/doorkeeper on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.