New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Browser Auth Flow

by ruvnet in ruvnet/ruflo

Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md

MITAuto-check: notesBackend & APIs

Install Browser Auth Flow

skills CLI
$ npx skills add ruvnet/ruflo --skill browser-auth-flow -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ruvnet/ruflo browser-auth-flow --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ruvnet/ruflo.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ruflo-browser/skills/browser-auth-flow .claude/skills/browser-auth-flow && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
browser-auth-flow
GitHub stars
74k
Token cost
~805 tokens
SKILL.md length
342 words
Files
1
Skills in repo
264
Repo updated
First seen
Licence
MIT

At a glance

Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md

  • Works in 6 steps: Open a recorded session via… → Drive the auth flow as in browser-login… → Run probes → …
  • Tasks that involve Authentication
  • SKILL.md covers When to use, Steps and Caveats
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Browser Auth Flow is an agent skill from ruvnet/ruflo. Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md

Its SKILL.md is about 810 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering Authentication, Web application vulnerabilities and OAuth and OpenID Connect. The repository describes itself as: 🌊 The original agent harness. Deploy intelligent multi-player swarms, coordinate autonomous workflows, and build conversational AI systems. Features adaptive memory…. The licence is MIT.

When your agent uses it

  • Tasks that involve Authentication
  • Tasks that involve Web application vulnerabilities
  • Tasks that involve OAuth and OpenID Connect

Example prompts

  • “/browser-auth-flow”

Requirements

  • Pre-approved tools (allowed-tools): mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin_ruflo-core_ruflo__browser_fill, mcp__plugin_ruflo-core_ruflo__browser_type, mcp__plugin_ruflo-core_ruflo__browser_click, mcp__plugin_ruflo-core_ruflo__browser_wait, mcp__plugin_ruflo-core_ruflo__browser_eval, mcp__plugin_ruflo-core_ruflo__browser_snapshot, mcp__plugin_ruflo-core_ruflo__browser_get-url, mcp__plugin_ruflo-core_ruflo__aidefence_has_pii, mcp__plugin_ruflo-core_ruflo__aidefence_scan, Bash, Read, Write

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

  1. Open a recorded session via browser-record.
  2. Drive the auth flow as in browser-login (credentials come from --credentials referencing browser-cookies if the run is a re-auth probe).
  3. Run probes
  4. Quarantine any token / credential / PII captured during probing — it stays inside the RVF container's findings, never returns to the model…
  5. Write findings.md with one section per probe, severity rating per finding, and a verdict (pass / warn / fail).
  6. Index the session in browser-sessions with tag: auth-probe so future audits compare against it.

What it can do on your machine

Read from SKILL.md and the folder at commit de590e1. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • mcp__plugin_ruflo-core_ruflo__browser_open
    • mcp__plugin_ruflo-core_ruflo__browser_close
    • mcp__plugin_ruflo-core_ruflo__browser_fill
    • mcp__plugin_ruflo-core_ruflo__browser_type
    • mcp__plugin_ruflo-core_ruflo__browser_click
    • mcp__plugin_ruflo-core_ruflo__browser_wait
    • mcp__plugin_ruflo-core_ruflo__browser_eval
    • mcp__plugin_ruflo-core_ruflo__browser_snapshot
    • mcp__plugin_ruflo-core_ruflo__browser_get-url
    • mcp__plugin_ruflo-core_ruflo__aidefence_has_pii

    …and 4 more on the same allowed-tools line.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Browser Auth Flow loads about 805 tokens when it runs. Until then it costs about 41 tokens; SKILL.md has 342 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~41
When it runs · the whole SKILL.md, loaded when a task matches
~805

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ruvnet/ruflo at commit de590e1, republished under its MIT licence (© ruvnet). 342 words, ~805 tokens.

Download SKILL.mdSave it as .claude/skills/browser-auth-flow/SKILL.md (or your agent's skills folder).
name
browser-auth-flow
description
Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md
allowed-tools
mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin_ruflo-core_ruflo__browser_fill, mcp__plugin_ruflo-core_ruflo__browser_type, mcp__plugin_ruflo-core_ruflo__browser_click, mcp__plugin_ruflo-core_ruflo__browser_wait, mcp__plugin_ruflo-core_ruflo__browser_eval, mcp__plugin_ruflo-core_ruflo__browser_snapshot, mcp__plugin_ruflo-core_ruflo__browser_get-url, mcp__plugin_ruflo-core_ruflo__aidefence_has_pii, mcp__plugin_ruflo-core_ruflo__aidefence_scan, Bash, Read, Write
argument-hint
<login-url> [--credentials <handle>] [--probes csrf,redirect,cookie,oauth]

Browser Auth Flow

Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured findings.md inside the RVF container.

When to use

  • Pre-deployment audit of a new auth flow.
  • Investigating a suspected token leak or redirect issue.
  • Establishing a baseline for ongoing regression checks.

Steps

  1. Open a recorded session via browser-record.

  2. Drive the auth flow as in browser-login (credentials come from --credentials <handle> referencing browser-cookies if the run is a re-auth probe).

  3. Run probes:

    • csrf: inspect the login POST in the trajectory; verify a same-origin token field is present and non-empty.
    • redirect: watch browser_get-url after each nav for cross-origin redirects with auth state in the URL or fragment. Flag any token-bearing URL that crosses an origin boundary.
    • cookie: walk document.cookie via browser_eval. For each cookie, check Secure, HttpOnly, SameSite, expiry, and entropy of the value. Flag missing flags or short tokens. Pass each through aidefence_scan to flag PII embedded in cookie values.
    • oauth: if the flow involves a third-party provider, capture the authorization request, verify state and nonce are present and high-entropy, verify redirect_uri matches the registered callback domain.

  4. Quarantine any token / credential / PII captured during probing — it stays inside the RVF container's findings, never returns to the model unredacted (aidefence_is_safe gate from browser-extract applies if you read the findings back).

  5. Write findings.md with one section per probe, severity rating per finding, and a verdict (pass / warn / fail).

  6. Index the session in browser-sessions with tag: auth-probe so future audits compare against it.

Caveats

  • This skill probes; it does not exploit. Do not chain follow-up requests using a captured token.
  • Credentials must come from a vaulted handle or interactive entry. Never hardcode them in the field map.
  • Some probes require multiple page loads. Trajectory step count for an auth probe typically lands at 15–40 steps; budget accordingly.
  • The output is structured for human review. Do not auto-act on findings without surfacing them to the user first.

© ruvnet, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in plugins/ruflo-browser/skills/browser-auth-flow of ruvnet/ruflo.

Open the folder on GitHubat commit de590e1

Compare with similar skills

Browser Auth Flow next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Browser Auth Flow compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Browser Auth Flow this skillruvnet/ruflo74k—~805Automated safety check: NotesMIT
Supercheck Security Authsupercheck-io/supercheck215—~1.2kAutomated safety check: PassAGPL-3.0
Frappe Errors APIImpertio-Studio/Frappe_Claude_Skill_Package1871 repos~4kAutomated safety check: PassMIT
Hunt Atoelementalsouls/Claude-BugHunter4.8k—~3.4kAutomated safety check: PassMIT
Quarkus Securityaffaan-m/ECC274k—~2.6kAutomated safety check: PassMIT
Quarkus Securityaffaan-m/ECC274k—~2.8kAutomated safety check: PassMIT

Similar skills

  • Supercheck Security Auth

    supercheck-io/supercheck

    Work on Supercheck authentication, RBAC, tenant isolation, sessions, API and trigger keys, invitations, project membership, project variables, OAuth, super-admin behavior, SSRF, or…

    215 GitHub stars~1.2k tokensUpdated today
    Backend & APIsAuto-check passed

  • Frappe Errors API

    Impertio-Studio/Frappe_Claude_Skill_Package

    A skill your agent uses when debugging or handling API errors in Frappe/ERPNext v14/v15/v16.

    187 GitHub starsUsed in 1 repo~4k tokens
    Backend & APIsAuto-check passed

  • Hunt Ato

    elementalsouls/Claude-BugHunter

    Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains.

    4.8k GitHub stars~3.4k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Quarkus Security

    affaan-m/ECC

    Buenas prácticas de seguridad en Quarkus para autenticación, autorización, JWT/OIDC, RBAC, validación de entrada, CSRF, gestión de secretos y seguridad de dependencias.

    274k GitHub stars~2.6k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed

  • Quarkus Security

    affaan-m/ECC

    Quarkus認証、認可、JWT/OIDC、RBAC、入力検証、CSRF、シークレット管理、依存関係セキュリティのセキュリティベストプラクティス。

    274k GitHub stars~2.8k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed

  • Quarkus Security

    affaan-m/ECC

    Quarkus Security best practices for authentication, authorization, JWT/OIDC, RBAC, input validation, CSRF, secrets management, and dependency security.

    274k GitHub stars~3.1k tokensUpdated 2 days ago
    Backend & APIsAuto-check passed

More from ruvnet/ruflo

All 264 skills in this repo

  • AgentDB Pattern Memory

    ruvnet/ruflo

    Stores, searches, and retrieves successful patterns with HNSW-indexed semantic search so agents can reuse past solutions instead of relearning them.

    74k GitHub starsUsed in 2 repos~830 tokens
    Auto-check passed

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    Auto-check passed

  • SPARC Development Methodology

    ruvnet/ruflo

    Applies the SPARC method (specification, pseudocode, architecture, refinement, completion) with 17 specialized modes and multi-agent orchestration, from research to deployment.

    74k GitHub starsUsed in 2 repos~829 tokens
    Auto-check passed

  • Swarm Orchestration

    ruvnet/ruflo

    Coordinates a hierarchical swarm of specialized agents through the claude-flow CLI for work that spans several files or modules at once.

    74k GitHub starsUsed in 2 repos~779 tokens
    Auto-check passed

  • Ruflo Multi-Agent Orchestration

    ruvnet/ruflo

    Sets up and drives Ruflo, an npm-installed orchestration layer for multi-agent swarms, persistent memory, routing, hooks and its MCP tool catalog.

    74k GitHub starsUsed in 1 repo~975 tokens
    Auto-check passed

  • Agent Coordination

    ruvnet/ruflo

    Reference for spawning, listing, monitoring and stopping agents with claude-flow commands, with agent type families, routing codes and coordination tips.

    74k GitHub starsUsed in 2 repos~519 tokens
    Auto-check passed

Categories

Questions about Browser Auth Flow

What does Browser Auth Flow do?

Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md. Browser Auth Flow is an agent skill from ruvnet/ruflo.

When should I use Browser Auth Flow?

Browser Auth Flow fits situations like: tasks that involve Authentication; tasks that involve Web application vulnerabilities; tasks that involve OAuth and OpenID Connect.

How do I install Browser Auth Flow in Claude Code?

Run `npx skills add ruvnet/ruflo --skill browser-auth-flow -a claude-code`. Or copy the skill folder (plugins/ruflo-browser/skills/browser-auth-flow in ruvnet/ruflo) into .claude/skills/browser-auth-flow in your project. Claude Code loads it when a task matches its description.

How do I install Browser Auth Flow in Codex?

Run `npx skills add ruvnet/ruflo --skill browser-auth-flow -a codex`. Or copy the skill folder (plugins/ruflo-browser/skills/browser-auth-flow in ruvnet/ruflo) into .agents/skills/browser-auth-flow in your project. Codex loads it when a task matches its description.

Can I use Browser Auth Flow in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ruvnet/ruflo --skill browser-auth-flow -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/browser-auth-flow, .gemini/skills/browser-auth-flow, .github/skills/browser-auth-flow and .opencode/skills/browser-auth-flow in your project.

What does Browser Auth Flow need to run?

SKILL.md names no scripts, command-line tools or credentials: Browser Auth Flow is instructions for the agent only. Its frontmatter pre-approves these tools: mcp__plugin_ruflo-core_ruflo__browser_open, mcp__plugin_ruflo-core_ruflo__browser_close, mcp__plugin_ruflo-core_ruflo__browser_fill, mcp__plugin_ruflo-core_ruflo__browser_type, mcp__plugin_ruflo-core_ruflo__browser_click, mcp__plugin_ruflo-core_ruflo__browser_wait, mcp__plugin_ruflo-core_ruflo__browser_eval, mcp__plugin_ruflo-core_ruflo__browser_snapshot, mcp__plugin_ruflo-core_ruflo__browser_get-url, mcp__plugin_ruflo-core_ruflo__aidefence_has_pii, mcp__plugin_ruflo-core_ruflo__aidefence_scan, Bash, Read, Write.

Does Browser Auth Flow access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Browser Auth Flow safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Browser Auth Flow use?

Browser Auth Flow is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Browser Auth Flow use?

About 805 tokens (SKILL.md is roughly 3.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Browser Auth Flow?

Skills that share tags, products or a category with Browser Auth Flow: Supercheck Security Auth (supercheck-io/supercheck, 215 stars), Frappe Errors API (Impertio-Studio/Frappe_Claude_Skill_Package, 187 stars), Hunt Ato (elementalsouls/Claude-BugHunter, 4.8k stars) and Quarkus Security (affaan-m/ECC, 274k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Browser Auth Flow?

ruvnet (a GitHub user) maintains it in ruvnet/ruflo, which has 74,012 GitHub stars. The repository holds 264 skills in this directory. The repository was last updated on October 7, 2026.

Source: ruvnet/ruflo on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.