New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Authenticated Session Acquisition

by transilienceai in transilienceai/communitytools

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface.

MITAuto-check passedSecurity

Install Authenticated Session Acquisition

skills CLI
$ npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install transilienceai/communitytools authenticated-session-acquisition --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/transilienceai/communitytools.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/authenticated-session-acquisition .claude/skills/authenticated-session-acquisition && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
authenticated-session-acquisition
GitHub stars
562
Token cost
~1.4k tokens
SKILL.md length
623 words
Files
2
Skills in repo
35
Repo updated
First seen
Licence
MIT

At a glance

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface.

  • Works in 3 steps: File a client-input request at… → Set a realm-level BLOCKED_REASON in… → Mark that realm's post-auth coverage…
  • Tasks that involve Web application vulnerabilities
  • SKILL.md covers The artifact contract (how the…, Modes (pick by what the client…, Provider recipes and When a session cannot be…, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Authenticated Session Acquisition is an agent skill from transilienceai/communitytools. Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication skill (which ATTACKS auth); this one legitimately authenticates and hands the session to the rest of the engagement.

Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `reference/session-acquisition.md`).

It sits in Security, covering Web application vulnerabilities, Threat modeling and Browser testing. It works with Playwright. The repository describes itself as: Open-source Claude Code skills, agents, and slash commands for AI-powered penetration testing, bug bounty hunting, and security research. The licence is MIT.

When your agent uses it

  • Tasks that involve Web application vulnerabilities
  • Tasks that involve Threat modeling
  • Tasks that involve Browser testing

Example prompts

  • “/authenticated-session-acquisition”

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

  1. File a client-input request at reports/client-input-requests/CIR-NNN.md naming exactly what's needed ("needs test account / OTP seed /…
  2. Set a realm-level BLOCKED_REASON in attack-chain.md.
  3. Mark that realm's post-auth coverage cells status:"deferred" in coverage.json, each carrying deferral_reason + client_input_request (the…

What it can do on your machine

Read from SKILL.md and the folder at commit 95fdc12. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Authenticated Session Acquisition loads about 1.4k tokens when it runs. Until then it costs about 137 tokens; SKILL.md has 623 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~137
When it runs · the whole SKILL.md, loaded when a task matches
~1.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from transilienceai/communitytools at commit 95fdc12, republished under its MIT licence (© transilienceai). 623 words, ~1,435 tokens.

Download SKILL.mdSave it as .claude/skills/authenticated-session-acquisition/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
authenticated-session-acquisition
description
Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication skill (which ATTACKS auth); this one legitimately authenticates and hands the session to the rest of the engagement.

Authenticated Session Acquisition

On financial and multi-tenant targets the login is gated by SMS OTP / TOTP MFA that an autonomous run cannot satisfy, so the post-auth surface (BOLA/IDOR/mass-assignment/injection on the real data APIs, session handling, API pivots) silently collapses to pre-auth findings only. This skill's job is narrow and concrete: get one legitimate authenticated session and hand it to the executors as a reusable artifact. It does not attack the auth mechanism — see authentication for that.

The artifact contract (how the session reaches executors)

Emit both, into the engagement's OUTPUT_DIR, referenced BY NAME (never inline secrets — credential-loading.md):

  • OUTPUT_DIR/<asset>/session/storageState.json — the Playwright storage state (cookies + localStorage) for browser-driven post-auth testing.
  • OUTPUT_DIR/<asset>/session/bearer.txt — the raw access/ID token (+ its expires_at) for direct API replay.

Executors consume these exactly like any env-loaded secret: the scope file's creds_env names the realm, and the session path is passed as a file reference, so no token is ever written into a prompt, experiments.md, or attack-chain.md. Re-run this skill when the token expires (record expires_at; refresh rather than re-login where a refresh token exists).

Modes (pick by what the client can provide)

ModeWhenHow
TOTP-from-seedThe client shared the TOTP secret (Base32 seed) for a test accountGenerate the current code deterministically with tools/totp_now.py <BASE32_SEED>, submit it in the login flow. Fully autonomous, repeatable.
Explicit-OTPThe operator can read a one-time code (SMS/email/authenticator) at run timeDrive login to the OTP prompt, the operator supplies the code once, continue.
Human-in-the-loop resumeOTP arrives out-of-band and the run must pausePersist the pre-OTP browser context, pause; the operator completes the challenge; resume and capture storageState.

Provider recipes

Detailed per-IdP flows are in reference/session-acquisition.md: Auth0, Okta, Amazon Cognito (SRP auth + the UNSIGNED unauthenticated-posture check), and Descope. Each recipe ends by exporting storageState.json + bearer.txt in the contract above.

Show full SKILL.md (327 more words)Show less

When a session cannot be acquired — defer honestly, do not fake

If no test account / OTP seed is available and no OTP can be relayed, the realm's post-auth surface is untestable through no fault of the tester. Record it honestly instead of a fabricated NA or a silent miss:

  1. File a client-input request at reports/client-input-requests/CIR-NNN.md naming exactly what's needed ("needs test account / OTP seed / allowlist for <realm>").
  2. Set a realm-level BLOCKED_REASON in attack-chain.md.
  3. Mark that realm's post-auth coverage cells status:"deferred" in coverage.json, each carrying deferral_reason + client_input_request (the CIR path) — see coverage-matrix.md. The deterministic gate then discloses the deferred surface in the report rather than hiding it, and only the parent orchestrator (via coverage_gate.py --accept-deferrals) may finalize a substantiated-deferred engagement. A scope that is entirely auth-gated never completes.

The preflight cred-reach probe (preflight-checklist.md, Phase-1 gate) is what triggers this path: present creds are not working creds; verify reachability per realm before spawning post-auth executors.

Workflow

  1. Read the scope: which realms/tenants are in creds_env, which assets are behind them, roe.reversible_writes for the test tenant.
  2. Identify the IdP (login redirect host / /.well-known/openid-configuration / SDK bundle) → pick the recipe.
  3. Acquire the session in the appropriate mode → write storageState.json + bearer.txt.
  4. Verify: one minimal authenticated request returns an authorized response (not 401/403/login-redirect).
  5. Hand the artifact paths to the post-auth executor batch; on failure, run the defer path above.

Anti-Patterns

  • Do not paste tokens, seeds, or cookies into prompts, experiments.md, attack-chain.md, or any tools/*.md — reference the artifact file by path only.
  • Do not brute-force or bypass the OTP/MFA challenge here — that is an authentication finding, not session acquisition.
  • Do not mark an MFA-blocked cell covered/NA — mark it deferred with a filed CIR so the gate discloses it.
  • Do not test outside the authenticated tenant you were given, and honor roe.reversible_writes (create-then-delete only in your own test tenant).

Reference

© transilienceai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/authenticated-session-acquisition of transilienceai/communitytools.

  • SKILL.md
  • reference/session-acquisition.md

Open the folder on GitHubat commit 95fdc12

Compare with similar skills

Authenticated Session Acquisition next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Authenticated Session Acquisition compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Authenticated Session Acquisition this skilltransilienceai/communitytools562—~1.4kAutomated safety check: PassMIT
Xrk Crawlxrkseek/XRK-AGT140—~1.3kAutomated safety check: PassMIT
Playwright Skilllackeyjb/playwright-skill3.2k—~1.9kAutomated safety check: PassMIT
Playwright Coretestdino-hq/playwright-skill3901 repos~1.4kAutomated safety check: PassMIT
Website LoginLakr233/Cookey160—~3.7kAutomated safety check: PassMIT
Playwright Login Flowsandrewyng/context-hub14k—~715Automated safety check: PassMIT

Similar skills

  • Xrk Crawl

    xrkseek/XRK-AGT

    当你需要开发/排查 HTTP 抓取、SSRF、Playwright 受控浏览器、本地字体增强截图，或判断 webfetch 与 browser 工作流如何选型时使用。

    140 GitHub stars~1.3k tokensUpdated 8 days ago
    SecurityAuto-check passed

  • Playwright Skill

    lackeyjb/playwright-skill

    Complete browser automation with Playwright. An agent skill from lackeyjb/playwright-skill.

    3.2k GitHub stars~1.9k tokensUpdated 8 days ago
    Testing & QAAuto-check passed

  • Playwright Core

    testdino-hq/playwright-skill

    Battle-tested Playwright patterns for writing and debugging reliable E2E, API, component, visual, accessibility, and security tests.

    390 GitHub starsUsed in 1 repo~1.4k tokens
    Testing & QAAuto-check passed

  • Website Login

    Lakr233/Cookey

    A skill your agent uses whenever the user needs to log in to a website on their phone and reuse that authenticated session locally, especially for Playwright storageState JSON, cookies/localStorage…

    160 GitHub stars~3.7k tokensUpdated 4 mo ago
    Testing & QAAuto-check passed

  • Playwright Login Flows

    andrewyng/context-hub

    Collects reusable Playwright patterns for logging in during end-to-end tests: password forms, OAuth redirects, saved browser state and TOTP two-factor codes.

    14k GitHub stars~715 tokensUpdated 4 mo ago
    Testing & QAAuto-check passed

  • Open Browser

    JasonHonKL/Openbrowser

    A skill your agent uses whenever the task involves browsing web pages, extracting page content, clicking forms, or completing web workflows.

    114 GitHub stars~1.6k tokensUpdated 5 mo ago
    Testing & QAAuto-check passed

More from transilienceai/communitytools

All 35 skills in this repo

  • Dfir

    transilienceai/communitytools

    Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation.

    562 GitHub stars~1.5k tokensUpdated 2 mo ago
    Auto-check passed

  • GitHub Workflow

    transilienceai/communitytools

    GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review.

    562 GitHub stars~812 tokensUpdated 2 mo ago
    Auto-check: notes

  • Pci Secure Software

    transilienceai/communitytools

    Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation.

    562 GitHub stars~1.8k tokensUpdated 2 mo ago
    Auto-check passed

  • Protect With Password

    transilienceai/communitytools

    Generate ONE strong password and apply it to each referenced file (PDF, Word, Excel, PowerPoint, or any type).

    562 GitHub stars~583 tokensUpdated 2 mo ago
    Auto-check passed

  • Skill Update

    transilienceai/communitytools

    Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits.

    562 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check passed

  • Source Code Scanning

    transilienceai/communitytools

    Security-focused source code review and SAST. An agent skill from transilienceai/communitytools.

    562 GitHub stars~1.2k tokensUpdated 2 mo ago
    Auto-check: notes

Works with

Categories

Questions about Authenticated Session Acquisition

What does Authenticated Session Acquisition do?

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Authenticated Session Acquisition is an agent skill from transilienceai/communitytools. Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface.

When should I use Authenticated Session Acquisition?

Authenticated Session Acquisition fits situations like: tasks that involve Web application vulnerabilities; tasks that involve Threat modeling; tasks that involve Browser testing.

How do I install Authenticated Session Acquisition in Claude Code?

Run `npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -a claude-code`. Or copy the skill folder (skills/authenticated-session-acquisition in transilienceai/communitytools) into .claude/skills/authenticated-session-acquisition in your project. Claude Code loads it when a task matches its description.

How do I install Authenticated Session Acquisition in Codex?

Run `npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -a codex`. Or copy the skill folder (skills/authenticated-session-acquisition in transilienceai/communitytools) into .agents/skills/authenticated-session-acquisition in your project. Codex loads it when a task matches its description.

Can I use Authenticated Session Acquisition in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add transilienceai/communitytools --skill authenticated-session-acquisition -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/authenticated-session-acquisition, .gemini/skills/authenticated-session-acquisition, .github/skills/authenticated-session-acquisition and .opencode/skills/authenticated-session-acquisition in your project.

What does Authenticated Session Acquisition need to run?

SKILL.md names no scripts, command-line tools or credentials: Authenticated Session Acquisition is instructions for the agent only.

Does Authenticated Session Acquisition access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Authenticated Session Acquisition safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Authenticated Session Acquisition use?

Authenticated Session Acquisition is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Authenticated Session Acquisition use?

About 1.4k tokens (SKILL.md is roughly 5.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Authenticated Session Acquisition?

Skills that share tags, products or a category with Authenticated Session Acquisition: Xrk Crawl (xrkseek/XRK-AGT, 140 stars), Playwright Skill (lackeyjb/playwright-skill, 3.2k stars), Playwright Core (testdino-hq/playwright-skill, 390 stars) and Website Login (Lakr233/Cookey, 160 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Authenticated Session Acquisition?

transilienceai (a GitHub organization) maintains it in transilienceai/communitytools, which has 562 GitHub stars. The repository holds 35 skills in this directory. The repository was last updated on July 29, 2026.

Source: transilienceai/communitytools on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.