New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

OAuth Oidc Misconfiguration

by yaklang in yaklang/hack-skills

OAuth and OIDC misconfiguration testing playbook. An agent skill from yaklang/hack-skills.

MITAuto-check passedBackend & APIs

Install OAuth Oidc Misconfiguration

skills CLI
$ npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install yaklang/hack-skills oauth-oidc-misconfiguration --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/yaklang/hack-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/oauth-oidc-misconfiguration .claude/skills/oauth-oidc-misconfiguration && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
oauth-oidc-misconfiguration
GitHub stars
2.4k
Token cost
~580 tokens
SKILL.md length
261 words
Files
1
Skills in repo
27
Repo updated
First seen
Licence
MIT

At a glance

OAuth and OIDC misconfiguration testing playbook. An agent skill from yaklang/hack-skills.

  • Works in 4 steps: WHEN TO LOAD THIS SKILL → HIGH-VALUE MISCONFIGURATION CHECKS → QUICK TRIAGE → …
  • Reviewing redirect URI handling
  • SKILL.md covers 1. WHEN TO LOAD THIS SKILL, 2. HIGH-VALUE MISCONFIGURATION…, 3. QUICK TRIAGE and 4. RELATED ROUTES
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

OAuth Oidc Misconfiguration is an agent skill from yaklang/hack-skills. OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.

Its SKILL.md is about 580 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Backend & APIs, covering OAuth and OpenID Connect. The repository describes itself as: Helping AI Agent become an awesome practical hacker! The licence is MIT.

When your agent uses it

  • Reviewing redirect URI handling
  • State and nonce validation
  • Callback binding
  • Identity-provider trust flaws

Example prompts

  • “/oauth-oidc-misconfiguration”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. WHEN TO LOAD THIS SKILL
  2. HIGH-VALUE MISCONFIGURATION CHECKS
  3. QUICK TRIAGE
  4. RELATED ROUTES

What it can do on your machine

Read from SKILL.md and the folder at commit 6fbf0bc. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

OAuth Oidc Misconfiguration loads about 580 tokens when it runs. Until then it costs about 56 tokens; SKILL.md has 261 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~56
When it runs · the whole SKILL.md, loaded when a task matches
~580

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from yaklang/hack-skills at commit 6fbf0bc, republished under its MIT licence (© yaklang). 261 words, ~580 tokens.

Download SKILL.mdSave it as .claude/skills/oauth-oidc-misconfiguration/SKILL.md (or your agent's skills folder).
name
oauth-oidc-misconfiguration
description
OAuth and OIDC misconfiguration testing playbook. Use when reviewing redirect URI handling, state and nonce validation, PKCE, token audience, callback binding, and identity-provider trust flaws.

SKILL: OAuth and OIDC Misconfiguration — Redirects, PKCE, Scopes, and Token Binding

AI LOAD INSTRUCTION: Use this skill when the target uses OAuth 2.0 or OpenID Connect and you need a focused misconfiguration checklist: redirect URI validation, state and nonce handling, PKCE enforcement, token audience, and account binding mistakes.

1. WHEN TO LOAD THIS SKILL

Load when:

  • The app supports Login with Google, GitHub, Microsoft, Okta, or other IdPs
  • You see authorize, callback, redirect_uri, code, state, nonce, or code_challenge
  • Mobile or SPA clients rely on OAuth or OIDC flows

For token cryptography and JWT header abuse, also load:

2. HIGH-VALUE MISCONFIGURATION CHECKS

ThemeWhat to Check
state handlingmissing, static, predictable, or not bound to user session
redirect_uri validationprefix match, open redirect chaining, path confusion, localhost leftovers
PKCEmissing for public clients, code verifier not enforced, downgraded flow
OIDC noncemissing or not validated on ID token return
token audience and issuerweak aud / iss checks, cross-client token reuse
account bindingcallback binds attacker identity to victim session
scope handlingbroader scopes granted than the user or client should receive

3. QUICK TRIAGE

  1. Map the full flow: authorize, callback, token exchange, logout.
  2. Replay callback flows with altered state, nonce, and redirect_uri.
  3. Compare SPA, mobile, and web clients for weaker validation.
  4. Check whether one provider account can be rebound to another local account.

© yaklang, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/oauth-oidc-misconfiguration of yaklang/hack-skills.

Open the folder on GitHubat commit 6fbf0bc

Compare with similar skills

OAuth Oidc Misconfiguration next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

OAuth Oidc Misconfiguration compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
OAuth Oidc Misconfiguration this skillyaklang/hack-skills2.4k—~580Automated safety check: PassMIT
Fortify Developmentcoollabsio/coolify63k4 repos~1.9kAutomated safety check: PassMIT
OmniRoute Provider Managementdiegosouzapw/OmniRoute75k—~2.4kAutomated safety check: PassMIT
Antipattern Preventiondoorkeeper-gem/doorkeeper5.5k—~1.1kAutomated safety check: PassMIT
Cognitoitsmostafa/aws-agent-skills1.2k1 repos~2.3kAutomated safety check: PassMIT
Notion Worker Third-Party Auth Guidemakenotion/workers-template4391 repos~3.5kAutomated safety check: NotesMIT

Similar skills

  • Fortify Development

    coollabsio/coolify

    ACTIVATE when the user works on authentication in Laravel. An agent skill from coollabsio/coolify.

    63k GitHub starsUsed in 4 repos~1.9k tokens
    Backend & APIsAuto-check passed

  • OmniRoute Provider Management

    diegosouzapw/OmniRoute

    Manages AI provider connections, API keys, OAuth flows and connection tests through OmniRoute's REST API across its 327-provider catalog.

    75k GitHub stars~2.4k tokensUpdated today
    Backend & APIsAuto-check passed

  • Antipattern Prevention

    doorkeeper-gem/doorkeeper

    Avoid common Ruby and Rails antipatterns that degrade maintainability and performance.

    5.5k GitHub stars~1.1k tokensUpdated yesterday
    Backend & APIsAuto-check passed

  • Cognito

    itsmostafa/aws-agent-skills

    AWS Cognito user authentication and authorization service. An agent skill from itsmostafa/aws-agent-skills.

    1.2k GitHub starsUsed in 1 repo~2.3k tokens
    Backend & APIsAuto-check passed

  • Notion Worker Third-Party Auth Guide

    makenotion/workers-template

    Official

    Decides whether a Notion Worker should use a brokered credential, a plaintext environment secret, or OAuth to authenticate against a non-Notion service.

    439 GitHub starsUsed in 1 repo~3.5k tokens
    Backend & APIsAuto-check: notes

  • Stripe Best Practices

    kanchengw/cnllm

    Guides Stripe integration decisions — API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, Treasury financial…

    173 GitHub starsUsed in 2 repos~925 tokens
    Backend & APIsAuto-check passed

More from yaklang/hack-skills

All 27 skills in this repo

  • Anti Debugging Techniques

    yaklang/hack-skills

    Anti-debugging detection and bypass playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~3.4k tokensUpdated 27 days ago
    Auto-check passed

  • API Auth And JWT Abuse

    yaklang/hack-skills

    API authentication and JWT abuse playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~567 tokensUpdated 27 days ago
    Auto-check passed

  • API Authorization And Bola

    yaklang/hack-skills

    API authorization and BOLA testing playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~449 tokensUpdated 27 days ago
    Auto-check passed

  • API Recon And Docs

    yaklang/hack-skills

    API reconnaissance and documentation review playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~456 tokensUpdated 27 days ago
    Auto-check passed

  • Attack Surface Mapping

    yaklang/hack-skills

    Draw a testable attack surface from one authorized target URL or one application.

    2.4k GitHub stars~2.6k tokensUpdated 27 days ago
    Auto-check passed

  • Classical Cipher Analysis

    yaklang/hack-skills

    Classical cipher analysis playbook. An agent skill from yaklang/hack-skills.

    2.4k GitHub stars~4.8k tokensUpdated 27 days ago
    Auto-check passed

Categories

Questions about OAuth Oidc Misconfiguration

What does OAuth Oidc Misconfiguration do?

OAuth and OIDC misconfiguration testing playbook. An agent skill from yaklang/hack-skills. OAuth Oidc Misconfiguration is an agent skill from yaklang/hack-skills. OAuth and OIDC misconfiguration testing playbook.

When should I use OAuth Oidc Misconfiguration?

OAuth Oidc Misconfiguration fits situations like: reviewing redirect URI handling; state and nonce validation; callback binding; identity-provider trust flaws.

How do I install OAuth Oidc Misconfiguration in Claude Code?

Run `npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a claude-code`. Or copy the skill folder (skills/oauth-oidc-misconfiguration in yaklang/hack-skills) into .claude/skills/oauth-oidc-misconfiguration in your project. Claude Code loads it when a task matches its description.

How do I install OAuth Oidc Misconfiguration in Codex?

Run `npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a codex`. Or copy the skill folder (skills/oauth-oidc-misconfiguration in yaklang/hack-skills) into .agents/skills/oauth-oidc-misconfiguration in your project. Codex loads it when a task matches its description.

Can I use OAuth Oidc Misconfiguration in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add yaklang/hack-skills --skill oauth-oidc-misconfiguration -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/oauth-oidc-misconfiguration, .gemini/skills/oauth-oidc-misconfiguration, .github/skills/oauth-oidc-misconfiguration and .opencode/skills/oauth-oidc-misconfiguration in your project.

What does OAuth Oidc Misconfiguration need to run?

SKILL.md names no scripts, command-line tools or credentials: OAuth Oidc Misconfiguration is instructions for the agent only.

Does OAuth Oidc Misconfiguration access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is OAuth Oidc Misconfiguration safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does OAuth Oidc Misconfiguration use?

OAuth Oidc Misconfiguration is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does OAuth Oidc Misconfiguration use?

About 580 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to OAuth Oidc Misconfiguration?

Skills that share tags, products or a category with OAuth Oidc Misconfiguration: Fortify Development (coollabsio/coolify, 63k stars), OmniRoute Provider Management (diegosouzapw/OmniRoute, 75k stars), Antipattern Prevention (doorkeeper-gem/doorkeeper, 5.5k stars) and Cognito (itsmostafa/aws-agent-skills, 1.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains OAuth Oidc Misconfiguration?

yaklang (a GitHub organization) maintains it in yaklang/hack-skills, which has 2,418 GitHub stars. The repository holds 27 skills in this directory. The repository was last updated on September 13, 2026.

Source: yaklang/hack-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.