It runs a fixed workflow — detect the auth implementation, scan for known anti-patterns,
verify cryptographic choices, check token/session lifecycle, and audit authorization logic
(RBAC/ABAC) — checking for vulnerabilities such as JWT signed with none, undersized JWT
secrets, missing/too-long token expiration, refresh tokens in localStorage, session fixation,
missing CSRF protection, and OAuth flows missing PKCE or the state parameter.
Auth Audit Skill
Overview
Comprehensive audit of authentication and authorization implementations.
Audit Categories
| Category |
Checks |
| JWT |
Signing algo, expiration, refresh, storage |
| Sessions |
Storage, expiry, regeneration, fixation |
| OAuth2 |
PKCE, state param, redirect validation |
| Passwords |
Hashing algo, strength rules, reset flow |
| MFA |
Implementation, backup codes, recovery |
Workflow
- Detect auth implementation (JWT, sessions, OAuth)
- Scan for known anti-patterns
- Verify cryptographic choices
- Check token/session lifecycle
- Audit authorization logic (RBAC, ABAC)
Common Vulnerabilities
- JWT signed with
none algorithm
- JWT secret too short (< 256 bits)
- No token expiration or too long
- Refresh tokens stored in localStorage
- Session fixation after login
- Missing CSRF protection
- OAuth without PKCE for public clients
- Missing
state parameter in OAuth flow
References
- Auth Patterns
- Auth Checklist
1---2name: auth-audit3description: Use when auditing JWT, session, OAuth2/PKCE, password, or MFA implementations for security vulnerabilities and best-practice deviations.4---56<objective>7This skill audits authentication and authorization implementations end to end: JWT signing8algorithm, expiration, refresh, and storage; session storage, expiry, regeneration, and9fixation; OAuth2 PKCE, state parameter, and redirect validation; password hashing algorithm,10strength rules, and reset flow; and MFA implementation, backup codes, and recovery.1112It runs a fixed workflow — detect the auth implementation, scan for known anti-patterns,13verify cryptographic choices, check token/session lifecycle, and audit authorization logic14(RBAC/ABAC) — checking for vulnerabilities such as JWT signed with `none`, undersized JWT15secrets, missing/too-long token expiration, refresh tokens in localStorage, session fixation,16missing CSRF protection, and OAuth flows missing PKCE or the `state` parameter.17</objective>1819# Auth Audit Skill2021## Overview2223Comprehensive audit of authentication and authorization implementations.2425## Audit Categories2627| Category | Checks |28|----------|--------|29| JWT | Signing algo, expiration, refresh, storage |30| Sessions | Storage, expiry, regeneration, fixation |31| OAuth2 | PKCE, state param, redirect validation |32| Passwords | Hashing algo, strength rules, reset flow |33| MFA | Implementation, backup codes, recovery |3435## Workflow36371. **Detect** auth implementation (JWT, sessions, OAuth)382. **Scan** for known anti-patterns393. **Verify** cryptographic choices404. **Check** token/session lifecycle415. **Audit** authorization logic (RBAC, ABAC)4243## Common Vulnerabilities4445- JWT signed with `none` algorithm46- JWT secret too short (< 256 bits)47- No token expiration or too long48- Refresh tokens stored in localStorage49- Session fixation after login50- Missing CSRF protection51- OAuth without PKCE for public clients52- Missing `state` parameter in OAuth flow5354## References5556- [Auth Patterns](references/auth-patterns.md)57- [Auth Checklist](references/templates/auth-checklist.md)
fusengine