# Auth Security Reviewer

> Review security risks around login, sessions, tokens, authorization checks, admin boundaries, and secret exposure. Use it for changes involving auth or sensitive data handling.

- Skill: `lteawoo/auth-security-reviewer` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add lteawoo/auth-security-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lteawoo/auth-security-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: lteawoo (https://skillmd.com/u/lteawoo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/lteawoo/auth-security-reviewer

---


# Auth Security Reviewer

## Purpose
Identify security vulnerabilities and operational risks around authentication, authorization boundaries, and sensitive data handling.

## Core Principles
1. Evaluate authentication and authorization separately.
2. Check bypass paths and failure paths before the success path.
3. Do not trust client-side validation.
4. Review sensitive data across storage, transport, logs, and responses.
5. Keep admin boundaries distinct from regular user capabilities.
6. Do not overstate assumptions; describe the conditions required for exploitation.

## Inputs
- Auth-related code or changes
- Login flow and session or token design
- Permission model or role definitions
- Environment variables and secret handling approach
- Related APIs, middleware, guards, or route configuration
- Known concerns or prior incidents, if available

## Review Workflow
1. Separate authentication boundaries from authorization boundaries.
2. Map the flow for login, sessions, and token issuance, verification, expiry, and refresh.
3. Confirm where permission checks happen across routes, APIs, and service layers.
4. Inspect admin-only features, resource ownership checks, and direct object access risks.
5. Check whether secrets, tokens, or personal data are exposed through storage, logs, or responses.
6. Document exploitable failure paths and any further validation that is required.

## Output Format

### Security Review Summary
- Review scope
- Core security boundaries

### Authentication Review
- Login and session flow
- Token issuance, expiration, and refresh handling
- Authentication bypass risk

### Authorization Review
- Roles or permission model
- Permission checks per endpoint or service
- Resource ownership validation

### Sensitive Data Review
- How secrets are stored and injected
- Exposure in logs, responses, or client storage
- Environment-variable or configuration risks

### Key Findings
- Vulnerable areas
- Exploitation conditions
- Recommended remediation direction

### Additional Validation
- Security tests to add
- Manual review scenarios
- Assumptions that still need confirmation

## When Information Is Missing
- If the auth structure is unclear, separate confirmed facts from assumptions based on the current code.
- If the permission model is undocumented, judge it from the actual enforcement points.
- If security impact looks high but evidence is incomplete, do not down-rank it to "needs confirmation" without stating the risk conditions.