# Auth Review

> Perform a defensive review of authentication and authorization flows in an authorized codebase. Use for login, session, MFA, OAuth, password reset, cookie security, JWT validation, impersonation, privilege checks, and object-level access control.

- Skill: `muhammedzohaib/auth-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add muhammedzohaib/auth-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/muhammedzohaib/auth-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: MuhammedZohaib (https://skillmd.com/u/muhammedzohaib)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/muhammedzohaib/auth-review

---


# Auth Review

## Focus

- login and logout correctness
- session fixation and invalidation
- cookie flags and token storage
- reset, invite, recovery, and MFA flows
- server-side authorization and object-level checks
- impersonation, elevation, and admin escape hatches

## Review prompts

- Are checks enforced server-side on every sensitive action?
- Does auth depend on user-controlled headers, origins, or claims?
- Are session boundaries rotated after identity change?
- Can one user access another user's objects through predictable identifiers?

## Output

Use the Patchman findings format and call out auth assumptions explicitly.