Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured findings.md inside the RVF container.
When to use
Pre-deployment audit of a new auth flow.
Investigating a suspected token leak or redirect issue.
Establishing a baseline for ongoing regression checks.
Steps
Open a recorded session via browser-record.
Drive the auth flow as in browser-login (credentials come from --credentials <handle> referencing browser-cookies if the run is a re-auth probe).
Run probes:
csrf: inspect the login POST in the trajectory; verify a same-origin token field is present and non-empty.
redirect: watch browser_get-url after each nav for cross-origin redirects with auth state in the URL or fragment. Flag any token-bearing URL that crosses an origin boundary.
cookie: walk document.cookie via browser_eval. For each cookie, check Secure, HttpOnly, SameSite, expiry, and entropy of the value. Flag missing flags or short tokens. Pass each through aidefence_scan to flag PII embedded in cookie values.
oauth: if the flow involves a third-party provider, capture the authorization request, verify state and nonce are present and high-entropy, verify redirect_uri matches the registered callback domain.
Quarantine any token / credential / PII captured during probing — it stays inside the RVF container's findings, never returns to the model unredacted (aidefence_is_safe gate from browser-extract applies if you read the findings back).
Write findings.md with one section per probe, severity rating per finding, and a verdict (pass / warn / fail).
Index the session in browser-sessions with tag: auth-probe so future audits compare against it.
Caveats
This skill probes; it does not exploit. Do not chain follow-up requests using a captured token.
Credentials must come from a vaulted handle or interactive entry. Never hardcode them in the field map.
Some probes require multiple page loads. Trajectory step count for an auth probe typically lands at 15–40 steps; budget accordingly.
The output is structured for human review. Do not auto-act on findings without surfacing them to the user first.
1---2name: browser-auth-flow3description: Browser Auth Flow4---567# Browser Auth Flow89Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured `findings.md` inside the RVF container.1011## When to use1213- Pre-deployment audit of a new auth flow.14- Investigating a suspected token leak or redirect issue.15- Establishing a baseline for ongoing regression checks.1617## Steps18191. **Open a recorded session** via `browser-record`.202. **Drive the auth flow** as in `browser-login` (credentials come from `--credentials <handle>` referencing `browser-cookies` if the run is a re-auth probe).213. **Run probes**:2223 - **`csrf`**: inspect the login POST in the trajectory; verify a same-origin token field is present and non-empty.24 - **`redirect`**: watch `browser_get-url` after each nav for cross-origin redirects with auth state in the URL or fragment. Flag any token-bearing URL that crosses an origin boundary.25 - **`cookie`**: walk `document.cookie` via `browser_eval`. For each cookie, check `Secure`, `HttpOnly`, `SameSite`, expiry, and entropy of the value. Flag missing flags or short tokens. Pass each through `aidefence_scan` to flag PII embedded in cookie values.26 - **`oauth`**: if the flow involves a third-party provider, capture the authorization request, verify `state` and `nonce` are present and high-entropy, verify `redirect_uri` matches the registered callback domain.27284. **Quarantine** any token / credential / PII captured during probing — it stays inside the RVF container's findings, never returns to the model unredacted (`aidefence_is_safe` gate from `browser-extract` applies if you read the findings back).295. **Write `findings.md`** with one section per probe, severity rating per finding, and a `verdict` (pass / warn / fail).306. **Index** the session in `browser-sessions` with `tag: auth-probe` so future audits compare against it.3132## Caveats3334- This skill probes; it does not exploit. Do not chain follow-up requests using a captured token.35- Credentials must come from a vaulted handle or interactive entry. Never hardcode them in the field map.36- Some probes require multiple page loads. Trajectory step count for an auth probe typically lands at 15–40 steps; budget accordingly.37- The output is structured for human review. Do not auto-act on findings without surfacing them to the user first.3839---4041**Source:** [`ruvnet/ruflo`](https://github.com/ruvnet/ruflo) → `plugins/ruflo-browser/skills/browser-auth-flow/SKILL.md`
Run npx skillmds@latest add ruvnet/browser-auth-flow in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Browser Auth Flow It is listed under Security on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
ruvnet (@ruvnet) published this skill. Their other Agent Skills are listed on their SkillMD profile.
ruvnet