mcpField
A
auth-audit

auth-audit

github.com/fusengineSecurity3446 installsUpdated 2w ago
Repository

About auth-audit

auth-audit is a skill for end-to-end reviews of authentication and authorization implementations. It examines token and session lifecycles, OAuth2, passwords, MFA, cryptographic choices, and access-control logic for common vulnerabilities.

Key features

  1. 01Audits JWT signing, expiry, refresh, and storage
  2. 02Checks session lifecycle and fixation risks
  3. 03Reviews OAuth2 PKCE, state, and redirects
  4. 04Examines password rules and reset flows
  5. 05Checks MFA, recovery, RBAC, and ABAC

Use cases

  1. 01Reviewing a JWT-based authentication system
  2. 02Auditing OAuth2 login and redirects
  3. 03Checking session handling after login
  4. 04Assessing authorization and MFA controls

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/fusengine/agents --skill auth-audit

After installing, type/auth-auditin Claude Code to confirm it loaded.

Bundled filesreferences/auth-patterns.mdreferences/templates/auth-checklist.md

Details

From the project README
This skill audits authentication and authorization implementations end to end: JWT signing algorithm, expiration, refresh, and storage; session storage, expiry, regeneration, and fixation; OAuth2 PKCE, state parameter, and redirect validation; password hashing algorithm, strength rules, and reset flow; and MFA implementation, backup codes, and recovery.

It runs a fixed workflow — detect the auth implementation, scan for known anti-patterns, verify cryptographic choices, check token/session lifecycle, and audit authorization logic (RBAC/ABAC) — checking for vulnerabilities such as JWT signed with none, undersized JWT secrets, missing/too-long token expiration, refresh tokens in localStorage, session fixation, missing CSRF protection, and OAuth flows missing PKCE or the state parameter.

Auth Audit Skill

Overview

Comprehensive audit of authentication and authorization implementations.

Audit Categories

CategoryChecks
JWTSigning algo, expiration, refresh, storage
SessionsStorage, expiry, regeneration, fixation
OAuth2PKCE, state param, redirect validation
PasswordsHashing algo, strength rules, reset flow
MFAImplementation, backup codes, recovery

Workflow

  1. Detect auth implementation (JWT, sessions, OAuth)
  2. Scan for known anti-patterns
  3. Verify cryptographic choices
  4. Check token/session lifecycle
  5. Audit authorization logic (RBAC, ABAC)

Common Vulnerabilities

  • JWT signed with none algorithm
  • JWT secret too short (< 256 bits)
  • No token expiration or too long
  • Refresh tokens stored in localStorage
  • Session fixation after login
  • Missing CSRF protection
  • OAuth without PKCE for public clients
  • Missing state parameter in OAuth flow

References

Comments

Markdown supported