Browser Auth Flow

Runs an adversarial probe against your login flow, checking for redirect leaks, missing CSRF tokens, weak session cookies, and OAuth misconfigurations. It drives the auth sequence in a recorded browser session, then runs a configurable set of tests (csrf, redirect, cookie, oauth) against the captured artifacts and live page. Output lands in a structured findings.md with severity ratings and a pass/warn/fail verdict. Good for pre-deployment audits or investigating suspected token leaks. The probes are deliberately limited to inspection, they don't exploit findings, and all credentials stay vaulted. Expect 15 to 40 trajectory steps per run.

skills.sh installs: 690
GitHub stars: 81.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add ruvnet/ruflo --skill browser-auth-flow --agent claude-code

Installs into .claude/skills of the current project.

Files

Browser Auth Flow

Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured findings.md inside the RVF container.

When to use

Pre-deployment audit of a new auth flow.
Investigating a suspected token leak or redirect issue.
Establishing a baseline for ongoing regression checks.

Steps

Open a recorded session via browser-record.
Drive the auth flow as in browser-login (credentials come from --credentials <handle> referencing browser-cookies if the run is a re-auth probe).
Run probes: