Auth Sec

This is a routing skill that helps you figure out which authentication or authorization testing path to take before diving deep. It covers the decision tree between login mechanics, object-level access controls, browser trust boundaries, and identity protocols like OAuth, JWT, and SAML. You'd reach for this when facing a login page, API with tokens, or SSO flow and need to triage whether you're dealing with broken authentication, IDOR issues, CSRF problems, or protocol misconfigurations. The skill map links out to seven specialized auth topics, so it's really about making the right first move rather than doing the actual testing. Honest take: it's metacognition as a skill, which is useful if you're new to auth testing or working with a complex surface.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill auth-sec --agent claude-code

Installs into .claude/skills of the current project.

Files

Authentication and Authorization Router

This is the routing entry point for authentication, sessions, and authorization boundaries.

Use it to decide whether the issue is mainly login mechanics, object-level authorization, browser trust boundaries, or identity protocols such as OAuth/JWT/SAML before going deeper.

When to Use

The target includes login, registration, password reset, 2FA, sessions, JWT, OAuth, or SSO
You suspect object authorization flaws, cross-tenant access, cross-origin reads, CSRF, or protocol misconfiguration
You need to decide whether to test authentication or authorization first