Guide · Agent skill
How to use the Identity Federation Security Testing agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The identity-federation skill is an agent skill that gives an AI agent a structured playbook for assessing single sign-on systems built on SAML, OpenID Connect and OAuth2. It is written for authorized testing: penetration testers reviewing an organisation's SSO setup, developers checking their own SAML or OIDC integration, and security teams preparing an identity federation audit. After reading this guide you will know what the skill does, how to install it, how to ask for it in plain language, and what it needs before you use it.
Identity Federation Security Testingzhaoxuya520/reverse-skill · MIT Download the skill Quick start
- 1Get written authorization. Confirm you have written permission and a defined scope covering the IdP and SP you will test.
- 2Download and unzip the skill. Download the ZIP from the directory page and unzip it so SKILL.md and references/sso-flow-checklist.md are in one skill folder.
- 3Place the skill folder. Put it in ~/.claude/skills/ for all projects, or in a project's .claude/skills/ folder for one project. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills instead.
- 4Install the testing tools. Obtain Burp Suite with the SAML Raider extension, jwt_tool and browser developer tools, since the skill references them but does not include them.
- 5Ask for the flow mapping first. Describe the protocol, the IdP and SP in scope, and ask the agent to map the login flow before checking anything else.
- 6Work through the checklist. Ask the agent to check redirect_uri matching, state, PKCE, SAML signatures, sessions and logout, and record each finding with reproduction steps and impact.
What does the identity-federation skill make the agent do?
When the skill is installed, the agent follows a fixed assessment workflow for federated login. It first maps the flow between the user, the service provider (SP), the identity provider (IdP) and the token passed back to the SP. Then it checks the common mistakes that usually cause SSO problems.
The checks listed in the skill cover weak redirect URI matching, missing state or PKCE protection, SAML signature coverage and algorithm downgrade, session fixation, and logout that does not invalidate sessions. The skill also covers issuer confusion between IdP and SP metadata and multi-tenant setups, and it includes a reference checklist covering audience and issuer validation and account linking logic.
- Map the login flow: User, SP, IdP, Token, SP
- Collect OpenID configuration and SAML metadata
- Check redirect_uri exact matching, state binding and PKCE
- Check SAML signature coverage and algorithm handling
- Check session fixation and logout invalidation
- Finish with a checklist and a reproduction and impact note for each finding
How do you install the identity-federation skill?
Download the skill ZIP from the directory page and unzip it. The skill folder should contain SKILL.md and references/sso-flow-checklist.md. Place it in one of two locations: your user skills folder at ~/.claude/skills/, or a project's .claude/skills/ folder if you want it to apply only to that project.
If you use the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
- Option 1: unzip into ~/.claude/skills/ for all your projects
- Option 2: unzip into a project's .claude/skills/ folder for one project
- Option 3: upload the ZIP in the Claude apps under Settings → Capabilities → Skills
How do you trigger the skill with a natural request?
You do not need a special command. Describe the task in plain language that mentions the protocol or the kind of SSO problem, and make clear the test is authorized and has a defined scope. The skill's description covers authorized assessment of SAML, OIDC, OAuth2 flows, SSO misconfiguration and token confusion, so requests in those terms are the ones it is built for.
Also state the scope up front. The skill tells the agent to put SSO test accounts and the IdP and SP scope on record before starting, so include them in your request.
- "We have written authorization to test our SSO. Scope is the staging IdP and the billing SP. Map the OIDC login flow and check redirect_uri and state handling."
- "Review our SAML integration before release. Check signature coverage and whether the signature algorithm can be downgraded."
- "Build an audit checklist for our identity federation setup covering logout and session revocation."
What kinds of tasks does it handle well?
The skill is most useful when you have a specific protocol flow to review. Typical work includes walking through an OIDC authorization code flow to check PKCE on public clients, reviewing a SAML Response for signature gaps, and verifying that redirect URIs are matched exactly rather than loosely.
It is also a useful planning aid. Because it sets out a workflow and a checklist, it can help a security team agree on what to cover in an audit before testing begins.
- Reviewing an OIDC or OAuth2 authorization flow for redirect and state issues
- Checking a SAML integration for signature and assertion problems
- Testing logout and session handling after sign-out
- Building an identity federation audit checklist before a test
What do you need before using it?
The skill itself does not run anything. It is a set of instructions, and it references tools that you must obtain separately: Burp Suite with the SAML Raider extension for editing SAML assertions, jwt_tool for JWT segments, and your browser's developer tools for following redirect chains. The skill also points to IdP admin logs for audit purposes.
Most importantly, you need written authorization and a defined scope for the test. The skill is built for offensive techniques, so using it against systems you do not own or have permission to test may be illegal.
- Burp Suite with the SAML Raider extension (referenced, not included)
- jwt_tool (referenced, not included)
- Browser developer tools
- Written authorization and a defined scope for the test
What safety rules does the skill apply?
The skill runs no scripts and makes no network calls of its own. Everything it does happens through the agent's normal conversation and the tools you run yourself. Its instructions tell the agent to stay inside the authorized scope and to avoid brute-forcing real user accounts, since locking out real users is a common side effect of password guessing.
Treat the skill's output as guidance to be checked. Any finding should be reproduced and documented with its impact before it is reported.
- Runs scripts: no
- Uses network: no
- Stay within the authorized scope at all times
- Do not brute-force real user accounts
What people use it for
- Pre-release review of a company's own OIDC login integration for redirect URI and PKCE issues.
- Scoped penetration test of an organisation's SAML single sign-on, focused on signature coverage.
- Preparing a checklist for an identity federation audit covering account linking and logout.
- Checking whether logout actually revokes sessions across a federated app.
- Reviewing an OAuth2 flow for token confusion between issuers or audiences.
Frequently asked questions
How do I install the identity-federation agent skill?
Download the skill ZIP from the directory page and unzip it into ~/.claude/skills/ for all projects, or into a project's .claude/skills/ folder for one project. In the Claude apps you can instead upload the ZIP under Settings → Capabilities → Skills.
Is the identity-federation skill free to use?
The skill is listed under the MIT licence. Its tools, Burp Suite with SAML Raider and jwt_tool, are separate downloads, and the skill does not include them, so check their own licences.
What do I need to run the identity-federation skill?
You need Burp Suite with the SAML Raider extension, jwt_tool, browser developer tools, and written authorization with a defined scope for the test. The skill itself runs no scripts and makes no network calls.
Can I use this skill to test a website I don't own?
No. The skill is built for offensive techniques and is intended only for authorized assessments. Testing SSO systems without owner permission may be illegal.
Is this skill a guide to setting up SSO?
No. It is a security assessment playbook for finding misconfigurations in SAML, OIDC and OAuth2 flows. If you want implementation instructions, you need a different resource.
How is this different from the api-security skill?
The identity-federation skill focuses on federated and SSO flows. The source notes that pure API JWT attacks belong to a separate api-security skill, so the two complement each other.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are doing an authorized security test of SAML, OIDC or OAuth2 single sign-on, or reviewing your own integration before release, and you have written scope. Pick something else if you want a beginner guide to setting up SSO, or if you have no permission to test the system in question.
Download the skill