Skip to content
Get packs

Identity Federation Security Testing

Guides an agent through authorized testing of SAML, OIDC and OAuth2 single sign-on flows for misconfigurations.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
2 files

What it does

When installed, the agent gets a structured playbook for assessing how a system's single sign-on works (SAML, OpenID Connect, OAuth2). It maps the login flow between user, service provider and identity provider, then checks common mistakes such as weak redirect URI matching, missing state or PKCE protection, SAML signature gaps and session or logout problems. It also points to Burp Suite with SAML Raider, jwt_tool and browser developer tools as the usual testing tools, and it tells the agent to stay within an authorized scope and avoid brute-forcing real user accounts.

Great for

  • Security testers doing an authorized penetration test of an organisation's SSO setup
  • Developers reviewing their own SAML or OIDC integration before release
  • Security teams preparing a checklist for an identity federation audit

Skip it if

  • Testing SSO systems you do not own or have written permission to test, since the skill is built for offensive techniques and unauthorized use may be illegal
  • Beginners wanting a simple SSO setup guide, because the content is a security assessment playbook rather than implementation instructions

Try asking

  • “Map the SSO login flow for our staging app and its identity provider, then list likely misconfigurations to verify with permission”
  • “Check whether our OIDC client enforces exact redirect_uri matching and uses PKCE and state correctly”
  • “Review our SAML metadata and signature coverage for known weakness patterns in an authorized test”
Step-by-step guide: how to use Identity Federation Security TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    identity-federation.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip identity-federation.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip identity-federation.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide the test scope, IdP and SP details and a dedicated test account before starting so the agent stays within authorization.
  • Ask for a flow map first, then verify each suspected issue step by step with reproduction notes.
  • Note that the SKILL.md is partly written in Chinese and references other skills (api-security, windows-ad, cloud-k8s) that are not part of this package.

What's inside

  • references/sso-flow-checklist.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.