OAuth Security Testing
Walks an agent through an OAuth attack checklist for testing login and authorization flows in web apps
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
OAuth is the standard 'Log in with Google/GitHub' system that lets apps access accounts using tokens. Once this skill is installed, when you ask the agent about OAuth, it follows a structured checklist of known weaknesses (such as redirect_uri bypass, missing or abused state parameters, PKCE bypass, token leakage via Referer, and scope escalation) and checks how a given implementation handles each one. It also explains OAuth best practices and flow mechanics, including OAuth 2.1 and FAPI guidance. The file is a text methodology, not an automated scanner.
Great for
- Security testers and bug bounty hunters reviewing OAuth or OIDC login implementations they are authorized to test
- Developers who want a checklist of common OAuth mistakes to review in their own code
- Students learning how OAuth flows can fail
Skip it if
- Testing systems you do not own or have explicit written permission to test, since the checklist is written for attacking live targets and could facilitate unauthorized access
- Non-technical users looking for a simple way to secure a login, because the skill is an offensive reference rather than a setup guide
Try asking
- “Review this OAuth authorization code flow for redirect_uri validation weaknesses in my authorized test app”
- “Walk me through a PKCE bypass checklist for a single-page app I'm pentesting”
- “Check whether my app's state parameter handling protects against OAuth CSRF”
- “Summarize the OAuth 2.1 changes I should verify in my authorization server”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-oauth.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-oauth.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-oauth.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- State clearly that you are authorized to test the target, and name the scope, so the agent stays on the in-scope assessment.
- Provide the actual requests, redirect URIs, or code you want reviewed; the checklist works best when applied to concrete details.
- Pair the checklist with a proxy such as Burp or ZAP for the manual steps it describes, since the agent itself does not send traffic.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.