Open Redirect Vulnerability Testing

What it does

When active, this skill gives the agent a structured checklist for spotting open redirect flaws, where a website sends visitors to an attacker-chosen address. It covers where to look (redirect parameters, login and OAuth flows), common bypass tricks such as encoding, double slashes and domain spoofing, and how a minor redirect can be chained into bigger issues like OAuth token theft or SSRF. It is written for offensive security testing, so the agent acts as a tester working through the checklist and suggesting next steps.

Try asking

• “Review https://myapp.example/login?next= for open redirect issues and suggest bypass tests I can run on my own staging site”Copy
• “Walk me through the OAuth redirect_uri checks for my app and what a partial allowlist flaw looks like”Copy
• “Create a checklist of redirect parameter names to audit in our codebase”Copy

Get better results

• State that you have authorisation for the target and its scope so the agent keeps tests within bounds
• Paste the specific endpoint or code snippet so the agent can judge which techniques apply
• Ask for remediation alongside findings, such as strict allowlists and exact redirect_uri matching

What's inside

• SKILL.md