654 skills · sorted by relevance
Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.
Investigate clickjacking, where a hidden page tricks users into unintended clicks. Check protective headers, then verify in a real browser whether the embedded page retains authentication and allows sensitive actions.
Emulated Microsoft Entra ID (Azure AD) OAuth 2.0 / OpenID Connect for local development and testing. Use when the user needs to test Microsoft sign-in locally, emulate Entra ID OIDC discovery, handle Microsoft token exchange, configure Azure AD OAuth clients, work with Microsoft Graph /me, or test PKCE/client credentials flows without hitting real Microsoft APIs. Triggers include "Microsoft OAuth", "Entra ID", "Azure AD", "emulate Microsoft", "mock Microsoft login", "test Microsoft sign-in", "Microsoft OIDC", "local Microsoft auth", or any task requiring a local Microsoft OAuth/OIDC provider.
The English summary is being prepared. Showing the original description.
Expert guidance on authentication implementation including OAuth 2.0/OIDC, JWT tokens, session management, and secure password handling. Covers both implementing auth from scratch and integrating auth providers. Use when "implement authentication, oauth login, jwt tokens, session management, social login, password reset, multi-factor auth, refresh tokens, Working with Auth0, Clerk, NextAuth, Passport.js, authentication, oauth, jwt, session, security, login, password, mfa, oidc" mentioned.
The English summary is being prepared. Showing the original description.
Hunt OAuth 2.0 and OIDC flaws — redirect_uri abuse, state CSRF, PKCE bypass, scope manipulation, implicit-flow token theft, postMessage origin tricks, ID token sub claim swap, JWKS confusion, response_type confusion, and OAuth-CSRF. Use when an app has Google/GitHub/Facebook/Apple/custom OAuth or OpenID Connect.
The English summary is being prepared. Showing the original description.
Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).
The English summary is being prepared. Showing the original description.
Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com/token. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM / service account authentication.
The English summary is being prepared. Showing the original description.
Webアプリのアクセス制御・認証・認可の実装はすべてこのスキルを使う。遮断だけならCloudflare Access、アプリ内identity・role・session・WebSocket等が必要ならBetter Authとする単一決定表の正本。「認証を付けて」「ログイン機能」「Googleでログインできるように」「社員だけに限定」「特定企業だけに公開」「許可リスト/招待制」「メール+パスワード認証」「セッション管理」「ロール・権限管理」「OAuth設定」「redirect_uri_mismatchを直す」「認証のセキュリティレビュー」などの文脈で、ユーザーが「認証」と明示しなくてもログイン要件が含まれるなら必ず読む。特にNext.js App Router＋OpenNext＋D1、Hono、素のWorkersでのBetter Auth＋Google OAuth導入を自動化し、Google Cloud Consoleで人間にしかできない操作は日本語のクリック手順と直リンクへ切り分ける。
The English summary is being prepared. Showing the original description.
Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
The English summary is being prepared. Showing the original description.
tespit etme (s) and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly Tespit. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft Tespit, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
The English summary is being prepared. Showing the original description.
Guide for adding new OAuth-based integrations to Fabric. Use when implementing OAuth providers like Microsoft Teams, GitHub, Google Drive, Slack, or similar services that need OAuth 2.0 authentication for user data access.
The English summary is being prepared. Showing the original description.
Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
The English summary is being prepared. Showing the original description.
OAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.
The English summary is being prepared. Showing the original description.
Connect software to X (Twitter) to publish posts and threads, upload images, read timelines, search conversations, and track engagement. Covers authentication, access checks, and handling limits on how often the API can be called.
Manage email, schedules, files, documents, and spreadsheets across Google services. Search and reply in Gmail, create Calendar events, share Drive files, and update Docs or Sheets through a command-line interface or the bundled Python client.
Manage AI provider connections from the terminal. List configured services, test connections individually or together, rotate credentials, and inspect usage metrics. Validate local configuration without contacting providers when checking its structure.
Manage AI service connections in OmniRoute through its API. Add, update, remove, and test connections, maintain API keys and sign-in credentials, and inspect usage metrics and connection health.
Build and troubleshoot C#/.NET MCP servers that expose tools and information to AI agents. Guidance targets the official 2.x SDK and covers transport setup, authentication, interactive features, basic clients, and migration issues caused by changed defaults.
Investigate suspected email account takeovers by examining audit logs, sign-ins, inbox rules, and app permissions. Identify suspicious forwarding, unlikely travel between sign-ins, and unusual access, then summarize findings and recommended containment actions in a severity-rated report.
Connect Gmail, Calendar, and Contacts to track people awaiting replies and promises still outstanding. Get a prioritized digest with supporting quotes, email links, deadlines when available, and background context to help prepare a response.
Connect NanoClaw to Linear so an agent can respond to issue comments without mentions. The skill installs and checks the integration, guides authentication setup, and keeps each issue thread in its own conversation.
Set up access to Zoom Whiteboard through MCP, a connector interface for agent tools. Find authentication requirements, choose the correct board identifier, and follow workflows for listing and retrieving whiteboards, with a catalog of creation and metadata tools.
Helps implement Zoom Phone connections with CRM systems and web apps. Covers embedded calling, call history, call and SMS launch links, and automated call handling, with guidance on authentication, event processing, and security checks.
Build Zoom Team Chat integrations for user messages or interactive bots. Guides API selection, authentication, message cards with buttons and forms, and webhooks that receive commands and user actions.