638 skills · sorted by relevance
Implement and debug Google OAuth 2.0 refresh tokens bound to a client key. Covers key generation, signed DPoP proofs that demonstrate key possession, and nonce challenge retries in WebCrypto and JavaScript environments.
Connect a remote Hermes gateway to MCP servers that require OAuth, a browser-based authorization process. The skill covers dashboard access, manual token setup when needed, and diagnosis of expired tokens or revoked sessions.
Configure OAuth 2.0 authorization for web and mobile apps or service communication. Choose suitable flows, implement PKCE to protect authorization codes, limit permissions, and manage token storage, renewal, and revocation with security checks.
Configure OAuth, the authorization flow used for provider sign-in, with portless development URLs. It guides callback registration and authentication library settings, helping diagnose rejected domains, redirect URL mismatches, and callbacks that point to the wrong address.
Build remote MCP servers, which let AI agents call external tools, on Cloudflare Workers. This skill covers server code, tool definitions, OAuth authentication, local testing, deployment, and connecting a Codex client.
Manage OmniRoute API keys and provider authentication from the command line. Register, rotate, or revoke keys, inspect usage and expiration, set spending and model restrictions, and start or check OAuth sign-in connections.
Trace mailbox abuse in a CTF sandbox, a controlled security challenge environment. The skill connects OAuth permissions, forwarding rules, delegated access, and message logs to concrete mail effects, documenting the smallest reproducible sequence and supporting evidence.
Investigate stolen OAuth tokens and their reuse in Microsoft Entra ID through sign-in log analysis. Follow response procedures for revoking sessions and reviewing app permissions, and configure device-bound token protection and session monitoring for Azure and M365 environments.
Launch a standalone Chrome browser in a Daytona sandbox and control it through CDP, a browser debugging connection. Use it to complete sign-in, OAuth authorization, and web administration flows, then verify the visible results.
Use when managing Connected Apps for integration purposes — configuring OAuth policies, IP restrictions, refresh token expiry, pre-authorization assignment via profile or permission set, and monitoring connected app usage via EventLogFile. Also covers the running-integration operations: revoking a grant, rotating the consumer key or secret, pairing the app to an integration user's permission set, and the periodic review. Trigger keywords: 'revoke OAuth token', 'DeleteToken', 'OauthToken query returns nothing', 'ipRelaxation ENFORCE', 'permissionSetName', 'PermissionSetAssignment ExpirationDate', 'LoginHistory Application', 'connected app quarterly review', 'rotate consumer secret'. NOT for choosing which OAuth grant flow to implement — use integration/oauth-flows-and-connected-apps. NOT for decoding a specific OAuth error such as invalid_grant — use admin/connected-app-troubleshooting. NOT for authoring the full connectedApp / External Client App / Named Credential file or choosing the auth artefact — use admin/connected-apps-and-auth.
The English summary is being prepared. Showing the original description.
Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.
Prepare a local LangBot environment for development and browser testing. The skill covers service startup, shared connection settings, browser access, proxy troubleshooting, and reusable login profiles, with guidance for Linux and WSL environments.
Prepare a Python environment for Mixpanel analysis by installing required libraries and checking credentials and connectivity. Use it for first-time setup, missing dependencies, or guidance on service account and OAuth sign-in options.
Troubleshooting Connected App OAuth flows — IP relaxation vs IP restriction, refresh token policy traps (default kills the connection on first refresh), session-revocation semantics, the OAuth error-code catalog (`invalid_grant`, `invalid_client_id`, `unsupported_grant_type`), per-user vs admin-pre-approved flows, and the user-policy check (Connected App must be assigned to the user via profile / permset). Covers the Login History debug trail. NOT for designing the OAuth flow itself — use integration/oauth-flows-and-connected-apps. NOT for a SAML / SSO login failure — use security/sso-saml-troubleshooting. Trigger keywords: 'invalid_grant', 'OAUTH_APP_BLOCKED', 'redirect_uri_mismatch', 'LoginHistory Status', 'LoginSubType', 'OauthRefreshToken', 'ForwardedForIp', 'SetupAuditTrail connected app', 'refreshTokenPolicy zero', 'isSecretRequiredForRefreshToken', 'works once then fails', 'diagnosis record'.
The English summary is being prepared. Showing the original description.
Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.
Build connections between applications and external APIs, interfaces used to exchange data with other services. The skill guides authentication, data conversion, webhook verification, request limits, retries, and troubleshooting to support reliable API clients.
Operate Chrome or Brave using signed-in browser sessions to verify deployed pages, reproduce bugs, inspect page structure, and examine errors or network traffic. An optional macOS bridge extends control to native applications and operating system input.
Design authentication and access permissions for web apps, mobile apps, and backend services using OAuth 2.0 and OpenID Connect. Get guidance on authorization flows, token validation, secure storage, renewal, and revocation.
Google OAuth クライアント設定の手順を案内する。「OAuth 設定」「Google 認証の準備」「クライアント ID 作成」「認証手順を教えて」「Google ログイン準備」「OAuth セットアップ」「認証設定したい」などで起動。
The English summary is being prepared. Showing the original description.
Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or aut...
The English summary is being prepared. Showing the original description.
Inspect a site's login flow for token leaks, missing protections against forged requests, exposed session cookies, and OAuth configuration issues. Produce a structured findings report with severity ratings and a pass, warn, or fail verdict.
Assess authorized single sign-on systems using SAML, OIDC, and OAuth2. Map the login flow, check signatures, redirects, and token validation, then document reproducible findings and their impact, including identity or tenant confusion.
Review suspicious emails for phishing and business email fraud by examining sender authentication, message content, links, and attachments. Organize indicators of compromise, which are traces of malicious activity, and recommend controls for the email environment.
Plan and implement user login and access permissions using sessions, JWT tokens, or OAuth2. Apply role-based permissions, protect APIs, and review common weaknesses in password handling, cookies, token expiration, and server-side checks.