666 个 · 按相关度排序
Guide authorized testing of open redirects, where a site sends visitors to an unintended destination. This skill defines test boundaries, alternative investigation paths, and the evidence needed to report findings or conclude an investigation.
中文简介正在准备中。当前显示英语简介。
Maintain upstream OAuth identity-provider directive parsers, shared configuration dispatch, injectable OAuth login storage, OAuth/OIDC discovery, GitHub identity claims, JWKS and static public PEM verification, EdDSA/Ed25519 token validation, key refresh, and real portal OAuth E2E tests. Excludes portal signing-key publication and gatekeeper-owned direct OAuth sessions.
中文简介正在准备中。当前显示原文说明。
Google OAuth クライアント設定の手順を案内する。「OAuth 設定」「Google 認証の準備」「クライアント ID 作成」「認証手順を教えて」「Google ログイン準備」「OAuth セットアップ」「認証設定したい」などで起動。
中文简介正在准备中。当前显示原文说明。
Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass. The tester evaluates the authorization server, client application, and token handling for common misconfigurations that enable account takeover or unauthorized access. Activates for requests involving OAuth security testing, OIDC vulnerability assessment, OAuth2 redirect bypass, or aut...
中文简介正在准备中。当前显示原文说明。
将功能开发、缺陷修复等开发目标拆分为可验证的小阶段，整理依赖关系、交付成果、工作量估算和达成标准，制定从实施到完成验收的计划。
Assess authorized single sign-on systems using SAML, OIDC, and OAuth2. Map the login flow, check signatures, redirects, and token validation, then document reproducible findings and their impact, including identity or tenant confusion.
中文简介正在准备中。当前显示英语简介。
Review suspicious emails for phishing and business email fraud by examining sender authentication, message content, links, and attachments. Organize indicators of compromise, which are traces of malicious activity, and recommend controls for the email environment.
中文简介正在准备中。当前显示英语简介。
Plan and implement user login and access permissions using sessions, JWT tokens, or OAuth2. Apply role-based permissions, protect APIs, and review common weaknesses in password handling, cookies, token expiration, and server-side checks.
中文简介正在准备中。当前显示英语简介。
Create a Microsoft 365 Copilot agent that connects to external systems through MCP, a protocol for accessing tools and data. Generate project configuration, select available functions, configure authentication, and follow provisioning and testing steps.
中文简介正在准备中。当前显示英语简介。
Review application permissions and consent audit logs in Microsoft Entra ID using Microsoft Graph API. Identify overly broad access, unverified publishers, and suspicious consent patterns, then produce a JSON risk report with remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Simulate device-code and app-consent phishing in an explicitly authorized Microsoft Entra ID environment. Assess whether authentication and consent controls prevent token misuse, map reachable Microsoft 365 resources, and document findings with remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Investigate Office 365 account compromise by reviewing audit logs, email forwarding rules, mailbox permissions, and application access grants. Produce a JSON report with risk scores and a timeline showing suspicious activity and affected mailboxes.
中文简介正在准备中。当前显示英语简介。
Choose an authentication flow for a Zoom integration, define scopes that control access, and understand token renewal. Use the reference examples and error tables to investigate failed authorization or token requests.
中文简介正在准备中。当前显示英语简介。
Build server-side Zoom integrations for meeting scheduling, user management, and recording downloads. This reference guides API endpoint selection, OAuth authentication, request limits, and error diagnosis, with examples for automated workflows and event notifications.
中文简介正在准备中。当前显示英语简介。
Plan authentication for a Zoom integration by choosing an app type, selecting an authorization flow, and defining minimum permissions. Work through token storage, renewal, and authentication failures with a clear implementation approach.
中文简介正在准备中。当前显示英语简介。
Manage GBrain client registrations, permissions, and OAuth connections, a method for authorizing access. The skill separates server owner administration from ordinary client access and guides token invalidation, revocation, and connection verification.
中文简介正在准备中。当前显示英语简介。
Add sign-in to a Convex app with @convex-dev/auth. The skill sets up passkeys by default, generates authentication keys, connects server and client settings, adds a sign-in interface and route protection, and verifies a real login.
中文简介正在准备中。当前显示英语简介。
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
中文简介正在准备中。当前显示原文说明。
Use when designing, reviewing, or troubleshooting Salesforce connected apps, External Client Apps, Named Credentials, External Credentials, and OAuth-based integration access. Triggers: 'connected app', 'OAuth flow', 'client credentials', 'JWT bearer', 'Named Credential', 'External Credential', 'integration user', 'IP restrictions', 'connectedApp-meta.xml', 'ExternalClientApplication', 'ExtlClntAppOauthSettings', 'isAdminApproved', 'refreshTokenPolicy', 'ipRelaxation', 'consumer key', 'consumer secret', 'permittedUsersPolicyType'. NOT for OAuth error codes you are already seeing — use admin/connected-app-troubleshooting. NOT for External Credential principal-type setup steps — use integration/named-credentials-setup.
中文简介正在准备中。当前显示原文说明。
Connect Claude Code plugins to external services through MCP, a protocol that makes service functions available as tools. Covers connection types, configuration files, authentication, tool permissions, and testing for local servers and hosted services.
中文简介正在准备中。当前显示英语简介。
Investigate lateral movement, where attackers expand access across Azure identities and tenants. Correlate audit logs and unusual sign-ins, build Microsoft Sentinel detection queries, and report affected identities with recommended containment actions.
中文简介正在准备中。当前显示英语简介。
Build and debug Java applications with Spring Boot 3.x. This skill guides application design, API implementation, database query tuning, authentication, and testing, including WebFlux applications that process requests without blocking.
中文简介正在准备中。当前显示英语简介。
Build and maintain TypeScript MCP servers that connect AI to tools, plus interactive MCP Apps, using mcp-use. The skill guides implementation, authentication, migration, and verification based on the package version and types installed in the project.
中文简介正在准备中。当前显示英语简介。
Build and maintain TypeScript MCP servers that connect AI to tools, plus interactive MCP Apps, using mcp-use. The skill guides implementation, authentication, migration, and verification based on the package version and types installed in the project.
中文简介正在准备中。当前显示英语简介。