The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file references/java-spring-security-oauth.md contains a hardcoded signing key converter.setSigningKey("secret-key");. While clearly a placeholder, it represents an unsafe pattern in implementation logic.
[CREDENTIALS_UNSAFE]: The file references/python-flask-oidc.py includes a hardcoded RSA Private Key placeholder block within the source code.
[CREDENTIALS_UNSAFE]: The OIDCProvider initialization in references/python-flask-oidc.py registers a sample client with the hardcoded secret secret123.
[COMMAND_EXECUTION]: The file scripts/security-checklist.sh contains a series of commands designed to check a local system for authentication-related files, such as .env and config.json, which could be used to discover sensitive configuration data.

oauth-implementation