The Agent Skills Directory

[SAFE]: The skill serves as a high-quality security guide for implementing OAuth 2.0. It correctly identifies and advises against legacy insecure patterns (e.g., Implicit Flow) and provides concrete implementations of modern security standards (PKCE with S256, random state validation).
[SAFE]: The provided code snippets follow security best practices. For example, the SPA implementation correctly uses in-memory token storage to mitigate XSS and sessionStorage for transient authentication state, while the server-side examples utilize established, audited libraries (openid-client, authlib).
[SAFE]: The audit checklist and 'Common Mistakes' sections actively educate the user on identifying security flaws such as open redirects, client secret leakage, and missing token validation.
[SAFE]: External references (Google, GitHub, Microsoft, Auth0) are to well-known, trusted identity providers and are used solely as examples of official integration endpoints.

oauth-flow