It runs a fixed workflow — detect the auth implementation, scan for known anti-patterns, verify cryptographic choices, check token/session lifecycle, and audit authorization logic (RBAC/ABAC) — checking for vulnerabilities such as JWT signed with none, undersized JWT secrets, missing/too-long token expiration, refresh tokens in localStorage, session fixation, missing CSRF protection, and OAuth flows missing PKCE or the state parameter.

Auth Audit Skill

Overview

Comprehensive audit of authentication and authorization implementations.