skills/mukul975/anthropic-cybersecurity-skills/exploiting-oauth-misconfiguration/Gen Agent Trust Hub
exploiting-oauth-misconfiguration
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Python script (
scripts/agent.py) and variouscurlcommands intended to automate the security assessment of OAuth 2.0 and OpenID Connect endpoints. - [EXTERNAL_DOWNLOADS]: The
scripts/agent.pytool requires therequestspackage, which is a standard and well-known library from the official Python Package Index (PyPI). - [COMMAND_EXECUTION]: In
scripts/agent.py, therequestslibrary is used withverify=Falseacross its functions (e.g.,discover_oidc_config,test_redirect_uri_bypasses). This disables SSL/TLS certificate verification, which is a common practice in penetration testing tools to ensure compatibility with development or lab environments, though it is a deviation from general security best practices.
Audit Metadata