skills/mukul975/anthropic-cybersecurity-skills/testing-oauth2-implementation-flaws/Gen Agent Trust Hub
testing-oauth2-implementation-flaws
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the Python
requestslibrary to fetch configuration data from OpenID Connect discovery endpoints and to test the behavior of OAuth authorization and token servers. - [COMMAND_EXECUTION]: Provides a Python script (
scripts/agent.py) and code snippets to automate network probing and vulnerability testing against target OAuth implementations. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external authorization servers during the discovery phase.
- Ingestion points: JSON data retrieved from
/.well-known/openid-configurationinSKILL.mdandscripts/agent.py. - Boundary markers: None.
- Capability inventory: Network GET and POST requests via the
requestslibrary. - Sanitization: Standard JSON parsing is used, but the content is not further sanitized before being printed or used in subsequent requests.
Audit Metadata