oauth-2-0-setup
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates a strong security posture by mandating the use of Proof Key for Code Exchange (PKCE), deprecating the insecure Implicit Flow, and implementing state-based CSRF protection.
- [DATA_EXFILTRATION]: The instructions and examples prioritize credential safety by recommending environment variables for secrets and secure, HTTP-only cookies for session management, while explicitly warning against storing tokens in insecure locations like localStorage.
- [COMMAND_EXECUTION]: The provided code examples utilize standard network libraries (Node.js fetch and Python requests) to interact with legitimate authentication provider endpoints as required for the OAuth 2.0 protocol.
Audit Metadata