oauth-sso-attack

High-risk offensive skill. It is internally consistent with its stated purpose, but that purpose is to help an AI agent exploit OAuth/SSO flows, steal tokens/codes, and facilitate account takeover. No notable supply-chain concerns appear, but the exploit and exfiltration content makes the skill dangerous.

This JSON artifact is not executable software but an instruction set designed to elicit and provide actionable OAuth SSO exploitation payloads and step-by-step account takeover workflows. It contains explicit malicious guidance (redirect_uri bypass patterns, missing-state CSRF/account binding flow, and OAuth/email auto-merge takeover). No obfuscation is present, and there are no direct malware execution behaviors within the file; however, the artifact has a high security risk due to its intended facilitation of real attacks when consumed by automated tools or shared without strict controls.

The provided fragment is highly indicative of malicious OAuth manipulation: it auto-submits an OAuth-related form using attacker-controlled grant/code/client/redirect parameters, including an attacker-controlled redirect_uri, consistent with authorization-code/token theft or account takeover mechanics. However, because no actual package/library source code was supplied, this cannot be used to attribute behavior to a specific open-source dependency implementation.