auth-review

Perform a defensive review of authentication and authorization flows in an authorized codebase. Use for login, session, MFA, OAuth, password reset, cookie security, JWT validation, impersonation, priv

SKILL.md

GitHub

Auth Review

Focus

  • login and logout correctness
  • session fixation and invalidation
  • cookie flags and token storage
  • reset, invite, recovery, and MFA flows
  • server-side authorization and object-level checks
  • impersonation, elevation, and admin escape hatches

Review prompts

  • Are checks enforced server-side on every sensitive action?
  • Does auth depend on user-controlled headers, origins, or claims?
  • Are session boundaries rotated after identity change?
  • Can one user access another user's objects through predictable identifiers?

Output

Use the Patchman findings format and call out auth assumptions explicitly.

Related in security

git-workflow

Git workflow guidance for commits, branches, and pull requests

by agno-agi
37,144

clerk-observability

Implement monitoring, logging, and observability for Clerk authentication. Use when setting up monitoring, debugging aut...

by jeremylongshore
1,061

juicebox-migration-deep-dive

Advanced Juicebox data migration strategies. Use when migrating from other recruiting platforms, performing bulk data im...

by jeremylongshore
1,061