Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From fuse-security
Audit authentication and authorization patterns. Checks JWT, sessions, OAuth2, PKCE implementations for security best practices and common vulnerabilities.
npx claudepluginhub fusengine/agents --plugin fuse-securityHow this skill is triggered — by the user, by Claude, or both
Slash command
/fuse-security:auth-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Comprehensive audit of authentication and authorization implementations.
Analyzes auth mechanisms (passwords/sessions/JWT/OAuth/MFA) and authz patterns (RBAC/ABAC/ACL) for vulnerabilities like bypasses, hijacking, broken access control; reports with OWASP/NIST remediation.
Audits authentication in web apps/APIs: password hashing, JWT handling, sessions, OAuth flows, MFA, and account controls against OWASP/NIST standards.
Analyzes authentication and authorization patterns (OAuth2, JWT, RBAC/ABAC, MFA), audits security posture against OWASP, and recommends improvements for token lifecycle, permission models, and multi-factor authentication.
Share bugs, ideas, or general feedback.
Comprehensive audit of authentication and authorization implementations.
| Category | Checks |
|---|---|
| JWT | Signing algo, expiration, refresh, storage |
| Sessions | Storage, expiry, regeneration, fixation |
| OAuth2 | PKCE, state param, redirect validation |
| Passwords | Hashing algo, strength rules, reset flow |
| MFA | Implementation, backup codes, recovery |
none algorithmstate parameter in OAuth flow