Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow or an access token carried in a URL. It leaves out the safe look-alikes, such as a state kept in a cookie and compared, an exact redirect match, a server-side client with a secret, and a token sent in a header. Use to review a login integration, to audit a single-page app before launch, or to check a gateway that handles redirects.
OAuth Redirect Flow Review is a tested SKILL.md that reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402.
Not for
Token signature checks, session storage after login, the setup of an identity provider, SAML and password forms. It reads the pasted code of one sign-in flow and judges only what is written in it.
Tested, honestly
Tested 2026-10-26 with a strong and a weak model.
- SonnetStrong model, claude-sonnet-5-5
- Right on all 3 cases, read by hand. On the gateway it found the state cookie that is set and never compared and the redirect matched by prefix, and left out the missing PKCE of a client that holds a secret. On the browser orders app it found the absent PKCE challenge and the access token in a query string, and left out the state kept in sessionStorage and the exact redirect constant. On the clean billing app it answered exactly No findings.
- HaikuWeak model, claude-haiku-5-5
- Right on both planted files, with sound fixes, keeping the confidential client, the sessionStorage state and the exact redirect out of its list. On the first run of the clean billing app it added one STATE-UNCHECKED line, because a returned state and a stored value that are both null would compare equal, and that edge really was in our clean input. The input was then corrected (a missing stored value is rejected) and only that case was run again: Haiku answered exactly No findings. Counted as 2 of 3 on the first run, 3 of 3 after the corrected input.
Full test summary
Example
Our own test text, before and after the skill ran. Excerpts only.
English · claude-sonnet-5-5
Before
const express = require('express');
const crypto = require('node:crypto');
const app = express();
const AUTH_URL = 'https://id.example.com/authorize';
const TOKEN_URL = 'https://id.example.com/token';
const REGISTERED = [
'https://app.example.com/callback',
'https://admin.example.com/callback',
];
app.get('/login', (req, res) => {…
After
STATE-UNCHECKED — `/callback`, never reads `req.query.state` or the `oauth_state` cookie set in `/login` — an attacker can send the victim's browser a callback carrying the attacker's code and complete a login as the wrong account — read the cookie in `/callback`, compare it to `req.query.state`, reject on mismatch, then clear the cookie…
What is in the file
- What the standards say, as published on 26 October 2026
- The answer
- The codes
- Rules
- Work in this order
- Short example
Languages
English. Tried in: English.
License
Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.
Versions
Current version 1.0.0, updated 2026-10-26. Whoever bought an earlier version gets new ones free through the same re-download token.
v1.0.0 · 2026-10-26
First release, written in the light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.
Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.
After the first runs: the clean test input was corrected (it did not reject a missing stored state) and that case was run again on both models; the skill rules are unchanged.
FAQ
Server-side client with a secret and no PKCE: reported?
No. The line is for clients that cannot keep a secret, such as browser or mobile apps. A web server that authenticates to the token endpoint with its own secret is left alone, as the best-practice document asks PKCE of public clients.
State saved in sessionStorage: reported?
No. A saved per-session value that is compared with the returned one before the code is used is the accepted form; the place can be a cookie, the server session or sessionStorage. A state that is set and never compared does earn a line.
Which flows went into the test?
Three code samples we wrote ourselves. First, an Express gateway that sets a state cookie but never reads it back and matches redirects by prefix. Second, a browser app with no PKCE that puts its token in a query string. Third, a correct browser app. Each model was given every sample one time.
What does a sound flow return?
A single short sentence, No findings., and nothing beside it. Each real mistake is reported on its own line giving code, function, damage and repair, and the parts that were read and judged fine stay unmentioned.