auth-audit
Auth Audit Skill
Overview
Comprehensive audit of authentication and authorization implementations.
Audit Categories
| Category | Checks |
|---|---|
| JWT | Signing algo, expiration, refresh, storage |
| Sessions | Storage, expiry, regeneration, fixation |
| OAuth2 | PKCE, state param, redirect validation |
| Passwords | Hashing algo, strength rules, reset flow |
| MFA | Implementation, backup codes, recovery |
Workflow
- Detect auth implementation (JWT, sessions, OAuth)
- Scan for known anti-patterns
- Verify cryptographic choices
- Check token/session lifecycle
- Audit authorization logic (RBAC, ABAC)
Common Vulnerabilities
- JWT signed with
nonealgorithm - JWT secret too short (< 256 bits)
- No token expiration or too long
- Refresh tokens stored in localStorage
- Session fixation after login
- Missing CSRF protection
- OAuth without PKCE for public clients
- Missing
stateparameter in OAuth flow
References
More from fusengine/agents
laravel-architecture
Design Laravel app architecture with services, repositories, actions, and clean code patterns. Use when structuring projects, creating services, implementing DI, or organizing code layers.
97laravel-blade
Create Blade templates with components, slots, layouts, and directives. Use when building views, reusable components, or templating.
88laravel-livewire
Livewire 3 reactive components - wire:model, actions, events, Volt, Folio. Use when building reactive UI without JavaScript.
86nextjs-i18n
Next.js 16 internationalization with next-intl or DIY. Use when implementing i18n, translations, localization, multilingual, language switch, locale routing, or formatters.
59solid-php
SOLID principles for Laravel 12 and PHP 8.5. Files < 100 lines, interfaces separated, PHPDoc mandatory. Auto-detects Laravel and FuseCore architecture.
51laravel-testing
Write tests with Pest 3/PHPUnit, feature tests, unit tests, mocking, fakes, and factories. Use when testing controllers, services, models, or implementing TDD.
50