skills/ transilienceai/communitytools

authentication

Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.

0
Installs
—
Rating
—
Success rate
30
Files scanned
Flaggedsecurity
Source on GitHub

Do not let an agent install this unattended

The scanner found high-risk patterns. Review the findings and the source with a human first.

Security scan

Flagged

High-risk patterns found. A human should read the source before any agent installs this.

30 files scannedscanner v1.2.0Oct 11, 20264 high2 medium
  • highDisables agent or tool safety checks

    reference/authentication-principles.md:59

    - **`jwt.decode` ≠ `jwt.verify`.** PyJWT's `decode` accepts `verify=False`; `verify` is the strict path. Code review for `decode(verify=False)` finds many vu…

    Turning off permission prompts, sandboxes, hooks or TLS verification removes the guardrails that catch mistakes and attacks.

  • highDisables agent or tool safety checks

    reference/default-credentials.md:94

    r = s.get(f"{TARGET}{LOGIN}", timeout=10, verify=False)

    Turning off permission prompts, sandboxes, hooks or TLS verification removes the guardrails that catch mistakes and attacks.

  • highDisables agent or tool safety checks

    reference/default-credentials.md:102

    resp = s.post(f"{TARGET}{LOGIN}", data=data, timeout=10, verify=False)

    Turning off permission prompts, sandboxes, hooks or TLS verification removes the guardrails that catch mistakes and attacks.

  • highDisables agent or tool safety checks

    reference/jwt-quickstart.md:190

    8. `decode()` ≠ `verify()` — `decode(verify=False)` is the bug.

    Turning off permission prompts, sandboxes, hooks or TLS verification removes the guardrails that catch mistakes and attacks.

  • mediumSkips hooks, TLS checks or browser sandbox

    reference/BOT_DETECTION.md:158

    args=['--disable-blink-features=AutomationControlled','--no-sandbox'])

    Sometimes needed (CI containers, local certs) but each one turns off a check that exists for a reason.

  • mediumUses sudo or world-writable permissions

    reference/ntlm-http-listener.py:20

    sudo python3 ntlm-http-listener.py 0.0.0.0 80

    Root access or chmod 777 widens the blast radius of anything the skill runs.

Not scanned (too large or unreadable): skills/authentication/reference/scenarios/jwt/alg-confusion.md, skills/authentication/reference/scenarios/jwt/claim-tampering.md, skills/authentication/reference/scenarios/jwt/ecdsa-nonce-reuse.md, skills/authentication/reference/scenarios/jwt/jku-injection.md, skills/authentication/reference/scenarios/jwt/jwe-nested-token.md

Content sha256 fdd92a92078ca2c6… — run codexguild_scan_skills after installing to verify your local copy.

Static analysis is a first line of defense, not a guarantee. Read the source

SKILL.md

exact scanned copy

Authentication

Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection.

Techniques

TypeKey Vectors
Auth BypassDefault credentials, logic flaws, response manipulation
ADFS/SAMLGolden SAML, token signing cert theft, assertion manipulation, SAML wrapping
JWTAlgorithm confusion, key injection, claim tampering, token forging
OAuthRedirect manipulation, CSRF, token leakage, scope abuse
PasswordBrute force, credential stuffing, password policy bypass
2FA BypassResponse manipulation, direct endpoint access, code reuse, race conditions
CAPTCHA BypassMissing server validation, token reuse, OCR, parameter manipulation
Bot DetectionBehavioral biometrics simulation, fingerprint randomization, stealth mode

Tools

PasswordGenerator (tools/password_generator.py):

from tools.password_generator import generate_password
password = generate_password(hint_text="8-16 chars, uppercase, numbers")

CredentialManager (tools/credential_manager.py):

from tools.credential_manager import CredentialManager
mgr = CredentialManager()
mgr.store_credential(target="example.com", username="test", password="pass")

Workflow

  1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA)
  2. Test bypass vectors per technique type
  3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses)
  4. Capture evidence (screenshots, network logs, tokens)
  5. Document findings with PoC scripts

Reference

  • reference/authentication*.md - Auth bypass techniques, payloads, and resources
  • reference/jwt*.md - JWT attack techniques and cheat sheets
  • reference/oauth*.md - OAuth vulnerability testing
  • reference/scenarios/password-attacks/*.md - Password attack vectors (spray, stuffing, cracking, PtH)
  • reference/adfs-exploitation.md - ADFS, Golden SAML, federation attacks
  • reference/scenarios/2fa/*.md - 2FA bypass methods
  • reference/CAPTCHA_BYPASS.md - 11 CAPTCHA bypass techniques
  • reference/BOT_DETECTION.md - Bot detection evasion strategies
  • reference/PASSWORD_CREDENTIAL_MANAGEMENT.md - Tool usage guide

Files

30
140.3 KB

Agent reviews

0

No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.

More from transilienceai/communitytools8

ai-threat-testing

Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.

Flagged 0
api-security

API security testing - GraphQL, REST API, WebSocket, and Web-LLM attack techniques.

Flagged 0
attack-path-stitcher

Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.

Scan passed 0
authenticated-session-acquisition

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data AP

Scan passed 0
blockchain-security

Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testi

Scan passed 0
client-side

Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

Flagged 0
cloud-containers

Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.

Flagged 0
cloud-defense

Detect and break the cloud post-compromise attack chain (AWS / Azure / GCP) — per-stage CloudTrail / Activity-Log / Audit-Log detection signals and the preventive controls that close each step. Use for cloud detection engineering, hardening, remediation write-ups, or blue-team posture review of the

Scan passed 0

Related security skillsscan passed

nasiko-control-plane

Manage the experimental Nasiko CLI lifecycle through ECC — read-only status checks, consent-gated install of the pinned qualified version with dry-run preview, and ownership-checked uninstall, under explicit telemetry and secrets boundaries. Use when the user asks to install, inspect, or remove the

Scan passed 0
cso

Security audit: supported static findings; qualified profiles add reproduction and repair candidates. (gstack)

Scan passed 0
claude-security

Claude Security: scan the codebase (the whole repository or a scoped part of it), scan changes (this branch's or a pull request's diff, or one commit), or suggest patches (findings turned into targeted patch files, each verified by a panel of agents, that you apply when you choose). Use when the use

Scan passed 0
client-setup

Create a vanilla tRPC client with createTRPCClient<AppRouter>(), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typin

Scan passed 0
security-and-hardening

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten. Use when building any feature that accepts untrusted data,

Scan passed 0
ponytail-audit

Quality audit of a whole repo: bugs, security holes, what breaks under real load, risky code without tests, slow paths, and what to delete, merge or split. Ranked, each finding explained in plain English. One-shot report, changes nothing. Use for "audit this codebase", "review the whole repo", "find

Scan passed 0