hellodqy/mastermind-bug-bounty/oauth-sso
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Analyze OAuth/OIDC/SSO flows as identity-chain attack surfaces.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/oauth-ssoSKILL.md
OAuth / SSO
Goal
判断登录、授权、回调、token 交换和账号绑定流程是否能导致身份混淆、会话固定、越权登录或权限提升。
Tools / Inputs
- login URL、authorize URL、redirect_uri、state、code、id_token、callback
- 资源索引：
references/INDEX.md；候选资源：oauth-oidc-saml-testing.md；跨漏洞链路再读decision-trees.md
Constraints
- 只用测试账号验证身份链。
- 不修改真实用户绑定状态。
- 每个 OAuth 异常必须证明最终登录身份或权限变化。
- state/redirect/token 问题要串到实际账号影响。
- 发现新 token 后回注 API/JWT 测试。
Chain Questions
- 谁控制 redirect_uri、state、code、token、account binding？
- 是否能把攻击者会话绑定给受害者？
- 是否能把普通身份升级到管理员或企业身份？
- token 能不能调用后端 API？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/oauth_sso/SKILL.md
Popularity
- Repository stars
- 14
- Repository forks
- 1
- 7-day trend score
- 19
Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/oauth-sso)