mtecoyy/ai-baike/saml-sso-assertion-attacks

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.

Install

npx vskill@latest install mtecoyy/ai-baike/saml-sso-assertion-attacks

SKILL.md

The same SKILL.md was published earlier as yaklang/hack-skills/saml-sso-assertion-attacks.

SKILL: SAML SSO and Assertion Attacks — Signature Validation, Binding, and Trust Confusion

AI LOAD INSTRUCTION: Use this skill when the target uses SAML-based SSO and you need to validate assertion trust: signature coverage, audience and recipient checks, ACS handling, XML parsing weaknesses, and IdP/SP confusion.

1. WHEN TO LOAD THIS SKILL

Load when:

  • Enterprise SSO uses SAML requests or responses
  • You see SAMLRequest, SAMLResponse, XML assertions, or ACS endpoints
  • Login flows involve an external IdP and browser POST/redirect binding

2. HIGH-VALUE MISCONFIGURATION CHECKS

ThemeWhat to Check
signature validationunsigned assertion accepted, wrong node signed, signature wrapping
audience and recipientweak Audience, Recipient, Destination, or ACS validation
issuer trustwrong IdP accepted or multi-tenant issuer confusion
replay and freshnessmissing InResponseTo, weak NotBefore / NotOnOrAfter enforcement
account mappingemail-only binding, case folding, unverified attributes
XML parser behaviorXXE-like parser issues or unsafe transforms around SAML documents

3. QUICK TRIAGE

  1. Capture one full login round trip.
  2. Inspect which XML nodes are signed and which attributes drive account binding.
  3. Compare SP-initiated and IdP-initiated flows.
  4. Test replay, altered attributes, and assertion placement confusion.

4. RELATED ROUTES

Security

  • Security scanPassed, 90 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
22
Repository forks
4
7-day trend score
21

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/mtecoyy/ai-baike/saml-sso-assertion-attacks/badge)](https://verified-skill.com/skills/mtecoyy/ai-baike/saml-sso-assertion-attacks)

Something wrong with this skill or its page? Tell us.