--- name: browser-auth-flow-9e913c4cff53 description: Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md argument-hint: " [--credentials ] [--probes csrf,redirect,cookie,oauth]" allowed-tools: mcp__claude-flow__browser_open mcp__claude-flow__browser_close mcp__claude-flow__browser_fill mcp__claude-flow__browser_type mcp__claude-flow__browser_click mcp__claude-flow__browser_wait mcp__claude-flow__browser_eval mcp__claude-flow__browser_snapshot mcp__claude-flow__browser_get-url mcp__claude-flow__aidefence_has_pii mcp__claude-flow__aidefence_scan Bash Read Write --- # Browser Auth Flow Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured `findings.md` inside the RVF container. ## When to use - Pre-deployment audit of a new auth flow. - Investigating a suspected token leak or redirect issue. - Establishing a baseline for ongoing regression checks. ## Steps 1. **Open a recorded session** via `browser-record`. 2. **Drive the auth flow** as in `browser-login` (credentials come from `--credentials ` referencing `browser-cookies` if the run is a re-auth probe). 3. **Run probes**: - **`csrf`**: inspect the login POST in the trajectory; verify a same-origin token field is present and non-empty. - **`redirect`**: watch `browser_get-url` after each nav for cross-origin redirects with auth state in the URL or fragment. Flag any token-bearing URL that crosses an origin boundary. - **`cookie`**: walk `document.cookie` via `browser_eval`. For each cookie, check `Secure`, `HttpOnly`, `SameSite`, expiry, and entropy of the value. Flag missing flags or short tokens. Pass each through `aidefence_scan` to flag PII embedded in cookie values. - **`oauth`**: if the flow involves a third-party provider, capture the authorization request, verify `state` and `nonce` are present and high-entropy, verify `redirect_uri` matches the registered callback domain. 4. **Quarantine** any token / credential / PII captured during probing — it stays inside the RVF container's findings, never returns to the model unredacted (`aidefence_is_safe` gate from `browser-extract` applies if you read the findings back). 5. **Write `findings.md`** with one section per probe, severity rating per finding, and a `verdict` (pass / warn / fail). 6. **Index** the session in `browser-sessions` with `tag: auth-probe` so future audits compare against it. ## Caveats - This skill probes; it does not exploit. Do not chain follow-up requests using a captured token. - Credentials must come from a vaulted handle or interactive entry. Never hardcode them in the field map. - Some probes require multiple page loads. Trajectory step count for an auth probe typically lands at 15–40 steps; budget accordingly. - The output is structured for human review. Do not auto-act on findings without surfacing them to the user first. --- Source attribution: digitalcrest01 Original project: https://github.com/digitalcrest01/ruflow/blob/8f78f238e1775aedf7faa6026b5f20c9aa8cbd12/plugins/ruflo-browser/skills/browser-auth-flow/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Copyright (c) 2024-2026 ruvnet Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: digitalcrest01 Original project: https://github.com/digitalcrest01/ruflow/blob/8f78f238e1775aedf7faa6026b5f20c9aa8cbd12/plugins/ruflo-browser/skills/browser-auth-flow/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: DevOps / SRE, QA / Test Engineer, Security Engineer Specialties: API, Testing Tools: Bash, Mcp__Claude Flow__Aidefence_Has_Pii, Mcp__Claude Flow__Aidefence_Scan, Mcp__Claude Flow__Browser_Click, Mcp__Claude Flow__Browser_Close, Mcp__Claude Flow__Browser_Eval, Mcp__Claude Flow__Browser_Fill, Mcp__Claude Flow__Browser_Get Url, Mcp__Claude Flow__Browser_Open, Mcp__Claude Flow__Browser_Snapshot, Mcp__Claude Flow__Browser_Type, Mcp__Claude Flow__Browser_Wait Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: e15659805ae70fc0f629821e72d2d6bfc24916219bf638c8414ce4b959ecd885