auth-analyzer
Analyzes authentication and authorization patterns to identify security vulnerabilities and provide remediation guidance.
Install this skill
Security score
The auth-analyzer skill was audited on Feb 9, 2026 and we found 27 security issues across 5 threat categories, including 9 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 611 | const fakeToken = `header.${base64Payload}.fakesignature`; |
Template literal with variable interpolation in command context
| 616 | 'Authorization': `Bearer ${fakeToken}` |
Template literal with variable interpolation in command context
| 849 | sendEmail(user.email, `Reset link: /reset?token=${resetToken}`); |
Template literal with variable interpolation in command context
| 907 | const resetURL = `https://example.com/reset?token=${resetToken}`; |
Template literal with variable interpolation in command context
| 908 | await sendEmail(user.email, `Reset link (expires in 15min): ${resetURL}`); |
Template literal with variable interpolation in command context
| 990 | return `${req.ip}-${req.body.email}`; |
Curl to non-GitHub URL
| 695 | curl -X PUT https://api.example.com/api/users/456 \ |
Curl to non-GitHub URL
| 701 | curl https://api.example.com/api/orders/$i \ |
Curl to non-GitHub URL
| 972 | curl -X POST https://example.com/api/login \ |
Fetch to external URL
| 614 | fetch('/api/admin/users', { |
Access to .env file
| 112 | secret: process.env.SESSION_SECRET, // Strong, random secret |
Access to .env file
| 174 | process.env.JWT_SECRET, // Strong secret (256+ bits) |
Access to .env file
| 187 | process.env.REFRESH_TOKEN_SECRET, |
Access to .env file
| 197 | return jwt.verify(token, process.env.JWT_SECRET, { |
Access to .env file
| 263 | clientID: process.env.OAUTH_CLIENT_ID, |
Access to .env file
| 264 | clientSecret: process.env.OAUTH_CLIENT_SECRET, |
Access to .env file
| 642 | const payload = jwt.verify(token, process.env.JWT_SECRET, { |
Access to .env file
| 1085 | const JWT_SECRET = process.env.JWT_SECRET; |
Buffer.from base64 decode
| 248 | const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64')); |
Buffer.from base64 decode
| 587 | Buffer.from(token.split('.')[1], 'base64').toString() |
External URL reference
| 261 | authorizationURL: 'https://provider.com/oauth/authorize', |
External URL reference
| 262 | tokenURL: 'https://provider.com/oauth/token', |
External URL reference
| 265 | callbackURL: 'https://example.com/auth/callback', |
External URL reference
| 695 | curl -X PUT https://api.example.com/api/users/456 \ |
External URL reference
| 701 | curl https://api.example.com/api/orders/$i \ |
External URL reference
| 907 | const resetURL = `https://example.com/reset?token=${resetToken}`; |
External URL reference
| 972 | curl -X POST https://example.com/api/login \ |