browser-auth-flow
Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md
Profile →npx skills add ruvnet/ruflo --skill browser-auth-flow --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Browser Auth Flow Adversarial probe of a site's authentication. Drives the login flow once, records the trajectory, then runs a configurable set of probes against the captured artifacts and live page. Output is a structured `findings.md` inside the RVF container. ## When to use - Pre-deployment audit of a new auth flow. - Investigating a suspected token leak or redirect issue. - Establishing a baseline for ongoing regression checks. ## Steps 1. **Open a recorded session** via `browser-record`. 2. **Drive the auth flow** as in `browser-login` (credentials come from `--credentials <handle>` referencing `browser-cookies` if the run is a re-auth probe). 3. **Run probes**: - **`csrf`**: inspect the login POST in the trajectory; verify a same-origin token field is present and non-empty. - **`redirect`**: watch `browser_get-url` after each nav for cross-origin redirects with auth state in the URL or fragment. Flag any token-bearing URL that crosses an origin boundary. - **`cookie`**: walk `document.cookie` via `browser_eval`. For each cookie, check `Secure`, `HttpOnly`, `SameSite`, expiry, and entropy of the value. Flag missing flags or short tokens. Pass each through `aidefence_scan` t
- When to use
- Steps
- Caveats
What does the browser-auth-flow skill do?
Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md
How do I install it?
Run `npx skills add ruvnet/ruflo --skill browser-auth-flow --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From ruvnet/ruflo, a repository with 67,015 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.