h0p3sf4ll

Auth Review — Security skill for Claude Code

Security community

Deep-dive authentication and authorization security review: OAuth/OIDC, JWT, sessions, CSRF, MFA, RBAC, privilege escalation paths, and multi-tenancy isolation.

How to install Auth Review

Installs to ~/.claude/commands/h0p3sf4ll-threatlint-auth-review.md

Terminal

mkdir -p ~/.claude/commands && curl -fsSL https://raw.githubusercontent.com/h0p3sf4ll/threatlint/HEAD/.claude/commands/auth-review.md -o ~/.claude/commands/h0p3sf4ll-threatlint-auth-review.md

Restart Claude Code, or start a new session, for it to be picked up.

What Auth Review does

description: "Deep-dive authentication and authorization security review: OAuth/OIDC, JWT, sessions, CSRF, MFA, RBAC, privilege escalation paths, and multi-tenancy isolation. Saves a Word document." argument-hint: "Optional: specific auth component, file, or flow to focus on (default: full auth system)"

Delegate to the `appsec-auth-reviewer` agent. Pass any component name or file path as the review scope.

The agent will:

Map the complete authentication flow (token issuance, transmis

Alternatives in Security

MCP Security Checklist (SlowMist) — Comprehensive checklist: input validation, rate limiting, RBAC, credential management, container hardening 819 ★
ThinkWatch — Self-hosted AI API and MCP gateway for organizations: SSO and RBAC, per-user identity for MCP tool calls, PII 817 ★
API Contract Review — API platform contract review 83 ★