Creator · transilienceai
Last updated · Sep 5, 2026
Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
Creator · transilienceai
Last updated · Sep 5, 2026
Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
Creator · transilienceai
Last updated · Sep 5, 2026
Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
Creator · transilienceai
Last updated · Sep 5, 2026
Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.
Sandbox only
Install targets
Codex install prompt
Install the "authentication" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/authentication. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"transilienceai-authentication","task":"Install authentication","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add transilienceai/communitytools --skill authentication
Maintenance
active
1mo since push
Risk
Needs review
Permission surface may require sandboxing
GitHub quality
509
67/100 Quality · 70/100 Trust
Coverage tags
Review notes
Permission surface may require sandboxing · The skill does not include an explicit authorization or legal-use disclaimer, which is important for offensive security content.
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
PromisingUseful candidate, but compare it with alternatives before adopting.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
509 GitHub stars
Repo activity
509 stars, 75 forks
Maintenance
1mo since push
License
MIT
Install
npx skills add transilienceai/communitytools --skill authentication
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add transilienceai/communitytools --skill authenticationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/transilienceai-authentication/install
Agent should check
Copy prompt
Task: Use authentication in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/transilienceai-authentication/install
Install command: npx skills add transilienceai/communitytools --skill authentication
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/transilienceai-authentication/install
LLM text format
/api/skills/transilienceai-authentication/install?format=text
Find alternatives
/api/skills/search?q=authentication&limit=3
Agent prompt
Use authentication for this task. Review https://www.openagentskill.com/api/skills/transilienceai-authentication/install, then install with: npx skills add transilienceai/communitytools --skill authenticationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/transilienceai-authentication
LLM text
/api/registry/manifest/transilienceai-authentication?format=text
Install alias
/api/registry/install/transilienceai-authentication
Recommend
/api/registry/recommend?task=Use%20authentication%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Browser automation
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO509 GitHub stars
Stars/forks activity
INFO509 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS1mo since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Useful candidate, but compare it with alternatives before adopting.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Ingest, retrieve, and cite
A workflow for document-heavy agents that ingest files, create searchable knowledge, retrieve relevant context, and answer with grounded sources.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: authentication description: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. ---
# Authentication
Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection.
## Techniques
| Type | Key Vectors | |------|-------------| | **Auth Bypass** | Default credentials, logic flaws, response manipulation | | **ADFS/SAML** | Golden SAML, token signing cert theft, assertion manipulation, SAML wrapping | | **JWT** | Algorithm confusion, key injection, claim tampering, token forging | | **OAuth** | Redirect manipulation, CSRF, token leakage, scope abuse | | **Password** | Brute force, credential stuffing, password policy bypass | | **2FA Bypass** | Response manipulation, direct endpoint access, code reuse, race conditions | | **CAPTCHA Bypass** | Missing server validation, token reuse, OCR, parameter manipulation | | **Bot Detection** | Behavioral biometrics simulation, fingerprint randomization, stealth mode |
## Tools
**PasswordGenerator** (`tools/password_generator.py`): ```python from tools.password_generator import generate_password password = generate_password(hint_text="8-16 chars, uppercase, numbers") ```
**CredentialManager** (`tools/credential_manager.py`): ```python from tools.credential_manager import CredentialManager mgr = CredentialManager() mgr.store_credential(target="example.com", username="test", password="pass") ```
## Workflow
1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA) 2. Test bypass vectors per technique type 3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses) 4. Capture evidence (screenshots, network logs, tokens) 5. Document findings with PoC scripts
## Reference
- `reference/authentication*.md` - Auth bypass techniques, payloads, and resources - `reference/jwt*.md` - JWT attack techniques and cheat sheets - `reference/oauth*.md` - OAuth vulnerability testing - `reference/scenarios/password-attacks/*.md` - Password attack vectors (spray, stuffing, cracking, PtH) - `reference/adfs-exploitation.md` - ADFS, Golden SAML, federation attacks - `reference/scenarios/2fa/*.md` - 2FA bypass methods - `reference/CAPTCHA_BYPASS.md` - 11 CAPTCHA bypass techniques - `reference/BOT_DETECTION.md` - Bot detection evasion strategies - `reference/PASSWORD_CREDENTIAL_MANAGEMENT.md` - Tool usage guide
Source provenance
Decision snapshot
509 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for authentication, ready for a manual X post.
A practical pick for the next repo task: authentication: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and... 509 stars https://www.openagentskill.com/skills/transilienceai-authentication?ref=x
Listing + install path for authentication: https://www.openagentskill.com/skills/transilienceai-authentication?ref=x Install: npx skills add transilienceai/communitytools --skill authentication
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to transilienceai but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication/audit)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)transilienceai
@transilienceai
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "authentication" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/authentication. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"transilienceai-authentication","task":"Install authentication","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add transilienceai/communitytools --skill authentication
Maintenance
active
1mo since push
Risk
Needs review
Permission surface may require sandboxing
GitHub quality
509
67/100 Quality · 70/100 Trust
Coverage tags
Review notes
Permission surface may require sandboxing · The skill does not include an explicit authorization or legal-use disclaimer, which is important for offensive security content.
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
PromisingUseful candidate, but compare it with alternatives before adopting.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
509 GitHub stars
Repo activity
509 stars, 75 forks
Maintenance
1mo since push
License
MIT
Install
npx skills add transilienceai/communitytools --skill authentication
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add transilienceai/communitytools --skill authenticationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/transilienceai-authentication/install
Agent should check
Copy prompt
Task: Use authentication in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/transilienceai-authentication/install
Install command: npx skills add transilienceai/communitytools --skill authentication
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/transilienceai-authentication/install
LLM text format
/api/skills/transilienceai-authentication/install?format=text
Find alternatives
/api/skills/search?q=authentication&limit=3
Agent prompt
Use authentication for this task. Review https://www.openagentskill.com/api/skills/transilienceai-authentication/install, then install with: npx skills add transilienceai/communitytools --skill authenticationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/transilienceai-authentication
LLM text
/api/registry/manifest/transilienceai-authentication?format=text
Install alias
/api/registry/install/transilienceai-authentication
Recommend
/api/registry/recommend?task=Use%20authentication%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Browser automation
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO509 GitHub stars
Stars/forks activity
INFO509 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS1mo since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Useful candidate, but compare it with alternatives before adopting.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Ingest, retrieve, and cite
A workflow for document-heavy agents that ingest files, create searchable knowledge, retrieve relevant context, and answer with grounded sources.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: authentication description: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. ---
# Authentication
Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection.
## Techniques
| Type | Key Vectors | |------|-------------| | **Auth Bypass** | Default credentials, logic flaws, response manipulation | | **ADFS/SAML** | Golden SAML, token signing cert theft, assertion manipulation, SAML wrapping | | **JWT** | Algorithm confusion, key injection, claim tampering, token forging | | **OAuth** | Redirect manipulation, CSRF, token leakage, scope abuse | | **Password** | Brute force, credential stuffing, password policy bypass | | **2FA Bypass** | Response manipulation, direct endpoint access, code reuse, race conditions | | **CAPTCHA Bypass** | Missing server validation, token reuse, OCR, parameter manipulation | | **Bot Detection** | Behavioral biometrics simulation, fingerprint randomization, stealth mode |
## Tools
**PasswordGenerator** (`tools/password_generator.py`): ```python from tools.password_generator import generate_password password = generate_password(hint_text="8-16 chars, uppercase, numbers") ```
**CredentialManager** (`tools/credential_manager.py`): ```python from tools.credential_manager import CredentialManager mgr = CredentialManager() mgr.store_credential(target="example.com", username="test", password="pass") ```
## Workflow
1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA) 2. Test bypass vectors per technique type 3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses) 4. Capture evidence (screenshots, network logs, tokens) 5. Document findings with PoC scripts
## Reference
- `reference/authentication*.md` - Auth bypass techniques, payloads, and resources - `reference/jwt*.md` - JWT attack techniques and cheat sheets - `reference/oauth*.md` - OAuth vulnerability testing - `reference/scenarios/password-attacks/*.md` - Password attack vectors (spray, stuffing, cracking, PtH) - `reference/adfs-exploitation.md` - ADFS, Golden SAML, federation attacks - `reference/scenarios/2fa/*.md` - 2FA bypass methods - `reference/CAPTCHA_BYPASS.md` - 11 CAPTCHA bypass techniques - `reference/BOT_DETECTION.md` - Bot detection evasion strategies - `reference/PASSWORD_CREDENTIAL_MANAGEMENT.md` - Tool usage guide
Source provenance
Decision snapshot
509 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for authentication, ready for a manual X post.
A practical pick for the next repo task: authentication: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and... 509 stars https://www.openagentskill.com/skills/transilienceai-authentication?ref=x
Listing + install path for authentication: https://www.openagentskill.com/skills/transilienceai-authentication?ref=x Install: npx skills add transilienceai/communitytools --skill authentication
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to transilienceai but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication/audit)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)transilienceai
@transilienceai
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "authentication" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/authentication. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"transilienceai-authentication","task":"Install authentication","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add transilienceai/communitytools --skill authentication
Maintenance
active
1mo since push
Risk
Needs review
Permission surface may require sandboxing
GitHub quality
509
67/100 Quality · 70/100 Trust
Coverage tags
Review notes
Permission surface may require sandboxing · The skill does not include an explicit authorization or legal-use disclaimer, which is important for offensive security content.
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
PromisingUseful candidate, but compare it with alternatives before adopting.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
509 GitHub stars
Repo activity
509 stars, 75 forks
Maintenance
1mo since push
License
MIT
Install
npx skills add transilienceai/communitytools --skill authentication
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add transilienceai/communitytools --skill authenticationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/transilienceai-authentication/install
Agent should check
Copy prompt
Task: Use authentication in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/transilienceai-authentication/install
Install command: npx skills add transilienceai/communitytools --skill authentication
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/transilienceai-authentication/install
LLM text format
/api/skills/transilienceai-authentication/install?format=text
Find alternatives
/api/skills/search?q=authentication&limit=3
Agent prompt
Use authentication for this task. Review https://www.openagentskill.com/api/skills/transilienceai-authentication/install, then install with: npx skills add transilienceai/communitytools --skill authenticationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/transilienceai-authentication
LLM text
/api/registry/manifest/transilienceai-authentication?format=text
Install alias
/api/registry/install/transilienceai-authentication
Recommend
/api/registry/recommend?task=Use%20authentication%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Browser automation
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO509 GitHub stars
Stars/forks activity
INFO509 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS1mo since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Useful candidate, but compare it with alternatives before adopting.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Ingest, retrieve, and cite
A workflow for document-heavy agents that ingest files, create searchable knowledge, retrieve relevant context, and answer with grounded sources.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: authentication description: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. ---
# Authentication
Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection.
## Techniques
| Type | Key Vectors | |------|-------------| | **Auth Bypass** | Default credentials, logic flaws, response manipulation | | **ADFS/SAML** | Golden SAML, token signing cert theft, assertion manipulation, SAML wrapping | | **JWT** | Algorithm confusion, key injection, claim tampering, token forging | | **OAuth** | Redirect manipulation, CSRF, token leakage, scope abuse | | **Password** | Brute force, credential stuffing, password policy bypass | | **2FA Bypass** | Response manipulation, direct endpoint access, code reuse, race conditions | | **CAPTCHA Bypass** | Missing server validation, token reuse, OCR, parameter manipulation | | **Bot Detection** | Behavioral biometrics simulation, fingerprint randomization, stealth mode |
## Tools
**PasswordGenerator** (`tools/password_generator.py`): ```python from tools.password_generator import generate_password password = generate_password(hint_text="8-16 chars, uppercase, numbers") ```
**CredentialManager** (`tools/credential_manager.py`): ```python from tools.credential_manager import CredentialManager mgr = CredentialManager() mgr.store_credential(target="example.com", username="test", password="pass") ```
## Workflow
1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA) 2. Test bypass vectors per technique type 3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses) 4. Capture evidence (screenshots, network logs, tokens) 5. Document findings with PoC scripts
## Reference
- `reference/authentication*.md` - Auth bypass techniques, payloads, and resources - `reference/jwt*.md` - JWT attack techniques and cheat sheets - `reference/oauth*.md` - OAuth vulnerability testing - `reference/scenarios/password-attacks/*.md` - Password attack vectors (spray, stuffing, cracking, PtH) - `reference/adfs-exploitation.md` - ADFS, Golden SAML, federation attacks - `reference/scenarios/2fa/*.md` - 2FA bypass methods - `reference/CAPTCHA_BYPASS.md` - 11 CAPTCHA bypass techniques - `reference/BOT_DETECTION.md` - Bot detection evasion strategies - `reference/PASSWORD_CREDENTIAL_MANAGEMENT.md` - Tool usage guide
Source provenance
Decision snapshot
509 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for authentication, ready for a manual X post.
A practical pick for the next repo task: authentication: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and... 509 stars https://www.openagentskill.com/skills/transilienceai-authentication?ref=x
Listing + install path for authentication: https://www.openagentskill.com/skills/transilienceai-authentication?ref=x Install: npx skills add transilienceai/communitytools --skill authentication
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to transilienceai but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication/audit)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)transilienceai
@transilienceai
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "authentication" agent skill from https://github.com/transilienceai/communitytools/tree/main/skills/authentication. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"transilienceai-authentication","task":"Install authentication","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add transilienceai/communitytools --skill authentication
Maintenance
active
1mo since push
Risk
Needs review
Permission surface may require sandboxing
GitHub quality
509
67/100 Quality · 70/100 Trust
Coverage tags
Review notes
Permission surface may require sandboxing · The skill does not include an explicit authorization or legal-use disclaimer, which is important for offensive security content.
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
PromisingUseful candidate, but compare it with alternatives before adopting.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
509 GitHub stars
Repo activity
509 stars, 75 forks
Maintenance
1mo since push
License
MIT
Install
npx skills add transilienceai/communitytools --skill authentication
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add transilienceai/communitytools --skill authenticationDo not use when
Agent safety v2
Sparse or mixed signals. Useful for discovery, but not for autonomous installation.
Test manually in an isolated workspace and compare against safer alternatives.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/transilienceai-authentication/install
Agent should check
Copy prompt
Task: Use authentication in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20authentication%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/transilienceai-authentication/install
Install command: npx skills add transilienceai/communitytools --skill authentication
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/transilienceai-authentication/install
LLM text format
/api/skills/transilienceai-authentication/install?format=text
Find alternatives
/api/skills/search?q=authentication&limit=3
Agent prompt
Use authentication for this task. Review https://www.openagentskill.com/api/skills/transilienceai-authentication/install, then install with: npx skills add transilienceai/communitytools --skill authenticationRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/transilienceai-authentication
LLM text
/api/registry/manifest/transilienceai-authentication?format=text
Install alias
/api/registry/install/transilienceai-authentication
Recommend
/api/registry/recommend?task=Use%20authentication%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Shortlist this skill and compare it with close alternatives before production adoption.
Role in stack
Companion skill
Primary fit
Browser automation
Trust label
Strong shortlist
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO509 GitHub stars
Stars/forks activity
INFO509 stars, 75 forks; issue activity unavailable in current metadata
Recent maintenance
PASS1mo since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Useful candidate, but compare it with alternatives before adopting.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Ingest, retrieve, and cite
A workflow for document-heavy agents that ingest files, create searchable knowledge, retrieve relevant context, and answer with grounded sources.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: authentication description: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion. ---
# Authentication
Test authentication mechanisms including login security, token handling, 2FA, CAPTCHA, and bot detection.
## Techniques
| Type | Key Vectors | |------|-------------| | **Auth Bypass** | Default credentials, logic flaws, response manipulation | | **ADFS/SAML** | Golden SAML, token signing cert theft, assertion manipulation, SAML wrapping | | **JWT** | Algorithm confusion, key injection, claim tampering, token forging | | **OAuth** | Redirect manipulation, CSRF, token leakage, scope abuse | | **Password** | Brute force, credential stuffing, password policy bypass | | **2FA Bypass** | Response manipulation, direct endpoint access, code reuse, race conditions | | **CAPTCHA Bypass** | Missing server validation, token reuse, OCR, parameter manipulation | | **Bot Detection** | Behavioral biometrics simulation, fingerprint randomization, stealth mode |
## Tools
**PasswordGenerator** (`tools/password_generator.py`): ```python from tools.password_generator import generate_password password = generate_password(hint_text="8-16 chars, uppercase, numbers") ```
**CredentialManager** (`tools/credential_manager.py`): ```python from tools.credential_manager import CredentialManager mgr = CredentialManager() mgr.store_credential(target="example.com", username="test", password="pass") ```
## Workflow
1. Analyze auth implementation (forms, tokens, 2FA, CAPTCHA) 2. Test bypass vectors per technique type 3. Use Playwright MCP with human-like behavior (typing 80-200ms, random pauses) 4. Capture evidence (screenshots, network logs, tokens) 5. Document findings with PoC scripts
## Reference
- `reference/authentication*.md` - Auth bypass techniques, payloads, and resources - `reference/jwt*.md` - JWT attack techniques and cheat sheets - `reference/oauth*.md` - OAuth vulnerability testing - `reference/scenarios/password-attacks/*.md` - Password attack vectors (spray, stuffing, cracking, PtH) - `reference/adfs-exploitation.md` - ADFS, Golden SAML, federation attacks - `reference/scenarios/2fa/*.md` - 2FA bypass methods - `reference/CAPTCHA_BYPASS.md` - 11 CAPTCHA bypass techniques - `reference/BOT_DETECTION.md` - Bot detection evasion strategies - `reference/PASSWORD_CREDENTIAL_MANAGEMENT.md` - Tool usage guide
Source provenance
Decision snapshot
509 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for authentication, ready for a manual X post.
A practical pick for the next repo task: authentication: Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and... 509 stars https://www.openagentskill.com/skills/transilienceai-authentication?ref=x
Listing + install path for authentication: https://www.openagentskill.com/skills/transilienceai-authentication?ref=x Install: npx skills add transilienceai/communitytools --skill authentication
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to transilienceai but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/transilienceai-authentication/audit)
[](https://www.openagentskill.com/skills/transilienceai-authentication?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)transilienceai
@transilienceai
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsPermission surface
secrets or environment access, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, filesystem or document access
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness