← All skills
okta-attack
90 / 100 · Low risk
Fine to try.
By boisenoise/skills-collections (GitHub) · other · 12 stars · scanned at commit 419c39f
Okta-as-IdP red-team attack chain
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
The author does not mention this.
Found in 12 places.
Show 9 more
Sends data to these websites: $host, app.target.com, example.com&login_hint=
The author does not mention this.
Found in 15 places.
Show 12 more
- skills/antigravity-okta-attack/SKILL.md, line 110
curl -sS --max-time 10 "https://<tenant>.okta.com/api/v1/sessions/me" \ - skills/antigravity-okta-attack/SKILL.md, line 127
curl -sS --max-time 10I "https://<tenant>.okta.com/oauth2/v1/authorize?client_id=<id>&response_type=code&scope=openid&redirect_uri=https://example.com&login_hin - skills/antigravity-okta-attack/SKILL.md, line 137
curl -sS --max-time 10 -X POST "https://<tenant>.okta.com/api/v1/authn" \ - skills/antigravity-okta-attack/SKILL.md, line 209
curl -sS --max-time 10 -X POST "https://<tenant>.okta.com/api/v1/authn/factors/<factor_id>/verify" \ - skills/antigravity-okta-attack/SKILL.md, line 224
curl -sS --max-time 10 "https://<tenant>.okta.com/.well-known/openid-configuration" | python3 -m json.tool - skills/antigravity-okta-attack/SKILL.md, line 235
code=$(curl -sS --max-time 10 -o /dev/null -w "%{http_code}" \ - skills/antigravity-okta-attack/SKILL.md, line 250
curl -sS --max-time 10 "https://<tenant>.okta.com/app/<app_id>/sso/saml/metadata" - skills/antigravity-okta-attack/SKILL.md, line 266
curl -sS --max-time 10 -X POST "https://<tenant>.okta.com/api/v1/authn" \ - skills/antigravity-okta-attack/SKILL.md, line 273
curl -sS --max-time 10 -H "Authorization: SSWS <token>" "https://<tenant>.okta.com/api/v1/users" - skills/antigravity-okta-attack/SKILL.md, line 274
curl -sS --max-time 10 -H "Authorization: SSWS <token>" "https://<tenant>.okta.com/api/v1/groups" - skills/antigravity-okta-attack/SKILL.md, line 275
curl -sS --max-time 10 -H "Authorization: SSWS <token>" "https://<tenant>.okta.com/api/v1/apps" - skills/antigravity-okta-attack/SKILL.md, line 276
curl -sS --max-time 10 -H "Authorization: SSWS <token>" "https://<tenant>.okta.com/api/v1/logs" # audit log
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'okta-attack' ] || [ -L ~/.agents/skills/'okta-attack' ]; then echo 'A skill folder named okta-attack already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/boisenoise/skills-collections' "$d" && git -C "$d" checkout --quiet '419c39fde874b8baecbb36a397b967e0190a2ece' -- 'skills/antigravity-okta-attack' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/antigravity-okta-attack' ~/.agents/skills/'okta-attack' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'okta-attack' ~/.claude/skills/'okta-attack' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for boisenoise/skills-collections shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/boisenoise/skills-collections/)
Score history
| Date | Version | Score |
|---|
| 2026-11-12 | 419c39f | 90 |
| 2026-11-08 | 5fe45e5 | 90 |
| 2026-11-06 | b89b2f5 | 90 |