← All skills
testing-oauth2-implementation-flaws
95 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By mukul975/Anthropic-Cybersecurity-Skills (GitHub) · security · 35,906 stars · scanned at commit 54a7988
Tests OAuth 2.0 and OpenID Connect implementations for authorization code
Works with any agent that supports SKILL.md skills.
What this skill can do
Sends data to these websites: other-service.example.com
The author does not mention this. Expected for a security skill.
Found in 16 places.
Show 13 more
- skills/testing-oauth2-implementation-flaws/SKILL.md, line 159
resp = requests.get(auth_endpoint, params=params_no_state, allow_redirects=False) - skills/testing-oauth2-implementation-flaws/SKILL.md, line 168
resp = requests.get(auth_endpoint, params=params, allow_redirects=False) - skills/testing-oauth2-implementation-flaws/SKILL.md, line 200
resp = requests.get(auth_endpoint, params=params_no_pkce, allow_redirects=False) - skills/testing-oauth2-implementation-flaws/SKILL.md, line 206
token_resp = requests.post(token_endpoint, data={ - skills/testing-oauth2-implementation-flaws/SKILL.md, line 217
token_resp = requests.post(token_endpoint, data={ - skills/testing-oauth2-implementation-flaws/SKILL.md, line 233
resp = requests.get(auth_endpoint, params=params_plain_pkce, allow_redirects=False) - skills/testing-oauth2-implementation-flaws/SKILL.md, line 258
resp = requests.get(auth_endpoint, params=params, allow_redirects=False) - skills/testing-oauth2-implementation-flaws/SKILL.md, line 267
resp = requests.get("https://other-service.example.com/api/resource", - skills/testing-oauth2-implementation-flaws/SKILL.md, line 275
token_resp = requests.post(token_endpoint, data={ - skills/testing-oauth2-implementation-flaws/SKILL.md, line 295
resp = requests.get(auth_endpoint, params=implicit_params, allow_redirects=False) - skills/testing-oauth2-implementation-flaws/SKILL.md, line 312
token_resp = requests.post(token_endpoint, data={ - skills/testing-oauth2-implementation-flaws/scripts/agent.py, line 41
return requests.get(url, **kwargs, timeout=30) - skills/testing-oauth2-implementation-flaws/scripts/agent.py, line 50
return requests.post(url, **kwargs, timeout=30)
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'testing-oauth2-implementation-flaws' ] || [ -L ~/.agents/skills/'testing-oauth2-implementation-flaws' ]; then echo 'A skill folder named testing-oauth2-implementation-flaws already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills' "$d" && git -C "$d" checkout --quiet '54a798831d2266a3ca61ce68a7acb80b81160d57' -- 'skills/testing-oauth2-implementation-flaws' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/testing-oauth2-implementation-flaws' ~/.agents/skills/'testing-oauth2-implementation-flaws' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'testing-oauth2-implementation-flaws' ~/.claude/skills/'testing-oauth2-implementation-flaws' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for mukul975/Anthropic-Cybersecurity-Skills shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/mukul975/Anthropic-Cybersecurity-Skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 54a7988 | 95 |
| 2026-11-07 | 54a7988 | 95 |