identity-federation
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
What it does
This tool helps check the security of systems that let you log in to multiple applications using a single account (like Google or Facebook). It looks for common flaws that could be exploited.
When to use it
- ✓When testing the security of a single sign-on (SSO) system.
- ✓When you suspect login configurations might be vulnerable.
- ✓To understand how federated login systems work and where they might fail.
Example of what to ask your AI
“Check the security of our login system using SAML and OIDC.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool analyzes login flows, such as SAML and OIDC, looking for misconfigurations or known vulnerabilities. It checks if access tokens are used correctly and if there are security gaps.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill identity-federationOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/skills/identity-federation/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Identity Federation (SAML / OIDC / OAuth)
ACTION REQUIRED（读完后立刻执行）
NOW: 读取 precedent-pentest；SSO 测试账号与 IdP/SP 范围入 scopeNOW: 禁止锁定真实用户账户的暴力尝试NEXT: 抓包工具与文档（元数据 URL）ACT: 协议流映射 → 常见错配 → 验证
适用场景
- SAML Response 签名/断言篡改面（经典缺陷模式）
- OIDC 隐式/授权码 + PKCE 缺失
- redirect_uri / state / nonce 问题
- IdP 与 SP 元数据、多租户 issuer 混淆
- 与
api-securityJWT 攻击互补（本 skill 偏联邦与 SSO 流）
工作流
□ 画清：User → SP → IdP → Token → SP
□ 收集：/.well-known/openid-configuration、SAML metadata
□ 检查：redirect_uri 精确匹配、state 绑定、PKCE
□ 检查：SAML 签名覆盖范围、algorithm 降级
□ 会话固定与登出失效
工具链
| 工具 | 用途 |
|---|---|
| Burp + SAML Raider 等 | 断言编辑（授权） |
| jwt_tool | JWT 段 |
| 浏览器 DevTools | 重定向链 |
| IdP 管理日志 | 审计 |
参考
references/sso-flow-checklist.md../api-security/../windows-ad/（企业 IdP）
路由上下文
上游: MASTER R37
下游: 纯 API JWT → api-security；云 IdP → cloud-k8s
任务完成自检
- 是否映射完整 SSO 流？
- 每个 Finding 是否有复现与影响？
- Checklist？
FAQ
What is federated login?
It's a system that allows you to use one account (like Google) to access various other services without needing to create a new password for each.
What are SAML and OIDC?
They are protocols (sets of rules) used to enable secure federated login.
What does the tool specifically check for?
It checks for issues like invalid SAML signatures, incorrect redirects, and flaws in the protection of login flows like OIDC.
Details
Original description by the author
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
Popularity
- GitHub stars
- 42k
- Ranking position
- #4770
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
brand-discovery
Helps define a brand's identity through structured interviews. It creates a complete guide with the brand's purpose, audience, and personality.
affaan-m/ECC
brand-voice
Creates a writing profile based on actual brand texts. It ensures content and communications maintain a consistent and authentic style.
affaan-m/ECC
brand-guidelines
Has your agent apply Anthropic's brand colors and visual style to materials. It's useful for maintaining the company's visual identity across projects.
anthropics/skills