claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a spec
Install
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add SnailSploit/Claude-Red --skill offensive-oauth -a cursor -y
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
Questions
How do I install Claude-Red?
Download Skills/auth/offensive-oauth/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does Claude-Red live?
The publisher keeps it at https://github.com/SnailSploit/Claude-Red.
Which agents can use Claude-Red?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
OAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.
Trigger Phrases
Use this skill when the conversation involves any of:
OAuth, OAuth 2.0, authorization code, redirect_uri bypass, OAuth CSRF, state parameter, PKCE bypass, scope escalation, token leakage, open redirector, OAuth attack
Instructions for Claude
When this skill is active:
Load and apply the full methodology below as your operational checklist
Follow steps in order unless the user specifies otherwise
For each technique, consider applicability to the current target/context
Track which checklist items have been completed
Suggest next steps based on findings
Full Methodology
OAuth Security Testing
Shortcut
Check for improper redirect validation (open redirects)
Test state parameter manipulation/absence
Manipulate OAuth flows to bypass authentication
Try URL path traversal in redirect_uri
Hunt for client secret leakage in source code/repos
Look for improper scope validation
Mechanisms
OAuth 2.0 authorizes limited access to resources via tokens; pair with OIDC for identity.
Core Flows:
Authorization Code (with PKCE for public clients)
Client Credentials (service-to-service)
Avoid Implicit and ROPC where possible
Key Components:
Resource Owner (user)
Client (third-party app)
Authorization Server (issues tokens)
Resource Server (hosts protected resources)
Tokens (access and refresh)
Hardening Extensions:
PAR (Pushed Authorization Requests), JAR (Request Objects), JARM (JWT-secured responses)
Sender‑constrained tokens (DPoP, mTLS)
private_key_jwt or mTLS client authentication for confidential clients
OAuth/OIDC Considerations
PKCE everywhere: Even with confidential clients/native apps; code_verifier must be required and validated.
Nonce/state binding: For OIDC, ensure nonce is present and matched; state should be unguessable and tied to session.
redirect_uri exact match: Enforce exact string match against pre-registered allowlist; no wildcards/path traversal.
aud/azp/iss enforcement: Validate tokens strictly, including clock skew and JWKS kid rotation behavior.
Access token returned directly in URL fragment: /callback#access_token=z0y9x8w7v6u5&token_type=Bearer&expires_in=5000&scope=openid%20profile&state=ae13d489bd00e3c24
Higher vulnerability potential due to frontend token handling
sequenceDiagram
participant User
participant Client as Client (Browser)
participant AuthServer as Authorization Server
participant API as Resource Server
User->>Client: 1. Click "Login with Service"
Client->>AuthServer: 2. Authorization Request (response_type=token)
AuthServer->>User: 3. Login & Consent
User->>AuthServer: 4. Approves Access
AuthServer->>Client: 5. Redirect with Access Token in Fragment
Note over Client: Token stored in browser
Client->>API: 6. API Request + Access Token
API->>Client: 7. Protected Resource
Vulnerabilities
Improper redirect_uri validation
Open redirects
Subdomain/path validation bypass
CSRF attacks (missing/improper state parameter)
Token leakage (URL fragments in referrer headers)
Scope elevation (improper authorization)
Account takeover via improper linking/unlinking
JWT vulnerabilities (weak signatures, lack of validation)
Client secret exposure in source/git repositories
Authorization bypass in misconfigured implementations
Session fixation attacks
Access token theft via XSS/Man-in-the-Middle
Authorization Code Injection / Code Substitution
Attacker injects victim authorization code into attacker session to bind victim account. Mitigate with state-nonce binding and PKCE.
Method 1: Auth Bypass in OAuth Implicit Flow
Locate POST request containing user info (email, username) and access token
In implicit flow, servers often don't properly validate access tokens
Try changing user parameters (email, username) while keeping the token
Potentially impersonate other users if server trusts client-provided identifiers
Method 2: Forced Profile Linking
Target OAuth profile linking functionality
Check for missing state parameter in auth requests
Create CSRF attack by copying auth URL before code/token use
Deliver as direct link or embedded iframe to victim
Can link attacker's social media to victim's account
Method 3: Account Hijacking via redirect_uri
Identify authorization request with redirect_uri parameter
Test redirect_uri manipulation (external domains or open redirects)
Modify redirect_uri to attacker-controlled endpoint (webhook)
Deliver modified auth URL to victim to capture their authorization code
Use stolen code to complete OAuth flow and access victim's account
Methodologies
Tools:
Burp Suite (OAuth Scanner extension)
OWASP ZAP
OAuth 2.0 Threat Model Toolkit
Postman for API testing
JWT_Tool for token analysis
OAuthSecurity Cheatsheet Scanner
Techniques:
Flow manipulation
Parameter tampering
Token analysis
Replay attacks
Social engineering (phishing for tokens)
DPoP proof validation testing
MTLS certificate validation testing
PAR endpoint exploitation
Token exchange flow testing
Chaining and Escalation
OAuth → Full Account Takeover
Open Redirect → Authorization Code Theft:
Discover open redirect on trusted domain
Craft OAuth flow with redirect_uri pointing to open redirect
Require PKCE for all clients (public and confidential)
Enforce exact redirect_uri matching
Implement refresh token rotation with reuse detection
Enforce state parameter: Always required, cryptographically random, single-use
Validate token claims strictly:
aud (audience): Must match resource server
iss (issuer): Verify against known issuers
exp (expiration): Enforce with clock skew tolerance (max 60s)
nbf (not before): Validate if present
Secure token storage:
Never use localStorage (XSS vulnerable)
Use httpOnly cookies with __Host- prefix or memory-only storage
Set proper cookie flags: HttpOnly; Secure; SameSite=Strict
Advanced Security Features
Implement PAR (Pushed Authorization Requests): POST parameters to /par endpoint
Use DPoP (Demonstrating Proof-of-Possession): Bind access tokens to client's public key
Implement MTLS for confidential clients: Certificate-bound access tokens
Use JAR (JWT-secured Authorization Request): Sign authorization request parameters
Consider JARM (JWT-secured Authorization Response): Signed authorization responses
Token Management
Short-lived access tokens: 5-15 minutes maximum
Refresh token rotation: Issue new refresh token on each use
Refresh token reuse detection: Revoke entire token family on reuse
Token binding: Use DPoP or MTLS to bind tokens to clients
Standards and Compliance
Follow OAuth 2.1 (draft) guidance
Implement FAPI if dealing with financial data
Follow RFC 6819 OAuth threat model
Adopt RFC 8252 for native apps
Consider RFC 8693 for secure token exchange
Implement RFC 9449 for DPoP
Regular Security Practices
Rotate signing keys regularly (every 6-12 months)
Implement JWKS with short TTL (< 1 hour)
Pin trusted issuers in client configuration
Conduct regular OAuth security audits
Keep libraries and dependencies updated
How do I install Claude-Red?
Download Skills/auth/offensive-oauth/SKILL.md from the publisher, or copy the path and open the repository. PlugMCP lists the skill and does not host the file.
Where does Claude-Red live?
The publisher keeps it at https://github.com/SnailSploit/Claude-Red.
Which agents can use Claude-Red?
Claude, Cursor, and Codex can read a SKILL.md you add from the publisher's repository.