Descope Skills

A collection of AI agent skills for integrating Descope authentication into your applications. Skills follow the Agent Skills format and work with any compatible AI coding assistant.

Available Skills

Framework- and vendor-agnostic static review that enumerates every route/endpoint in a codebase, builds an authorization matrix, applies a vulnerability catalog (OWASP Web + API Top 10 identity categories), and writes a triage report ready to slice into GitHub issues or PRs.

Use when:

• “/auth-review”
• “Audit authentication in my app”
• “Find authorization bugs / IDOR / BOLA”
• “Review access control”
• “Identity security review before release”

Covers:

• Broken authentication (missing auth, weak password handling, SQLi-in-login, enumeration)
• JWT / token flaws (alg:none, algorithm confusion, unverified decode, missing claim validation)
• Session management (cookie flags, fixation, logout invalidation, predictable IDs)
• Broken access control (IDOR / BOLA, BFLA, tenant crossing, client-trusted input)
• Privilege escalation & mass assignment
• OAuth / OIDC / SAML (state/PKCE, open redirect, ID-token validation, SAML XSW)
• Password reset & account recovery (predictable/non-expiring tokens, host poisoning, MFA bypass)
• MFA bypass and step-up gaps
• Rate limiting & enumeration on auth surfaces
• CSRF, CORS, identity-adjacent SSRF

Output:

• Triage report in ./auth-review/report-YYYY-MM-DD.md