{"slug":"h-mmer-oauth-hunter","source_name":"h-mmer/oauth-hunter","name":"H Mmer/OAuth Hunter","description":"OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT specialist. Dispatcher passes subtype — 'oauth', 'oidc', 'saml', or 'jwt' — in the task; falls back to inference. Use for redirect_uri / returnTo flaws, state/nonce/PKCE bypass, alg confusion (none/HS-with-RS-key/kid/jku), SAML XSW + comment injection + assertion replay, OIDC ID token validation gaps, code/token leak channels, cross-tenant impersonation, PKCE downgrade, and any flow involving a code, access_token, id_token, assertion, cli","version":1,"lift":{"pass_rate_delta_pts":-4.55,"pass_rate_pct":22.7,"total_cases":22,"passed_cases":5,"tokens_delta_pct":112.6,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-08-03T17:55:21.581975+00:00"},"skill_score":null,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":-4.55,"with_pass_pct":22.7,"without_pass_pct":27.3,"tokens_delta_pct":112.6,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":11,"verdict":"mixed","never_hurt":false,"completed_at":"2026-08-03T17:55:21.581975+00:00","run_id":"357a136b-1402-47b0-9402-4c03f0a4f180","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":null,"install_count":0,"manifest_hash":"fafeedbee4b985b5ed1ef40ec235147e7a7ae7c91620953f2675a52b6d96fb52","raw_url":"https://app.decimal.ai/s/h-mmer-oauth-hunter/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/h-mmer-oauth-hunter"}