securityby encod3d-sec
Hunt: OAuth / SAML / Federation
encod3d-sec/hunt-federation
OAuth and SAML attack hunting - redirect_uri bypass, state CSRF, SAML XSW (XSW1-XSW8), signature stripping, comment injection. Wiki-first, FIND schema output.
Code scan CleanIntent PassedContent Clean
Benchmark snapshot
Same tasks, with and without this skill.
Model gemini-3.6-flashMeasured 10/10/2026v1
- Pass-rate lift
- +26 pp
percentage-point change- Pass rate with skill
- 70%
43% without skill- Tokens
- +48%
vs. without skill- Agent turns
- 0%
vs. without skill
Usage
All-time distinct users and times used, across every version.
Read the skill
SKILL.md · instructions and conventions
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v5 — 9/14/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
ImportedLicense MITImported 9/14/2026Version v1