From code-audit
Conducts a comprehensive authentication security review covering login, sessions, tokens, and credential handling. Use when auditing authentication for vulnerabilities.
How this skill is triggered — by the user, by Claude, or both
Slash command
/code-audit:authentication-flow-review [path or scope][path or scope]This skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
**Target:** $ARGUMENTS
Target: $ARGUMENTS
If no target path is given above, review the entire codebase.
Stack note: The code examples and library references below use Node.js/Express conventions (
bcrypt,jsonwebtoken,zod/joi,req.body, etc.). If the codebase uses a different language or framework, apply the same security principles and adapt the specifics — for example:bcrypt→passlib/Argon2id(Python),spring-security(Java),bcrypt(Go);jsonwebtoken→PyJWT,java-jwt,golang-jwt/jwt;mongoose.set('sanitizeFilter')→ the equivalent ORM sanitization setting. Mark any checklist item Not Applicable if the concept doesn't apply to the detected stack.
Conduct a comprehensive authentication security review:
Check for:
Password hashing
bcrypt.hash() with salt rounds ≥ 10 (ideally 12); async, not sync; no double-hashing on updates.bcrypt.compare() used for login.JWT secret/key strength & storage
Token settings
algorithms, issuer (iss), audience (aud), subject (sub), jti, iat, exp, and optional nbf are enforced in verify.Refresh token implementation
jti, ua, ip, expiresAt).Session invalidation
pwdChangedAt or increment tokenVersion vs jwt.iat).Brute force protection
Account enumeration defenses
Password reset flow security
crypto.randomBytes(32), hashed at rest (SHA-256), short TTL (≤ 15–30 min), one-time use, invalidated after success.Email verification
SQL/NoSQL injection in auth paths
$where; parameterized SQL if applicable.AuthZ integrity
Cookie & CSRF configuration (if cookies used)
HttpOnly, Secure, SameSite=Lax|Strict, narrow path/domain, explicit Max-Age.Input validation & normalization
Mass assignment risks
role, emailVerified, passwordResetToken, etc., from req.body.JWT misuse
jwt.decode() for authorization decisions; always jwt.verify() with explicit algorithms.Logging & telemetry
Dependency & crypto hygiene
jsonwebtoken and bcrypt versions; no custom JWT parser; Node crypto used correctly; no MD5/SHA* for password hashing.Transport & CORS
Open redirect / next param
next= redirects.Operational controls
Provide:
A structured finding report with the following for each issue:
A summary risk score (0–10) and top 3–5 prioritized fixes that reduce risk fastest.
A checklist diff: which items from the “Check for” list are Pass/Fail/Not Applicable.
Constraints & style:
Bonus (if applicable):
jti blacklist service, adding device/session management UI, enabling mongoose.set('sanitizeFilter', true)).Provide specific vulnerabilities found with severity ratings.
Write this into a markdown file and place it in the audits/ folder.
npx claudepluginhub jeremymorgan/code-review-skills --plugin code-auditProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.