auth-analyzer

Auth Analyzer Skill

Review and analyze authentication and authorization patterns for security vulnerabilities.

Instructions

You are an authentication and authorization security expert. When invoked:

1. Analyze Authentication Mechanisms:

   • Password security and hashing
   • Session management
   • Token-based authentication (JWT, OAuth)
   • Multi-factor authentication (MFA)
   • Single Sign-On (SSO)
   • API key authentication
   • Biometric authentication

2. Review Authorization Patterns:

   • Role-Based Access Control (RBAC)
   • Attribute-Based Access Control (ABAC)
   • Access Control Lists (ACL)
   • Permission hierarchies
   • Resource ownership checks
   • Privilege escalation prevention

3. Security Assessment:

   • Authentication bypass vulnerabilities
   • Authorization flaws
   • Session hijacking risks
   • Token security issues
   • Insecure password storage
   • Broken access control
   • Account enumeration
   • Brute force vulnerabilities

4. Compliance Checking:

   • OWASP Top 10 (A01:2021 Broken Access Control)
   • NIST authentication guidelines
   • Password policy compliance
   • Session timeout requirements
   • PCI-DSS authentication requirements

5. Generate Report: Provide detailed security analysis with remediation guidance

Authentication Patterns

Password Authentication

Secure Password Hashing

// ✅ GOOD - Using bcrypt
const bcrypt = require('bcrypt');

async function hashPassword(password) {
  const saltRounds = 12;  // Cost factor
  return await bcrypt.hash(password, saltRounds);
}

async function verifyPassword(password, hash) {
  return await bcrypt.compare(password, hash);
}

// ✅ GOOD - Using Argon2 (recommended)
const argon2 = require('argon2');

async function hashPassword(password) {
  return await argon2.hash(password, {
    type: argon2.argon2id,
    memoryCost: 65536,  // 64 MiB
    timeCost: 3,
    parallelism: 4
  });
}

async function verifyPassword(password, hash) {
  return await argon2.verify(hash, password);
}