vm-auth-auditor

# Authentication & Authorization Auditor Skill

Reviews authentication and authorization implementations for security weaknesses and best practice violations.

## Brownfield Context

This skill audits **existing auth implementations** in inherited or in-production code. It does not prescribe a specific auth framework — it evaluates whatever auth pattern is already in place (JWT, OAuth, session-based, custom) against security principles. When invoked from the Security Analysis Agent, it reviews the entire auth layer. When invoked from the Code Review Agent scoped to a change set, it focuses on auth-related files and any changed files that touch identity or authorization logic.

## When to Use This Skill

- Auditing existing authentication mechanisms (JWT, OAuth, SAML) in brownfield code
- Reviewing session management practices in legacy systems
- Validating password policies and storage in inherited applications
- Checking RBAC implementations against principle of least privilege
- Identifying broken access control issues in existing access control logic
- Verifying MFA implementation correctness

## Unitary Function

**ONE RESPONSIBILITY:** Review authentication and authorization implementation security

**NOT RESPONSIBLE FOR:**
- General vulnerability scanning (see vm-vulnerability-scanner)
- Data encryption review (see vm-data-protection-reviewer)
- API-specific security (see vm-api-security-reviewer)
- Compliance validation (see vm-compliance-checker)
- Fixing auth issues (read-only skill)

## Input

```json
{
  "source_path": "Path to source code directory",
  "scope": "full|auth_files_only|file_list",
  "files": ["optional explicit file list for change-scoped review"],
  "config_files": ["optional paths to auth configuration files"],
  "auth_type": "jwt|oauth|saml|session|custom|auto-detect"
}
```

## Output

```json
{
  "audit_id": "uuid",
  "generated_by": {
    "skill": "vm-auth-auditor",
    "version": "1.0.0"
  },
  "timestamp": "ISO-8601",
  "source_path": "string",
  "auth_type_detected": "jwt|oauth|saml|session|custom|mixed",
  "risk_score": "Critical|High|Medium|Low",
  "findings": {
    "authentication": [
      {
        "severity": "High",
        "category": "Password Storage",
        "issue": "Passwords stored with weak hashing algorithm (MD5)",
        "location": "auth/users.py:45",
        "remediation": "Use bcrypt, Argon2, or PBKDF2"
      }
    ],
    "authorization": [
      {
        "severity": "Critical",
        "category": "Broken Access Control",
        "issue": "Missing authorization check on admin endpoint",
        "location": "api/admin.py:12",
        "remediation": "Add role-based access control check"
      }
    ],
    "session_management": [],
    "token_handling": [],
    "mfa": []
  },
  "recommendations": []
}
```

## Auth Mechanisms Reviewed

- **JWT**: Token validation, signature verification, expiry, algorithm confusion attacks, claims
- **OAuth 2.0**: Flow security, token storage, scope validati