qa-auth-flows plugin
Authentication flow testing: OAuth 2.0 with PKCE, multi-factor authentication, and session management, plus Keycloak, Auth0 and Okta integration tests. Anchored on RFC 7636, RFC 9700 and OWASP ASVS V3. A critic agent (token-storage-security-critic) flags tokens in localStorage, auth cookies missing httpOnly / Secure / SameSite, and tokens leaking into logs or URLs.
How to install the qa-auth-flows plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add testland/qa
/plugin install qa-auth-flows@testland-qaWhat's inside qa-auth-flows
7 parts read from the plugin's own files.
Agents 1
Call as @agent-qa-auth-flows:name- @agent-qa-auth-flows:token-storage-security-criticsonnet
Use proactively whenever a PR touches auth tokens, cookies, API client setup or refresh logic. Flags tokens in localStorage or sessionStorage, cookies missing httpOnly, Secure or SameSite, tokens in logs or URLs, and missing rotation or expiry, with a BLOCK or PASS verdict.
Skills 6
Claude loads it when the task matches- auth0-tests
Tests Auth0 tenant configurations, OIDC authentication flows, and serverless Actions or legacy Rules and Hooks.
- keycloak-tests
Perform integration testing for Keycloak identity providers using Testcontainers to spin up isolated, throwaway instances with realm imports.
- mfa-flow-test-author
Automates testing for multi-factor authentication flows including TOTP, HOTP, SMS/email OTP, WebAuthn passkeys, and recovery codes.
- oauth-flow-test-author
Use whenever an OAuth 2.0 or OpenID Connect client or resource server needs tests, whatever the identity provider: auth code with PKCE, client credentials, refresh-token rotation and reuse detection, state and nonce checks, scopes and strict redirect-URI matching, per the RFCs.
- okta-tests
Tests Okta Identity Engine configurations, OIDC authentication flows, MFA enforcement, and SCIM provisioning.
- session-management-test-author
Authors security tests for web application session management including cookie attributes, timeouts, and session fixation defenses.
Using qa-auth-flows in Claude Code
Ask for an agent by name:
@agent-qa-auth-flows:token-storage-security-criticSkills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update qa-auth-flows@testland-qa
- Refresh the marketplace
- /plugin marketplace update testland-qa
- Turn it off for now
- /plugin disable qa-auth-flows@testland-qa
- Remove it
- /plugin uninstall qa-auth-flows@testland-qa
Skills in qa-auth-flows
- auth0-teststestland/qa
Tests Auth0 tenant configurations, OIDC authentication flows, and serverless Actions or legacy Rules and Hooks.
3 files13stars - keycloak-teststestland/qa
Perform integration testing for Keycloak identity providers using Testcontainers to spin up isolated, throwaway instances with realm imports.
14 files13stars - mfa-flow-test-authortestland/qa
Automates testing for multi-factor authentication flows including TOTP, HOTP, SMS/email OTP, WebAuthn passkeys, and recovery codes.
3 files13stars - oauth-flow-test-authortestland/qa
Use whenever an OAuth 2.0 or OpenID Connect client or resource server needs tests, whatever the identity provider: auth code with PKCE, client credentials, refresh-token rotation and reuse detection, state and nonce checks, scopes and strict redirect-URI matching, per the RFCs.
13 files13stars - okta-teststestland/qa
Tests Okta Identity Engine configurations, OIDC authentication flows, MFA enforcement, and SCIM provisioning.
2 files13stars - session-management-test-authortestland/qa
Authors security tests for web application session management including cookie attributes, timeouts, and session fixation defenses.
13 files13stars
qa-auth-flows plugin questions
How do I install the qa-auth-flows plugin?
In Claude Code run /plugin marketplace add testland/qa, then /plugin install qa-auth-flows@testland-qa.
What does the qa-auth-flows plugin include?
qa-auth-flows bundles 1 agent, 6 skills.
Which agents come with qa-auth-flows?
token-storage-security-critic. Call one with @agent-qa-auth-flows:token-storage-security-critic.
How do I update or remove the qa-auth-flows plugin?
Update it with claude plugin update qa-auth-flows@testland-qa in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall qa-auth-flows@testland-qa.
What license is the qa-auth-flows plugin under?
MIT, as stated in the plugin's manifest.