executing-plans
executing-plans
Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available
Explore skills
Productivity · SKILL.md
detecting-oauth-token-theft
detecting-oauth-token-theftDetect OAuth access token theft and misuse by analyzing sign-in logs for impossible travel, new device patterns, token replay from unusual IPs, and anomalous scope requests via Microsoft Graph and Okta APIs.
Independent GitHub snapshot · Automated classification · Original documentation governs
Skill documentation
GitHubname: detecting-oauth-token-theft description: > Detect OAuth access token theft and misuse by analyzing sign-in logs for impossible travel, new device patterns, token replay from unusual IPs, and anomalous scope requests via Microsoft Graph and Okta APIs. domain: cybersecurity subdomain: identity-security tags: [oauth, token-theft, identity-attacks, impossible-travel] version: "1.0" author: mahipal license: Apache-2.0
Detecting OAuth Token Theft
Analyze OAuth sign-in telemetry for indicators of token theft including impossible travel, device fingerprint changes, and token replay attacks.