create-rule
Create Cursor rules for persistent AI guidance. Use when the user wants to create a rule, add coding standards, set up project…
@coco-researchInstall SkillDevelopment
Skill
/identity-federation
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
Claude Code
$ npx -y skills add coco-research/coco --skill identity-federation --agent claude-code
Codex
$ npx skills add coco-research/coco --skill identity-federation -a codex -y
Cursor
$ npx skills add coco-research/coco --skill identity-federation -a cursor -y
Gemini CLI
$ npx skills add coco-research/coco --skill identity-federation -a gemini-cli -y
GitHub Copilot
$ npx skills add coco-research/coco --skill identity-federation -a github-copilot -y
OpenCode
$ npx skills add coco-research/coco --skill identity-federation -a opencode -y
Windsurf
$ npx skills add coco-research/coco --skill identity-federation -a windsurf -y
SKILL.md
identity-federation.SKILL.mdname: identity-federation description: Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues. user-invocable: true
Identity Federation (SAML / OIDC / OAuth)
适用场景
- SAML Response 签名/断言篡改面（经典缺陷模式）
- OIDC 隐式/授权码 + PKCE 缺失
- redirect_uri / state / nonce 问题
- IdP 与 SP 元数据、多租户 issuer 混淆
- 与 `api-security` JWT 攻击互补（本 skill 偏联邦与 SSO 流）
工作流
□ 画清：User → SP → IdP → Token → SP □ 收集：/.well-known/openid-configuration、SAML metadata □ 检查：redirect_uri 精确匹配、state 绑定、PKCE □ 检查：SAML 签名覆盖范围、algorithm 降级 □ 会话固定与登出失效
工具链
| 工具 | 用途 | |------|------| | Burp + SAML Raider 等 | 断言编辑（授权） | | jwt_tool | JWT 段 | | 浏览器 DevTools | 重定向链 | | IdP 管理日志 | 审计 |
参考
- `references/sso-flow-checklist.md`
- `../api-security/` `../windows-ad/`（企业 IdP）
Ships withcoco
495 personas across 13 departments, 229 skills[^installed] and 388 commands in the full catalog (coco 1.9.0, 2026-10-21). Agent skills, slash commands and subagents for Claude Code, Cursor, Codex and other AI coding agents.
631200 skills53 agents
Stars on GitHub
Momentum
- stars in total
- 631
Other skills on coco.
@coco-researchInstall Skillcreate-skill
Guides users through creating effective Agent Skills for Cursor. Use when the user wants to create, write, or author a new skill,…
@coco-researchInstall Skillcreate-subagent
Create custom subagents for specialized AI tasks. Use when the user wants to create a new type of subagent, set up task-specific…
@coco-researchInstall Skillmigrate-to-skills
Convert 'Applied intelligently' Cursor rules (.cursor/rules/*.mdc) and slash commands (.cursor/commands/*.md) to Agent Skills…
@coco-researchInstall Skillupdate-cursor-settings
Modify Cursor/VSCode user settings in settings.json. Use when the user wants to change editor settings, preferences,…
@coco-researchInstall Skillagent-lightning
Train and optimize AI agents using Microsoft's Agent Lightning framework with reinforcement learning. Use when setting up agent…
@coco-researchInstall SkillMore skills from other plugins.
Auto-invoked
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, modifying behavior, or…
@obraInstall Skillask-matt
Ask which skill or flow fits your situation. A router over the skills in this repo.
@mattpocockInstall SkillAuto-invoked
Questions about identity-federation.
- Which coding agents can use identity-federation?
- identity-federation installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.