Anthropic-Cybersecurity-Skills/skills/detecting-oauth-token-theft/SKILL.md

name, description, domain, subdomain, tags, version, author, license

name	description	domain	subdomain	tags	version	author	license
detecting-oauth-token-theft	Detect OAuth access token theft and misuse by analyzing sign-in logs for impossible travel, new device patterns, token replay from unusual IPs, and anomalous scope requests via Microsoft Graph and Okta APIs.	cybersecurity	identity-security	oauth token-theft identity-attacks impossible-travel	1.0	mahipal	Apache-2.0

Detecting OAuth Token Theft

Analyze OAuth sign-in telemetry for indicators of token theft including impossible travel, device fingerprint changes, and token replay attacks.