Skill UI

This guide outlines critical security measures for integrating with Guidewire systems, which handle sensitive policyholder PII, claims, and financial data. It covers best practices for implementing OAuth2 JWT authentication, API role scoping, input validation, and sensitive data redaction (PII) to prevent data breaches and meet compliance standards.

This skill provides comprehensive implementation for secure JWT (RFC 7519) signing and verification using multiple algorithms (HMAC-SHA256, RSA-PSS, ES256, EdDSA). It covers token expiration, claims validation, and crucial defenses against common attacks like algorithm confusion and 'none' algorithm bypass, essential for hardening web application authentication systems.

This skill rigorously verifies all claims of completion, whether for a task, a bug fix, or a feature rollout. It prevents false assurances by demanding fresh, multi-faceted evidence, including full test suite results, comprehensive coverage reports, integration status, and validation commands. Use it before declaring a component ready for GO or accepting a sub-agent's success report.

A comprehensive playbook for security testing APIs relying on JWT, bearer tokens, or API keys. It covers token validation weaknesses (e.g., 'alg:none', RS256 confusion), claim misuse, header spoofing, rate limit bypass, and mass assignment vulnerabilities. Ideal for penetration testers assessing authentication boundaries.

Microsoft Entra Authentication Events SDK for .NET. Azure Functions triggers that handle custom authentication extensions, including token claim enrichment, attribute collection customization and validation, and custom OTP delivery.