A client with "*" in Valid Redirect URIs lets Keycloak send authorization codes to any site an attacker picks. A realm file written by kc.sh export holds every client secret and the realm's private signing keys in clear text, so committing it lets anyone sign their own tokens. A Kubernetes manifest that runs start-dev with KC_BOOTSTRAP_ADMIN_PASSWORD: admin serves the master realm over plain HTTP with a known password. This skill finds those and the other Keycloak mistakes below, and tells you how to fix each one.

Your agent runs a scanner on your project: realm exports and imports (realm JSON, the users files of kc.sh export, KeycloakRealmImport resources, keycloak-config-cli YAML and realm JSON kept in a ConfigMap), keycloak.json adapter files, keycloak.conf, and Keycloak settings wherever they are written: KC_ variables and kc.sh arguments in Compose files, Kubernetes manifests and Secrets, Helm values, the Keycloak operator resource, Dockerfiles, systemd units and .env files. It knows Keycloak's defaults and its built-in clients, treats vault and environment placeholders and masked export values as kept outside the file, and tells a local start-dev setup apart from a deployment. Realm files and settings under test, fixture, dev or local paths (src/test/resources, integration-tests, e2e, kind clusters) are reported as REVIEW instead of BLOCK. It never contacts Keycloak and never uses the network. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• K01: a realm with sslRequired set to none
• K02: redirect URIs that accept other hosts: "*", "https://*" or a wildcard right after the host (also post-logout redirect URIs); loopback port wildcards for native apps are not reported
• K03: credentials in realm and adapter files: client secrets, identity provider client secrets, SMTP and LDAP bind passwords, user passwords, OTP seeds, keycloak.json client secrets
• K04: realm key material in a file: key provider private keys and secrets, key store passwords, SAML client private keys
• K05: literal server passwords: bootstrap admin password (also the deprecated KEYCLOAK_ADMIN_PASSWORD), database password (also inside KC_DB_URL), key store, trust store and other Keycloak password or secret options, as KC_ variables, kc.sh arguments, keycloak.conf lines or operator options
• K06: start-dev in a Kubernetes manifest, Helm values, a systemd unit, or a Compose file or Dockerfile named for production or staging (kind, minikube and k3d setups get K20 instead)

REVIEW (check before release)

• K11: clients with the implicit flow turned on
• K12: public clients with Direct Access Grants (the password grant)
• K13: brute force detection turned off
• K14: no password policy, no minimum length, or a minimum length below 8
• K15: "*" in a client's Web Origins
• K16: public clients that do not require PKCE with S256 and no enabled client policy for public clients that enforces it
• K17: access token lifespans longer than one hour
• K18: self-registration in the master realm or without email verification
• K19: hostname-strict turned off with no hostname set in the same file
• K20: start-dev in a Compose service that publishes its port beyond 127.0.0.1, or in a Dockerfile not named for local use
• K21: redirect URIs with a path wildcard on a host that is not local (Keycloak before 26.6.2 also has CVE-2026-7504 for wildcard redirect URIs)
• K22: literal Keycloak passwords in .env files that no .gitignore covers

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and documentation link for each rule (Keycloak docs and RFC 9700)
• A risky and a safe example (a shop realm export, a Compose file, a Kubernetes Deployment, keycloak.conf and an env file), and the real report the scanner produces on the risky one

Limits

It reads each file on its own and as written. A hostname set in another file, values in .env files used by a Compose file, Helm chart templates, chart-specific Helm keys, Terraform, and changes made later in the Admin Console or Admin REST API are not seen. Literal passwords in .env files are reported only when no .gitignore covers the file, and passwords in local start-dev setups and CI workflows are not reported. Development, test and production are decided from file names, folders, start-dev and published ports, so check K06, K20 and the REVIEW findings in test paths against how the files are used. Keycloak's own quickstart realms and Kubernetes quickstart manifest are reported where they are unsafe outside a laptop, and a complete export with Keycloak's defaults gets K13 and K14, because the Keycloak docs advise changing both. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 20 files: SKILL.md, the scanner in scripts/ (7 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (10 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.