Oauth Helper

**Quick judgment:** A focused and practical skill for automating OAuth logins via a browser, with Telegram-based human confirmation at key steps. Very useful for agents that need to log into many OAuth-enabled sites, but it has significant security implications and should be treated like high-sensitivity credential tooling. **What it does well** - Detects common OAuth buttons on login pages and lets the user choose the provider via Telegram when multiple options are available. - Recognizes provider-specific OAuth/authorization URLs for Google, Apple, Microsoft, GitHub, Discord, WeChat, and QQ. - Automates the usual click paths for login and consent (account selection, “Allow/Continue/Authorize” buttons, etc.), and handles QR-based flows (WeChat/QQ) using screenshots. - Uses confirmation messages ("Reply with number", "Reply yes") to ensure the user must explicitly approve provider choice and authorization. **Key risks / cautions** - **High-privilege access:** The browser must be pre-logged into major identity providers; compromise of the agent, browser profile, or Telegram channel could enable unauthorized account access or mass app authorizations. - **Scope visibility:** The Telegram confirmation flow asks for a “yes” but may not fully expose requested scopes/permissions; users might approve high-privilege grants without clearly seeing what’s being requested. - **Brittleness to UI/DOM changes:** Provider-specific selectors and flows are inherently fragile; layout or text changes at the OAuth providers can break automation or cause it to click unintended elements. - **2FA and QR dependencies:** While 2FA and QR flows are acknowledged, they still depend heavily on user responsiveness and correct interpretation of screenshots, which can fail or time out. **Recommended scenarios** - You run an autonomous or semi-autonomous agent that frequently needs to log in to OAuth-protected services, and you want to centralize that via a controlled browser profile. - You’re comfortable treating this skill with **password-manager-level sensitivity** (secure Telegram channel, locked-down environment, and careful monitoring). - You need cross-provider OAuth automation (especially including WeChat/QQ QR flows) more than you need rock-solid reliability or minimal latency. If adopted, pair this skill with strong operational security (private Telegram channel, hardened agent environment, and regular review of connected apps and sessions on each OAuth provider).