Service abuse: Google OAuth with suspicious redirect destination

type.inbound
and any(body.links,
        .href_url.domain.domain == "accounts.google.com"
        and strings.istarts_with(.href_url.path, '/o/oauth2/v2/auth')
        and strings.icontains(.href_url.url, 'prompt=none')
)