5.9K skills · sorted by relevance
Authentication & Authorization Implementation Patterns workflow skill. Use this skill when the user needs Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
The English summary is being prepared. Showing the original description.
Implement authentication and authorization with OWASP Top 10 standards, OAuth 2.0 + OIDC, WebAuthn/Passkeys, session management, and RBAC/ABAC. Use when user asks to implement login, signup, authentication, authorization, JWT, OAuth, SSO, passkeys, MFA, or role-based access. Do NOT use for API key management (use api-forge), encryption at rest, or network-level security (firewalls, WAF).
The English summary is being prepared. Showing the original description.
Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.
The English summary is being prepared. Showing the original description.
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token vali...
The English summary is being prepared. Showing the original description.
Better Auth (TypeScript 認証フレームワーク) v1.7 リファレンス。 認証・認可、サインアップ・サインイン、セッション管理、OAuth、パスキー、二要素認証 (2FA / TOTP)、SSO / SAML、SCIM、 OAuth Provider (OAuth 2.1 / OIDC)、MCP 認可 (@better-auth/mcp)、Infrastructure (dash / sentinel)、 プラグイン (organization, admin, magic-link, anonymous 等)。betterAuth, createAuthClient, signUp, signIn, getSession。 Next.js, Nuxt, SvelteKit, Hono, Express, Expo, TanStack, Effect 統合。
The English summary is being prepared. Showing the original description.
Set up and check OmniRoute authentication for API access and dashboard sessions. Use Bearer credentials for remote requests, manage login cookies, inspect authentication status, and configure OIDC, a standard for signing in through an identity provider.
Review article bylines to check that author names, roles, and biography links are clearly visible. Inspect rendered pages and related metadata to identify specific pages or templates that need clearer author information.
Audit whether author profiles clearly present relevant experience, qualifications, and professional links. Review rendered pages, metadata, structured data, and HTTP responses to identify specific places where author expertise needs clearer presentation and explain how to verify improvements.
Implement or review login and access controls for applications and APIs. Helps define token lifetimes, session handling, and permissions for specific resources, with checks for user identity, organization boundaries, credential storage, and authentication failures.
Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.
Assess authorized single sign-on systems using SAML, OIDC, and OAuth2. Map the login flow, check signatures, redirects, and token validation, then document reproducible findings and their impact, including identity or tenant confusion.
Create a Microsoft 365 Copilot agent that connects to external systems through MCP, a protocol for accessing tools and data. Generate project configuration, select available functions, configure authentication, and follow provisioning and testing steps.
Build a two-tier certificate authority with OpenSSL and Python, separating the offline root from the issuing authority. Covers server and client certificates, revocation checks, and policies that define certificate usage and trust.
Build server-side Zoom integrations for meeting scheduling, user management, and recording downloads. This reference guides API endpoint selection, OAuth authentication, request limits, and error diagnosis, with examples for automated workflows and event notifications.
Operate Chrome or Brave using signed-in browser sessions to verify deployed pages, reproduce bugs, inspect page structure, and examine errors or network traffic. An optional macOS bridge extends control to native applications and operating system input.
Prepare a local LangBot environment for development and browser testing. The skill covers service startup, shared connection settings, browser access, proxy troubleshooting, and reusable login profiles, with guidance for Linux and WSL environments.
Implement application security controls, including login, access permissions, password hashing, and input validation. The skill provides code, configuration requirements, and testing guidance for checking protections against unauthorized access, malicious input, and sensitive data exposure.
Build and debug Java applications with Spring Boot 3.x. This skill guides application design, API implementation, database query tuning, authentication, and testing, including WebFlux applications that process requests without blocking.
Build and maintain TypeScript MCP servers that connect AI to tools, plus interactive MCP Apps, using mcp-use. The skill guides implementation, authentication, migration, and verification based on the package version and types installed in the project.
Build and maintain TypeScript MCP servers that connect AI to tools, plus interactive MCP Apps, using mcp-use. The skill guides implementation, authentication, migration, and verification based on the package version and types installed in the project.
Prepare a Python environment for Mixpanel analysis by installing required libraries and checking credentials and connectivity. Use it for first-time setup, missing dependencies, or guidance on service account and OAuth sign-in options.
Assess account takeover risks across password resets, email changes, JWT tokens, SSO, and recovery flows. The skill connects individual weaknesses into testable scenarios and requires proof that an attacker session can gain access to a separate test account.
Test how applications trust Host and forwarding headers to identify poisoned password reset links, shared cache contamination, and unintended internal requests. The skill provides validation criteria to distinguish reflected values from demonstrated security impact.
Authentication, authorization, and API security implementation. Use when building user systems, protecting APIs, or implementing access control. Covers OAuth 2.1/OIDC, JWT patterns, sessions, Passkeys/WebAuthn, RBAC/ABAC/ReBAC, policy engines (OPA, Casbin, SpiceDB), managed auth (Clerk, Auth0), self-hosted (Keycloak, Ory), and API security best practices.
The English summary is being prepared. Showing the original description.