6026 个 · 按相关度排序
Authentication & Authorization Implementation Patterns workflow skill. Use this skill when the user needs Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
中文简介正在准备中。当前显示原文说明。
Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or credential handling issues. Covers JWT algorithm confusion, OAuth redirect manipulation, and rate limit bypass.
中文简介正在准备中。当前显示原文说明。
Webアプリのアクセス制御・認証・認可の実装はすべてこのスキルを使う。遮断だけならCloudflare Access、アプリ内identity・role・session・WebSocket等が必要ならBetter Authとする単一決定表の正本。「認証を付けて」「ログイン機能」「Googleでログインできるように」「社員だけに限定」「特定企業だけに公開」「許可リスト/招待制」「メール+パスワード認証」「セッション管理」「ロール・権限管理」「OAuth設定」「redirect_uri_mismatchを直す」「認証のセキュリティレビュー」などの文脈で、ユーザーが「認証」と明示しなくてもログイン要件が含まれるなら必ず読む。特にNext.js App Router＋OpenNext＋D1、Hono、素のWorkersでのBetter Auth＋Google OAuth導入を自動化し、Google Cloud Consoleで人間にしかできない操作は日本語のクリック手順と直リンクへ切り分ける。
中文简介正在准备中。当前显示原文说明。
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
中文简介正在准备中。当前显示原文说明。
Use for Nauthilus authentication and identity-provider work touching OIDC, OAuth2, SAML, MFA, TOTP, WebAuthn, recovery codes, LDAP-backed identity, browser login and consent flows, token/session/flow state, `private_key_jwt`, introspection, discovery metadata, endpoint-specific client authentication, and security-sensitive auth tests.
中文简介正在准备中。当前显示原文说明。
Expert Convex Auth setup, production, OAuth, security, and debugging guidance. Use when adding or auditing Convex Auth, configuring GitHub/Google/Apple OAuth, setting auth env vars, protecting Convex functions with getAuthUserId, debugging callback URLs, preparing production auth, rotating keys, or reviewing auth security.
中文简介正在准备中。当前显示原文说明。
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
中文简介正在准备中。当前显示原文说明。
Implement secure authentication and authorization systems with JWT, OAuth2, Session-based auth, and RBAC. Use when: (1) implementing user login/signup, (2) setting up JWT tokens, (3) OAuth2 integration (Google, GitHub, etc.), (4) role-based access control (RBAC), (5) password hashing and validation, (6) session management, (7) API authentication middleware, (8) 2FA/MFA setup. Triggers: "authentication", "login", "JWT", "OAuth", "session", "password hash", "RBAC", "permissions", "2FA".
中文简介正在准备中。当前显示原文说明。
Authentication and authorization patterns - JWT, OAuth2, sessions, RBAC, ABAC, passkeys, and MFA. Use for: authentication, authorization, jwt, oauth, oauth2, session, login, rbac, abac, passkey, mfa, totp, api key, token, auth, cookie, csrf, cors credentials, bearer token, refresh token, oidc.
中文简介正在准备中。当前显示原文说明。
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
中文简介正在准备中。当前显示原文说明。
Review author information in structured data, a machine-readable description of page content. Check names, profile links, and connections to articles or pages, then identify corrections using the rendered HTML and HTTP response.
中文简介正在准备中。当前显示英语简介。
Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.
中文简介正在准备中。当前显示英语简介。
Assess authorized APIs through a ten-stage workflow covering endpoint discovery, authentication, access permissions, input handling, and request limits. Collect reproducible evidence and turn findings into regression checks that can run in a development pipeline.
中文简介正在准备中。当前显示英语简介。
Review suspicious emails for phishing and business email fraud by examining sender authentication, message content, links, and attachments. Organize indicators of compromise, which are traces of malicious activity, and recommend controls for the email environment.
中文简介正在准备中。当前显示英语简介。
Configure SAML identity federation, a way to share authentication between systems, linking on-premises Active Directory with Microsoft Entra ID. Cover single sign-on for cloud applications, user attribute mapping, authentication model choices, and signing certificate management.
中文简介正在准备中。当前显示英语简介。
Assess authorized web applications for pages and APIs that allow access without authentication. Discover hidden URLs and exposed configuration or backup files, compare signed-in and signed-out responses, and document affected resources, impact, and recommended fixes.
中文简介正在准备中。当前显示英语简介。
Build connections between applications and external APIs, interfaces used to exchange data with other services. The skill guides authentication, data conversion, webhook verification, request limits, retries, and troubleshooting to support reliable API clients.
中文简介正在准备中。当前显示英语简介。
Assess Wi-Fi disconnection and reconnection behavior using deauthentication and disassociation tests. The skill covers client targeting, handshake capture, protected management frames, transmission scope and rate, and reporting observed effects and detection signals.
中文简介正在准备中。当前显示英语简介。
Investigate authentication gaps across single sign-on, APIs, and legacy login endpoints. The skill helps map entry points, compare their protections, test token trust between portals, and document whether a flaw grants access to protected accounts or functions.
中文简介正在准备中。当前显示英语简介。
Assess web application login and session security, including password rules, multi-factor authentication, and password resets. The skill guides testing and documents weaknesses, session behavior, and recommendations for strengthening authentication.
中文简介正在准备中。当前显示英语简介。
Build user authentication into a PinMe app using TypeScript Workers and Firebase Auth. The skill covers email registration, checking login tokens as proof of identity, Google sign-in integration, user lookups, and paginated user lists.
中文简介正在准备中。当前显示英语简介。
Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).
中文简介正在准备中。当前显示原文说明。
Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/missingauth-results.md. Use when asked to find missing auth, broken access control, or privilege escalation bugs.
中文简介正在准备中。当前显示原文说明。
Implement authentication and authorization using @delon/auth. Use this skill when adding login/logout flows, JWT token management, role-based access control (RBAC), route guards, HTTP interceptors, and session management. Integrates with Firebase Auth and custom permission systems. Ensures secure token storage, automatic token refresh, and consistent authorization checks across components and services.
中文简介正在准备中。当前显示原文说明。