Skills auth-implementation-patterns
📦

auth-implementation-patterns

Content revision r1 High Risk ⚙️ External commands🔑 Env variables

Build Secure Auth Systems

Teams need reliable authentication and authorization without rebuilding common patterns. This skill provides guidance for JWT, sessions, OAuth2, RBAC, and password security.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "auth-implementation-patterns" from https://skillstore.io/skills/sickn33-auth-implementation-patterns.md and its manifest at https://skillstore.io/api/skills/sickn33-auth-implementation-patterns/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-auth-implementation-patterns.md Signed manifest GET /api/skills/sickn33-auth-implementation-patterns/manifest Signed lockfile GET /api/skills/sickn33-auth-implementation-patterns/lockfile

Test it

Using "auth-implementation-patterns". I need authentication for a small SaaS API with web and mobile clients.

Expected outcome:

  • Recommended approach: short-lived access tokens with refresh token rotation.
  • Key controls: secure token storage, revocation, rate limits, and server-side authorization checks.
  • Open questions: identity provider choice, tenant boundaries, and account recovery rules.

Using "auth-implementation-patterns". Review my admin and user permissions before I build endpoints.

Expected outcome:

  • The review separates roles from permissions and identifies each protected resource.
  • It recommends middleware checks for authentication, role scope, and resource ownership.
  • It calls out missing denial cases and audit events for sensitive actions.

Using "auth-implementation-patterns". Improve the security of an existing password login flow.

Expected outcome:

  • The plan adds stronger password hashing, login rate limits, and generic error messages.
  • It also covers secure cookies, session expiration, and security event logging.

Security Audit

High Risk
v5 • 7/23/2026 Open versioned report

The static hits are false positives from Markdown examples that show environment-based configuration and inline code paths. One semantic issue remains: the OAuth callback example redirects with an access token in a query string, which can leak through history, logs, and referrers.

2
Files scanned
667
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (1)

High
resources/implementation-playbook.md:329
Access Token Exposed in OAuth Redirect URL
The OAuth callback example redirects to the frontend with token=${tokens.accessToken} in the query string. Access tokens in URLs can leak through browser history, logs, analytics, and referrer headers.
The code sample directly places the generated access token in the redirect URL. This is a well-known token exposure risk in OAuth callback handling.

Risk Factors

⚙️ External commands (3)
resources/implementation-playbook.md:329-332 SKILL.md:33 SKILL.md:42
🔑 Env variables (23)
resources/implementation-playbook.md:58 resources/implementation-playbook.md:64 resources/implementation-playbook.md:74 resources/implementation-playbook.md:137 resources/implementation-playbook.md:165 resources/implementation-playbook.md:215 resources/implementation-playbook.md:222 resources/implementation-playbook.md:226 resources/implementation-playbook.md:289 resources/implementation-playbook.md:290 resources/implementation-playbook.md:329 resources/implementation-playbook.md:58 resources/implementation-playbook.md:64 resources/implementation-playbook.md:74 resources/implementation-playbook.md:137 resources/implementation-playbook.md:165 resources/implementation-playbook.md:215 resources/implementation-playbook.md:222 resources/implementation-playbook.md:226 resources/implementation-playbook.md:289 resources/implementation-playbook.md:290 resources/implementation-playbook.md:329 resources/implementation-playbook.md:215
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-auth-implementation-patterns/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-auth-implementation-patterns/security.svg)](https://skillstore.io/skills/sickn33-auth-implementation-patterns?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-auth-implementation-patterns?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-auth-implementation-patterns/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-auth-implementation-patterns.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). auth-implementation-patterns security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-auth-implementation-patterns/audits/5

BibTeX citation

@techreport{sickn33-sickn33-auth-implementation-patterns-2026, author = {sickn33}, title = {auth-implementation-patterns security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-auth-implementation-patterns/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "auth-implementation-patterns security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-23" url: "https://skillstore.io/skills/sickn33-auth-implementation-patterns/audits/5" identifiers: - type: other value: "skillstore:sickn33-auth-implementation-patterns:audit:5" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Highest Skillstore Score
wshobson Recommended

wshobson-auth-implementation-patterns

Skillstore Score 69
Evidence Confidence High
Skillstore usage 13
Updated

2026-08-21

sickn33 Current

sickn33-auth-implementation-patterns

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 7
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Design a New Login System

Select a session, JWT, or OAuth2 approach for a new web service.

Review Authorization Rules

Map roles, permissions, and ownership checks before implementation.

Harden Existing Auth Flows

Improve token lifetimes, cookie settings, password hashing, and rate limits.

Try These Prompts

Choose an Auth Strategy 
Use this skill to compare session, JWT, and OAuth2 authentication for my app. Recommend one approach and explain the tradeoffs.
Plan Token Lifecycles 
Use this skill to design access token and refresh token lifecycles. Include expiration, storage, rotation, logout, and revocation behavior.
Model Authorization Rules 
Use this skill to design RBAC and resource ownership rules for these user roles and resources. Include enforcement points and failure cases.
Audit a Production Flow 
Use this skill to review my authentication flow for production risks. Focus on secrets, cookies, token exposure, logging, rate limits, and recovery flows.

Best Practices

  • Define users, tenants, flows, and threat models before choosing an auth pattern.
  • Keep tokens and secrets out of logs, URLs, browser storage, and client-controlled data.
  • Validate authentication and authorization on the server for every protected action.

Avoid

  • Do not store JWTs in localStorage when HttpOnly cookies are available.
  • Do not rely only on client-side role checks for protected actions.
  • Do not ship copied examples without adapting secrets, storage, and error handling.

Frequently Asked Questions

What types of authentication does this skill cover?
It covers sessions, JWTs, OAuth2, OpenID Connect, password login, and common token lifecycle choices.
Can it help with authorization design?
Yes. It covers RBAC, permission checks, and resource ownership patterns for server-side enforcement.
Does it replace a security audit?
No. It provides implementation guidance, but production systems still need testing and expert review.
Which tools can use this skill?
The report lists support for Claude, Codex, and Claude Code.
Does it include deployment-specific setup?
No. You must adapt examples to your framework, identity provider, database, and hosting platform.
What inputs improve the results?
Provide user roles, protected resources, login flows, token storage needs, and compliance requirements.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/auth-implementation-patterns

Ref

86d877f219e2131f05dd5b37c5e329c71c7b8ec4

Maintenance freshness

7/26/2026

Usage

6 downloads · 128 views

File structure

📁 resources/

📄 implementation-playbook.md

📄 SKILL.md

More from sickn33

View all

Related Skills

View all