DABO-ERP/auth-agnostic-architecture-boundary
.claude/skills/auth-agnostic-architecture-boundary/SKILL.md
Use this skill to enforce strict separation between core system architecture and authentication/authorization concerns.
tools
Updated Apr 17, 2026
$ install --global
skillsauthnpx skillsauth add DABO-ERP/gestion-ERP auth-agnostic-architecture-boundaryInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 4:15 AM366.8s1 file scanned
SKILL.md
- name:
- auth-agnostic-architecture-boundary
- description:
- Use this skill to enforce strict separation between core system architecture and authentication/authorization concerns.
Architectural Boundary Rule
This project is completely agnostic to authentication and authorization.
If a request reaches the system:
- The user is already authenticated
- The user is already authorized
- No permission checks are required
Core Principle
Authentication and authorization are external concerns.
They are handled by:
- API gateways
- Identity providers
- BFFs
- External security layers
They are never handled inside:
- Domain logic
- Application use cases
- Core services
- Business rules
Explicit Rules
- Do not model roles, permissions, or access levels
- Do not check user privileges in code
- Do not branch logic based on user identity or role
- Do not leak auth concepts into domain language
The system assumes trusted, pre-authorized input.
Mental Model for the AI Agent
Think of the system as operating in a secure internal network:
- Every request is valid
- Every action is permitted
- Focus exclusively on business correctness
If a feature requires authorization logic,
it is out of scope by design.
Violations of this rule are architectural bugs, not security improvements.
Related Skills
openclaw/taskflow
tools
VerifiedTrustedCommunity
Use when work should span one or more detached tasks but still behave like one job with a single owner context. TaskFlow is the durable flow substrate under authoring layers like Lobster, ACPX, plugins, or plain code. Keep conditional logic in the caller; use TaskFlow for flow identity, child-task linkage, waiting state, revision-checked mutations, and user-facing emergence.
357,764SKILL.mdUpdated Apr 10, 2026
openclaw/extensions/lobster
tools
VerifiedTrustedCommunity
# Lobster Lobster executes multi-step workflows with approval checkpoints. Use it when: - User wants a repeatable automation (triage, monitor, sync) - Actions need human approval before executing (send, post, delete) - Multiple tool calls should run as one deterministic operation ## When to use Lobster | User intent | Use Lobster? | | ------------------------------------------------------ | --------------------------
357,764SKILL.mdUpdated Apr 10, 2026
steipete/extensions/lobster
tools
VerifiedTrustedCommunity
# Lobster Lobster executes multi-step workflows with approval checkpoints. Use it when: - User wants a repeatable automation (triage, monitor, sync) - Actions need human approval before executing (send, post, delete) - Multiple tool calls should run as one deterministic operation ## When to use Lobster | User intent | Use Lobster? | | ------------------------------------------------------ | --------------------------
357,588SKILL.mdUpdated Apr 13, 2026
steipete/xurl
tools
VerifiedTrustedCommunity
A CLI tool for making authenticated requests to the X (Twitter) API. Use this skill when you need to post tweets, reply, quote, search, read posts, manage followers, send DMs, upload media, or interact with any X API v2 endpoint.
356,423SKILL.mdUpdated Apr 13, 2026