ab-aswini/.agent-os/skills/auth
.agent-os/skills/auth/SKILL.md
# Authentication & Authorization Skill > Loaded by: BE-005 (Auth), BE-006 (RBAC) | Version: 1.0 ## Password Handling - Hash with bcrypt (cost >= 12) or argon2; NEVER store plaintext - NEVER log passwords; implement password complexity rules ## JWT Tokens - Access tokens: 15-30 min expiry - Refresh tokens: 7-30 days, rotate on use - Minimal claims in payload; NEVER put sensitive data in JWT ## Session Management - HTTP-only, Secure, SameSite cookies - Implement session invalidation and tra
$ install --global
skillsauthnpx skillsauth add ab-aswini/agent-kit-p1 .agent-os/skills/authInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Error
VirusTotalMulti-engine malware detection
70%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 26, 2026, 11:35 AM43.0s1 file scanned
SKILL.md
Authentication & Authorization Skill
Loaded by: BE-005 (Auth), BE-006 (RBAC) | Version: 1.0
Password Handling
- Hash with bcrypt (cost >= 12) or argon2; NEVER store plaintext
- NEVER log passwords; implement password complexity rules
JWT Tokens
- Access tokens: 15-30 min expiry
- Refresh tokens: 7-30 days, rotate on use
- Minimal claims in payload; NEVER put sensitive data in JWT
Session Management
- HTTP-only, Secure, SameSite cookies
- Implement session invalidation and track active sessions
Pattern
from passlib.context import CryptContext
pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
def hash_password(password: str) -> str:
return pwd_context.hash(password)
def verify_password(plain: str, hashed: str) -> bool:
return pwd_context.verify(plain, hashed)
Anti-Patterns
- Do NOT implement custom crypto
- Do NOT store tokens in localStorage
- Do NOT skip token validation on protected endpoints
- Do NOT use MD5/SHA1 for passwords
- Do NOT send tokens in URL parameters
Checklist
- [ ] Passwords hashed with bcrypt/argon2
- [ ] JWT expiry is short and reasonable
- [ ] Refresh tokens rotate on use
- [ ] No sensitive data in tokens
- [ ] HTTPS enforced; brute force protection in place
Related Skills
ab-aswini/webapp-testing
development
VerifiedTrustedCommunity
Web application testing principles. E2E, Playwright, deep audit strategies.
2SKILL.mdUpdated Mar 26, 2026
ab-aswini/web-design-guidelines
development
VerifiedTrustedCommunity
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
2SKILL.mdUpdated Mar 26, 2026
ab-aswini/vulnerability-scanner
testing
VerifiedTrustedCommunity
Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
2SKILL.mdUpdated Mar 26, 2026
ab-aswini/.agent-os/skills/testing
development
VerifiedTrustedCommunity
# Testing Skill > Loaded by: QA Division agents | Version: 1.0 ## Test Pyramid ``` / E2E \ <- Few, slow, expensive / Integr. \ <- Some, moderate / Unit \ <- Many, fast, cheap ``` ## Unit Test Pattern (Arrange, Act, Assert) ```python def test_user_creation(): # Arrange user_data = {"name": "Alice", "email": "[email protected]"} # Act user = UserService.create(user_data) # Assert assert user.name == "Alice" assert user.id is
2SKILL.mdUpdated Mar 26, 2026