“authentication”

Authentication security testing - auth bypass, JWT attacks, OAuth flaws, password attacks, 2FA bypass, CAPTCHA bypass, and bot detection evasion.

Audit and implement secure authentication flows.

Authentication: JWT/OAuth-OIDC/sessions/API keys, password storage, secrets, CSRF/CORS/cookies.

Implement or review authentication and authorization flows, sessions/tokens, password/reset flows, role access, and secure identity integration.

Use for identity establishment and binding across login, registration, verification, reset, magic link, MFA, recovery, account linking, federation, device…

Use when wiring auth to a new project, debugging login errors (redirect_uri_mismatch, invalid_grant, session callback, refresh_token), or adding social/magic…

Password hashing (scrypt), server-side session tokens, HTTP-only cookies, and auth events.

Implement OAuth 2.0, OIDC, sessions, token lifetimes, MFA and password storage without rolling your own crypto.

Agent skill for authentication - invoke with $agent-authentication

Implement or review NewHeap consumer authentication and authorization, including session lifecycle, two-factor authentication, passkeys, token customization…

Use this skill when you need evidence-bounded authentication-testing analysis and validation preparation; triggers include 身份认证测试 and authentication-testing.

Expert guidance on authentication implementation including OAuth 2.0/OIDC, JWT tokens, session management, and secure password handling.

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential…

Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes.

Use when designing, implementing, reviewing, or testing authentication, protected routes, sessions, roles, permissions, ownership rules, or authorization…

Authentication bypass testing playbook.

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors…

Use when adding or changing Phoenix authentication, phx.gen.auth integration, LiveView session identity, or migration between current_user and Phoenix 1.8…

Implement browser authentication flows with explicit cookie/token, CSRF, refresh, logout and session-expiry contracts.

Implements authentication and authorisation systems including JWT, OAuth2, sessions, MFA, social login, RBAC, and refresh token rotation.

Assess authentication and session behavior using explicitly approved test accounts.

Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better…

Login, signup, password reset, SSO, MFA, and authentication UX patterns.

Implement authentication with JWT, OAuth2, SSO, MFA, and session management