auth-security

Authentication and authorization security, JWT lifecycle, OAuth 2.1 and OIDC flows, PKCE, and RBAC/ABAC access control.

IndexedMIT★ 1

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/arvnfly-auth-security

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Authentication and authorization security, JWT lifecycle, OAuth 2.1 and OIDC flows, PKCE, and RBAC/ABAC access control.

Use cases: security, agent-building

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.

Tools: No tools found
Secrets: None asked for
Install scripts: None found

Network hosts it talks to 1

codeload.github.com · found in install command

Files it touches

~/.claude/skills/auth-security

What's inside

Skill name: auth-security
Description: Authentication and authorization security, JWT lifecycle, OAuth 2.1 and OIDC flows, PKCE, and RBAC/ABAC access control.
License: MIT
Instructions: 31 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# Authentication & Access Control Security Protocol

When implementing login, session tokens, identity providers, or role permissions, enforce these standards.

---

## 1. Token Lifecycles & Storage

1. **Short-Lived Access Tokens**:
   - Access tokens should expire in 10-15 minutes.
   - Refresh tokens should be long-lived (e.g. 7-30 days) and stored in HttpOnly; Secure; SameSite=Lax cookies, never in localStorage.
2. **Refresh Token Rotation**:
   - Invalidate the old refresh token immediately upon issuing a new pair.
   - If an invalidated refresh token is reused, revoke the entire token family immediately (indicates token theft).

---

## 2. OAuth 2.1 & PKCE

1. Always use Proof Key for Code Exchange (PKCE) for both public (SPA, mobile) and confidential clients.
2. Eliminate the deprecated OAuth 2.0 Implicit Flow.
3. Validate state and nonce parameters strictly to prevent CSRF authentication replay attacks.

---

## 3. RBAC & ABAC Enforcement

1. Perform authorization checks at the data service/controller boundary, never rely solely on frontend UI hiding.
2. Enforce tenancy boundaries: Every query must verify that the requesting user's organization matches the target resource.

From arvnfly/VIBE-CODE-SKILLS, MIT.

Signals

Stars: 1
Forks: 0
Open issues: 0
Last commit (this folder): Oct 19, 2026 (10 days ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/arvnfly/VIBE-CODE-SKILLS
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

More from arvnfly

Cite this page

auth-security skill. Agent Mart. https://agentmart.dev/skills/arvnfly-auth-security (last updated 2026-10-24)