agentsclimarketplace
Sign in

Shelves Data & backend

Auth & identity

1,766 rows from 432 repositories

Who is asking, and what they are allowed to do.

What Auth & identity skills agree on

413 skill files read, by 408 of the 432 authors on this shelf whose files we hold, 2026-09-06

The middle one of the 74 measured here is ~1.5k tokens long, counted with cl100k_base

Counted by distinct author, so one author publishing three of these counts once. Where a claim sits in fewer files than authors, that is said: a claim held by forty authors across three files is one file people copied, not forty people who agreed. Near-identical wordings are grouped and the other wordings are shown, so the grouping is yours to check.

What they tell the agent to do

  1. Use parameterized queries for all SQL and database access to prevent SQL injection60 of 408 in 40 filesalso worded as Use parameterized queries for all database access; Parameterize all database queries
  2. Hash passwords with bcrypt or Argon2id50 of 408 in 34 filesalso worded as Hash passwords with bcrypt or argon2; Hash passwords with bcrypt or argon2id
  3. Store secrets in Vault or environment variables37 of 408 in 17 filesalso worded as Store all secrets in environment variables; Store secrets in environment variables or secret managers
  4. Add security headers to all responses28 of 408 in 14 filesalso worded as Set security headers on all responses; Set security headers on responses
  5. Rate limit public endpoints per client22 of 408 in 8 filesalso worded as Rate limit authentication endpoints; Implement rate limiting for public endpoints
  6. Store tokens in httpOnly cookies21 of 408 in 16 filesalso worded as Store auth tokens in httpOnly cookies, not localStorage; Store auth tokens in httpOnly cookies
  7. Apply rate limiting to all API endpoints17 of 408 in 9 filesalso worded as Rate limit all API endpoints; implement rate limiting on auth endpoints
  8. Use HTTPS in production17 of 408 in 4 filesalso worded as always use HTTPS in production; Force HTTPS in production
  9. Validate all user input with schemas15 of 408 in 10 filesalso worded as Validate all user input against schemas; Validate every input against a strict schema at the boundary
  10. Validate all user input server-side14 of 408 in 12 filesalso worded as Validate all input server-side; Validate all input on the server side
  11. Validate all input with Bean Validation16 of 408 in 3 filesalso worded as Validate all request bodies with Bean Validation
  12. Return generic error messages to users12 of 408 in 9 filesalso worded as Return generic error messages to clients; Return generic error messages in production
  13. Set HttpOnly, Secure, and SameSite cookie flags12 of 408 in 11 filesalso worded as Check httpOnly, Secure, SameSite flags on JWT cookies; Set HttpOnly, Secure, SameSite cookie attributes
  14. Rate limit auth endpoints12 of 408also worded as Rate-limit expensive and authentication endpoints; Apply strict rate limits to auth endpoints
  15. Validate all external input at system boundaries12 of 408also worded as Validate all inputs at boundaries; Validate every external input at the boundary with allowlists

What they tell it not to do

  1. Never store plaintext passwords37 of 408 in 21 filesalso worded as Never store plain-text passwords; never store passwords in plaintext or reversibly encrypted form
  2. Never concatenate user input into SQL36 of 408 in 20 filesalso worded as Never concatenate user input into SQL strings; Never build SQL by string concatenation
  3. Never store tokens in localStorage34 of 408 in 27 filesalso worded as Never store auth tokens in localStorage; Never store session tokens in localStorage
  4. Never log passwords, tokens, or payment data28 of 408 in 22 filesalso worded as Never log passwords, tokens, or payment details; Never log passwords, tokens, or card numbers
  5. Never hardcode secrets in source code26 of 408 in 21 filesalso worded as Never hardcode secrets or credentials; Never hardcode secrets
  6. Never expose stack traces to users22 of 408 in 17 filesalso worded as Never expose stack traces or internal errors to users; Never expose stack traces to clients
  7. Never hash passwords with MD5 or SHA120 of 408 in 19 filesalso worded as Never use MD5, SHA-1, or SHA-256 for passwords; Never use MD5 or SHA1 for passwords
  8. Never commit secrets to version control18 of 408 in 15 filesalso worded as Never commit secrets to git history; Never commit secrets to source control
  9. Avoid unsafe-inline in CSP script-src17 of 408 in 4 filesalso worded as Avoid unsafe-inline for script-src in CSP; Don't allow unsafe-inline scripts in CSP
  10. Never trust client-side validation alone16 of 408 in 14 filesalso worded as Never trust client-side validation as a security boundary; Never trust the identity token client-side alone

What they expect to be installed

  1. curl46 of 408 in 44 files
  2. npm audit36 of 408 in 29 files
  3. bcrypt28 of 408 in 25 files
  4. zod27 of 408 in 19 files
  5. express-rate-limit22 of 408 in 14 files
  6. Redis21 of 408 in 20 files
  7. grep19 of 408
  8. HashiCorp Vault19 of 408 in 6 files
  9. DOMPurify15 of 408 in 10 files
  10. npm15 of 408

What they ask it to produce

  1. Automated security tests10 of 408 in 5 filesalso worded as Security tests
  2. Completed pre-deployment security checklist10 of 408 in 5 filesalso worded as Completed security verification checklist; completed zero-trust pre-deployment checklist
  3. Security header middleware6 of 408 in 5 filesalso worded as Security middleware configuration
  4. File upload validators5 of 408 in 4 files
  5. Application code implementing the OAuth flow5 of 408 in 3 filesalso worded as OAuth login flow implementation; application code integrating the OAuth flow
  6. Enumeration result files in JSON4 of 408 in 1 file
  7. Forced browsing finding report4 of 408 in 1 file
  8. Secure implementation code4 of 408 in 2 filesalso worded as secure code

When Auth & identity authors say to reach for one

The situations these authors wrote into their own files, counted out of the same 408 authors, with the skills that name each one

How Auth & identity skills are built

1,555 skill directories by 404 authors, read from their repositories’ own file trees 2026-08-05

The middle bundle among those shipping files is 3 files, 20.0 KB beside SKILL.md

Counted by distinct author, same as above, so one author publishing forty template copies counts once. SKILL.md itself is not counted as a file, so a single-file skill is one where that file is the whole skill.

The shape

  1. SKILL.md is the whole skill156 of 404 authors, 676 of 1,555 skills
  2. files ship beside it248 of 404 authors, 879 of 1,555 skills
  3. executable scripts ship inside74 of 404 authors, 267 of 1,555 skills

The folders they converge on

  1. references/171 of 404 authors, 581 of 1,555 skills
  2. scripts/64 of 404 authors, 250 of 1,555 skills
  3. assets/29 of 404 authors, 83 of 1,555 skills
  4. agents/27 of 404 authors, 52 of 1,555 skills
  5. evals/21 of 404 authors, 33 of 1,555 skills
  6. examples/19 of 404 authors, 23 of 1,555 skills

  • Owasp security

    agamm/claude-code-owasp/.claude/skills/owasp-security Skill

    325★ repo

    Claude Code skill for OWASP security best practices (2025-2026). Includes Top 10:2025, ASVS 5.0, Agentic AI security, and 20+ language-specific security quirks.

  • Mcp server

    thoughtspot/mcp-server/app.thoughtspot/mcp-server MCP server

    no license33★ repo

    MCP Server for ThoughtSpot - provides OAuth authentication and tools for querying data

  • Api designer

    AutumnsGrove/ClaudeSkills/api-designer Skill

    no license26★ repo

    Skills for Claude.ai and Claude Code

  • Authentication failures

    scholarly360/owasp-top10-web-skills/skills/authentication-failures Skill

    20★ repo

    Agent Skills for OWASP Top 10 Application Security Risks (https://owasp.org/Top10/2025/)

  • Api security

    ShieldNet-360/secure-vibe/dist/agent-skills/.agents/skills/api-security Skill

    15★ repo

    SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

  • Appstore connect mcp

    ryaker/appstore-connect-mcp/io.github.ryaker/appstore-connect-mcp MCP server

    15★ repo

    MCP server for Apple Store Connect API integration with OAuth authentication support

  • Dsgvo auth and logging

    wuemaikblume/dsgvo-skills/claude/skills/dsgvo-auth-and-logging Skill

    no license11★ repo

    DSGVO Compliance Skills für Claude AI / Claude Code — DACH-fokussierte Best-Practice-Sammlung für Drittlandtransfer (Art. 44-49) mit US-CLOUD-Act-Hinweis

  • Saas security

    vitormiziara/saas-security Skill

    10★

    Claude skill for SaaS security auditing — 16 domains, 95 checks, OWASP-based

  • Agent identity

    23blocks-OS/ai-maestro-plugins/plugins/ai-maestro/skills/agent-identity Skill

    8★ repo

    Build complete AI agents — 150+ personalities + 7 skills + messaging + identity. The skill builder for AI Maestro.

  • Backend engineer

    pranav8494/team-of-agents/skills/backend-engineer Skill

    7★ repo

    A team of agents to support SDLC of a project.

  • MCP Gateway

    PanosSalt/MCP-Gateway/io.github.PanosSalt/MCP-Gateway MCP server

    6★ repo

    Multi-tenant MCP platform with OAuth 2.1, Entra SSO, RBAC and audit logging.

  • Tidal auth

    SteveGrosbois/tidal-cli/skills/tidal-auth Skill

    no license4★ repo

    A headless Python CLI for interacting with the Tidal music streaming API, designed for LLM agent automation. Supports OAuth authentication, artist/album/track search, playlist management (create, rename, delete, add/remove tracks), and library favorites. Outputs human-readable text or structured JSON via a --json flag.

  • Azcli

    marcfargas/skills/azcli Skill

    4★ repo

    Reusable skills for AI coding agents (pi, Claude Code, Agent Skills standard)

  • Kaltura api

    kaltura/kaltura-agents-api-guides/.agents/skills/kaltura-api Skill

    4★ repo

    Everything AI agents need to master the full Kaltura platform — The Agentic Digital Experience Platform. Live-tested API guides with curl examples and end-to-end test scripts. Agent Skill, llms.txt, and Context7 ready.

  • Secure code auditor

    n-shadloo/secure-code-auditor Skill

    4★

    Backend security Agent Skill that helps AI audit code, detect vulnerabilities, and generate secure-by-default backend applications, with deep Django/DRF coverage and guidance for any backend stack.

  • Bughunterpro

    sector-b79/web-hunter-pro/claude/skills/bughunterpro Skill

    no license3★ repo

    BugHunterPro is a practical AI bug hunting skill collection for Codex, Claude, and Gemini.

  • Elasticsearch expert

    Erni/agent-skills/elasticsearch-expert Skill

    no license2★ repo

    AI Agent skills

  • Claude laravel 13 skill

    Deixtra-Private-Limited/claude-laravel-13-skill Skill

    2★

    Built for developers who want Claude to generate production-ready Laravel 13 code that follows modern best practices, uses the latest PHP attributes, and leverages Laravel's newest features out of the box.

  • Asc api

    raydeveloperF/App-Store-Connect-release-kit/skills/asc-api Skill

    2★ repo

    A Claude Code and Codex plugin with Agent Skills for localized App Store Connect release workflows

  • Fastbound api

    FastBound/skills/skills/fastbound-api Skill

    no license1★ repo

    Official FastBound Agent Skills for AI coding assistants — integrate with FastBound's products and APIs.

  • Dianpo

    jyuwaaw/dianpo-skill/skills/dianpo Skill

    1★ repo

    Claude Code skill that explains the mental model behind any technical mechanism — who issues the token, who verifies whom, and why it's designed that way. 点破技术机制背后的信任拓扑。

  • Reverse engineering skill github copilot

    sarveshtalele/reverse-engineering-skill-github-copilot Skill

    no license1★

  • Authos backend integration

    drmhse/authos_skill/authos-backend-integration Skill

    1★ repo

    Source-verified Agent Skills for implementing and operating AuthOS.

  • Postgres auth security review

    maherukhislam/postgres-auth-security-review/skills/postgres-auth-security-review Skill

    1★ repo

    An Agent Skill that reviews and writes PostgreSQL/Supabase authentication code against a researched set of common and uncommon security mistakes - before it ships.

  • Atlassian skill

    sanjay3290/atlassian-skill Skill

    0★

    Atlassian (Jira + Confluence) skill for AI coding assistants — manage issues, wiki pages, sprints with OAuth 2.1 or API token auth

  • Aisense free public rest apis

    aisenseapi/aisense-free-public-rest-apis Skill

    no license0★

    Free, public, no-auth REST APIs from AI SENSE AS — clients for OpenClaw, Python, JavaScript, OpenAI function calling, Claude, and many more

  • Auth

    slogsdon/skills-engineering-reference/skills/auth Skill

    0★ repo

    Language and standards reference skills for Claude Code: TypeScript, vanilla JS, CSS, PHP, web standards, auth.

  • Mcp auth helper

    sanjibani/mcp-skills-pack/skills/mcp-auth-helper Skill

    0★ repo

    5 ready-to-use Claude Skills that teach Claude the operational best practices of working with MCP servers (auth, error decoding, tool routing, schema discovery, rate-limit handling)

  • Nestjs

    iamursky/nestjs-skill/skills/nestjs Skill

    0★ repo

    Reference skill for NestJS — the progressive, TypeScript-first Node.js framework.

  • Secure development

    siam-hossain9/secure-development-skill/plugins/secure-development/skills/secure-development Skill

    0★ repo

    Secure Development — a Claude Code skill: 23 security reference domains + a phase-by-phase secure build lifecycle (secure-by-design).

  • Plori

    plori-ai/skills/plori Skill

    0★ repo

    Agent Skills for plori: teach any coding agent to create and drive plori agents (cloud computers for AI agents)

  • Auth hardening

    AL-JANEF/janefskills/auth-hardening Skill

    0★ repo

    Defensive security & production-grade engineering skills for Claude Code — auth, OWASP audit, threat modeling, secrets, logging.

  • Building elysia apis

    WasDavidOliveira/irracional-skills/builder/building-elysia-apis Skill

    no license0★ repo

    Agent Skills para Cursor & Claude Code: revisão crítica + APIs Bun/Elysia/Drizzle/Zod — padrões que o chat não “inventa” de novo a cada conversa.

  • Liberfi auth

    liberfi-io/liberfi-skills/skills/liberfi-auth Skill

    no license0★ repo

  • Saas auth shield

    Rui-Huang-dotcom/saas-auth-shield Skill

    0★

    Add SaaS authentication with signup-abuse protection, including device fingerprinting, per-device account limits, and migration support for existing auth systems.

  • Better auth best practices

    escwxyz/skills-re/.agents/skills/better-auth-best-practices Skill

    no license0★ repo

    Code for SKILLS.re

  • Monocloud auth aspnetcore

    monocloud/agent-skills/plugins/monocloud/skills/monocloud-auth-aspnetcore Skill

    0★ repo

    Official MonoCloud Agent Skills repository.

  • Auth supabase complete

    JimmyBlanquet/project-forge/production-skills/core/auth-supabase-complete Skill

    0★ repo

    SaaS factory: Next.js starters + spec-kit extensions + Ralph++ autonomous loop. Production-ready in 48h.

  • Compliant logging

    Throughproof/throughproof/skills/compliant-logging Skill

    0★ repo

    Free, portable AI-agent skills that write compliant code (audit logging, access control, encryption) mapped to SOC 2, ISO 27001, PCI-DSS & HIPAA at once. Works in Claude Code, Cursor, Copilot, Gemini & Antigravity.

  • Windows github auth diagnosis

    h8nc4y/windows-github-auth-diagnosis Skill

    0★

    Agent skill for Codex and Claude Code that diagnoses Windows GitHub auth false negatives (HTTP 401, Bad credentials, SEC_E_NO_CREDENTIALS) caused by sandboxes that cannot read the Windows keyring.

  • Authz architect

    satishTheLegend/authz-architect Skill

    0★

    Designs, implements, and adversarially verifies an application's authorization + tenant-isolation model — closing the IDOR/broken-access-control gaps that are the #1 web vuln.

  • Discogs authentication

    Nikolasgrizli/discogs-api-skills/discogs-authentication Skill

    0★ repo

    Model-agnostic Agent Skills covering the entire public Discogs API (api.discogs.com).

  • Tanstack start auth

    MakFly/superpowers-tanstack-start/skills/tanstack-start-auth Skill

    0★ repo

    Open-source Claude Code plugin and Agent Skills for TanStack Start: type-safe routing, server functions, SSR, middleware, authentication, testing, and deployment.

  • Boring backend

    dd3ok/boring-backend/skills/boring-backend Skill

    0★ repo

    A compact AI coding-agent skill for designing, implementing, and reviewing boringly reliable backend APIs.

  • Backend development

    danielleit241/hs-skills/skills/backend-development Skill

    0★ repo

    Plugin toolkit for Claude Code and Codex.

  • Legible legitimacy

    that-guy-jamie/legible-legitimacy/skills/legible-legitimacy Skill

    0★ repo

    A portable workflow-governance skill for making high-consequence agent operations authorized, bounded, reversible, and auditable.

  • Conta azul

    augustotecnos/claude-skill-conta-azul/conta-azul Skill

    no license0★ repo

    Skill do Claude Code para integrar com a API do ERP Conta Azul: OAuth 2.0, 10 armadilhas mapeadas, mapa de ~45 endpoints e referencia completa navegavel.

  • JWT Decoder API

    Br0ski777/jwt-decoder-x402/io.github.Br0ski777/jwt-decoder MCP server

    0★ repo

    Decode JWT tokens — inspect header, payload, claims, expiry. x402 micropayment.

  • Jwt ai mcp

    CSOAI-ORG/jwt-ai-mcp/io.github.CSOAI-ORG/jwt-ai-mcp MCP server

    0★ repo

    jwt-ai-mcp MCP server by MEOK AI Labs

  • Jwt

    pipeworx-io/mcp-jwt/io.github.pipeworx-io/jwt MCP server

    0★ repo

    JWT decoder MCP.

  • Atlassian

    sanjay3290/ai-skills/skills/atlassian Skill

    397★ repo

    24 cross-platform agent skills for Claude Code, Cursor, Codex & Gemini CLI — databases, messaging, research, TTS, DevOps, and Google Workspace

  • Broken access control

    scholarly360/owasp-top10-web-skills/skills/broken-access-control Skill

    20★ repo

    Agent Skills for OWASP Top 10 Application Security Risks (https://owasp.org/Top10/2025/)

  • Fortify change review

    fortify/skills/skills/fortify-change-review Skill

    18★ repo

    AI agent skills for OpenText Fortify — SAST/DAST/SCA scanning, vulnerability triage, CI/CD integration, and FCLI workflows. Works with Claude Code, Codex, Gemini CLI, GitHub Copilot, and more.

  • Auth security

    ShieldNet-360/secure-vibe/dist/agent-skills/.agents/skills/auth-security Skill

    15★ repo

    SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

  • Auth archon

    playbookTV/Ironclad/skills/auth-archon Skill

    no license7★ repo

    Agent-agnostic operating procedures for reviewing, debugging, testing, refactoring, and hardening software.

  • Better auth patterns

    smicolon/ai-kit/packs/better-auth/skills/better-auth-patterns Skill

    no license6★ repo

    Convention packs for any AI coding tool - agents, skills, commands, and rules for 15 tools including Claude Code, Cursor, Windsurf, and Copilot

  • Jpm merchant integrations

    jpmorgan-payments/pdp-skills/skills/jpm-merchant-integrations Skill

    6★ repo

    Agent skills that give GitHub Copilot, Claude Code, and other AI coding assistants procedural knowledge of J.P. Morgan Payments APIs. Walks external developers from onboarding and credential setup through OAuth implementation and live API integration with Checkout and Online Payments.

  • Code review

    chipfighter/coding-discipline/plugins/coding-discipline/skills/code-review Skill

    6★ repo

    Workflow-agnostic guardrails for AI coding agents: spec sync + risk-triggered engineering discipline for Claude Code and Codex.

  • Bughunterpro

    sector-b79/web-hunter-pro/codex/skills/bughunterpro Skill

    no license3★ repo

    BugHunterPro is a practical AI bug hunting skill collection for Codex, Claude, and Gemini.

  • Auth patterns

    iwritec0de/app-dev/skills/auth-patterns Skill

    3★ repo

    Full-stack Next.js development plugin for Claude Code

All 1,766 in the catalog