agentsclimarketplace

Mobile authorization

Skill ahtishamshahzad/agent_dev_flow/.ai/skills/mobile/mobile-authorization

Tool-neutral AI Engineering System: 174 reusable skills (installable as Claude Code plugins) for planning and building software with AI agents. Classify → plan → approve → build under quality gates. Works with Claude Code, Codex, Cursor, Windsurf, Copilot & Antigravity. Canonical in .ai/.

Install
npx -y skills add ahtishamshahzad/agent_dev_flow --skill mobile-authorization

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 21 days oldThe repository was created 21 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use to plan authorization — role/permission gating of screens and actions, protected navigation, and server-verified access. Roles are enforced server-side; the client hides UI only as a convenience.

SKILL.md

3.1 KB, 587 tokens by cl100k_base, as published. Nobody here has run it

Mobile Authorization

Purpose

Plan authorization: gate screens and actions by role/permission, wire protected navigation, and ensure access is verified server-side — the client hides UI only as UX.

When to Use

  • When the app has roles/permissions or gated content/actions.
  • Not for authentication (identity) — that's mobile-authentication.

Inputs

  • Roles/permissions model and gated screens/actions.
  • Auth session (mobile-authentication) and navigation (mobile-navigation).

Discovery Questions

  • What roles/permissions exist and what do they gate?
  • Which screens/actions are protected?
  • How is access verified server-side for each protected action?

Responsibilities

  • Map roles/permissions to gated screens and actions.
  • Wire protected routes (mobile-navigation).
  • Ensure server-verified access for every protected action (../../security-review).
  • Hide UI as convenience, never as the security boundary.

Required Workflow

  1. Define roles/permissions + gated surfaces.
  2. Wire protected navigation.
  3. Confirm server-side checks per protected action.
  4. Handle unauthorized states gracefully.
  5. Record the authorization plan.

Decision Rules

  • Roles are enforced server-side; UI hiding is convenience only.
  • Never trust a client-editable role claim as the sole gate.
  • Gate both navigation and the underlying action/data access.

Rules

  • Server-side enforcement is authoritative.
  • Coordinate with mobile-authentication for the session/role source.
  • Handle unauthorized gracefully (no crash/leak).

Anti-Patterns

  • Gating by hiding UI only.
  • Trusting a client role claim as authoritative.
  • Protecting the route but not the action/data.
  • Leaking existence of protected resources.

Validation Checklist

  • Roles/permissions mapped to surfaces.
  • Protected routes wired.
  • Server-side verification confirmed per action.
  • Unauthorized states handled.
  • UI hiding treated as convenience only.

Definition of Done

A recorded authorization plan: role/permission mapping, protected navigation, and server-verified access for every protected action — with UI hiding as convenience only.

Related Skills

mobile-authentication, mobile-navigation, ../../security-review, mobile-api-integration

Related Knowledge

../../../knowledge/ (roles, permissions model).

Related References

../../../references/mobile/navigation/ when populated.

Context Loading Guidance

  • Requires: roles/permissions model, gated surfaces, auth session.
  • Does not require: unrelated screens, the full mobile skill set, unrelated references.
  • May load: mobile-authentication, mobile-navigation.
  • Stop when: the authorization plan is recorded.

Token Efficiency Guidance

Plan from the roles/gated-surface list; delegate identity to authentication and enforcement review to security-review.

Gives 0 of the 12 instructions most auth identity skills give in 587 tokens

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

  • hash passwords with bcrypt or argon2in 53 of 409, across 43 files
  • use parameterized queriesin 47 of 409, across 39 files
  • load SECRET_KEY from environment variablesin 23 of 409, across 14 files
  • validate all input server-sidein 19 of 409, across 11 files
  • refresh access tokens before expiryin 17 of 409, across 9 files
  • store tokens in httponly cookiesin 17 of 409, across 16 files
  • store refresh tokens securelyin 16 of 409, across 6 files
  • validate webhook signatures before processingin 15 of 409, across 5 files
  • sanitize user inputsin 15 of 409, across 9 files
  • implement rate limiting on auth endpointsin 14 of 409, across 9 files
  • encrypt sensitive data at restin 13 of 409, across 10 files
  • validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

  • Map roles and permissions to gated screens and actions
  • Wire protected navigation routes
  • Handle unauthorized states gracefully
  • Record the authorization plan
  • Coordinate with authentication for the session source
  • Hide UI as convenience only

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.