agentsclimarketplace

Reconfigure

Skill franzos/claude-plugins/plugins/forseti/skills/reconfigure

Claude Code plugin marketplace: a set of domain experts (subagents) grouped into installable plugins.

Install
npx -y skills add franzos/claude-plugins --skill reconfigure

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 27 days oldThe repository was created 27 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use to change an existing Forseti deployment toward a specific goal: add a social login provider (GitHub, Google, Microsoft, GitLab, Apple), enable Linux/POSIX login (PAM/NSS/sshd via the device grant), register a downstream OAuth client, enable or switch the email provider, turn on Enterprise SAML SSO, or adjust branding and rate limits. Locates the live config, reads the relevant operator-guide section, makes the change in the right file, validates it, and tests the affected flow. Triggers: add a GitHub login to Forseti, configure Linux login, add an OAuth client, reconfigure Forseti.

SKILL.md

4.1 KB, 946 tokens by cl100k_base, as published. Nobody here has run it

Reconfiguring Forseti

Reconfiguration is goal-driven: what does the user want to achieve? The right change lives in different places (Forseti's config.toml, Kratos's kratos.yml, Hydra, or the admin UI). Read the relevant docs/operator-guide.md section for the current detail rather than working from memory, and validate before declaring done.

1. Establish the goal and the current state

Ask what the user wants to achieve if it is not already clear. Then locate the deployment: the active config.toml ($FORSETI_CONFIG_PATH), infra/kratos/kratos.yml, infra/hydra/hydra.yml, and how the stack is run (playground compose vs native). Note whether TLS/proxy is in front (it affects callback URLs).

2. Dispatch by goal

Add a social login provider (GitHub, Google, Microsoft, GitLab, Apple, custom OIDC)

Configured in Kratos, not Forseti. In kratos.yml under selfservice.methods.oidc.config.providers[], add an entry: id, provider, client_id, client_secret (via ${ENV} substitution, not inline), mapper_url, and scope. Provide the claim-to-trait mapper as a Jsonnet file under infra/kratos/ (e.g. oidc.github.jsonnet). At the IdP, register the callback as https://<kratos-host>/self-service/methods/oidc/callback/<id>. Forseti auto-renders one "Sign in with X" button per provider (known: github, google, microsoft, gitlab, apple, facebook; unknown ids get a generic icon). See operator-guide §oidc.

Enable Linux / POSIX login

Forseti-native, via the OAuth Device Authorization Grant. Set the [posix] table in config.toml (uid/gid bands, default_shell, home_prefix, free_seats, pam_client_id/pam_client_secret, hydra_issuer). Mint the confidential Hydra device-auth client with forseti posix-init-client. Enroll the host at /admin/hosts (one-time host_id:secret), provision Kratos identities into POSIX accounts at /admin/posix, and install the forseti-unix host client (NSS + PAM + sshd AuthorizedKeysCommand + daemon; also packaged for Guix). Offline passphrase fallback is /settings/offline-access. Free up to free_seats (default 25); more needs a commercial license.

Register a downstream OAuth client

Use the admin UI: /admin/clients/new (40+ prefilled app templates), or issue a DCR initial-access token at /admin/dcr-tokens for RFC 7591 self-registration. Harden with the [oauth].dcr_reserved_names denylist to block brand impersonation on the consent screen.

Enable or switch the email provider

Set [email] in config.toml: enabled, from_address, from_name, provider, and the provider credentials (prefer env over inline). Kratos's courier SMTP is separate and lives in kratos.yml.

Enable Enterprise SAML SSO (commercial)

Set [saml] in config.toml to point at a Jackson/Ory Polis instance (URL, API key, verifier, SP entity id); per-org connections are managed at /sso/{org-slug}. See docs/commercial/saml.md.

Branding, rate limits, other subsystems

[brand], [auth]/[oauth]/[orgs]/[claim_email]/[handoff] rate limits and TTLs are all in config.toml.

3. Validate and test

  • Lint the Ory side: forseti config-check (--strict).
  • Restart what changed: Kratos for kratos.yml edits, Forseti for config.toml edits (some values are hot, most are read at boot).
  • Exercise the changed flow end to end in a browser (the new provider button, a POSIX login, the downstream authorize round-trip). Do not report the change as working without loading it.

For a full hardening pass rather than a single change, use the forseti:audit skill.

Gives 0 of the 12 instructions most auth identity skills give in 946 tokens

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

  • hash passwords with bcrypt or argon2in 53 of 409, across 43 files
  • use parameterized queriesin 47 of 409, across 39 files
  • load SECRET_KEY from environment variablesin 23 of 409, across 14 files
  • validate all input server-sidein 19 of 409, across 11 files
  • refresh access tokens before expiryin 17 of 409, across 9 files
  • store tokens in httponly cookiesin 17 of 409, across 16 files
  • store refresh tokens securelyin 16 of 409, across 6 files
  • validate webhook signatures before processingin 15 of 409, across 5 files
  • sanitize user inputsin 15 of 409, across 9 files
  • implement rate limiting on auth endpointsin 14 of 409, across 9 files
  • encrypt sensitive data at restin 13 of 409, across 10 files
  • validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

  • establish reconfiguration goal and current state
  • locate active deployment configuration files
  • read relevant operator-guide section before changing
  • add social login providers in Kratos configuration
  • use environment substitution for client secrets
  • configure POSIX login settings in config.toml

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.