agentsclimarketplace

Identity management

Skill K95M65/AI_ONBOARD/skills/identity-management

Portable agent workflow framework for Codex, Claude Code, and OpenCode—shared project context, focused skills, independent review, and safe updates.

Install
npx -y skills add K95M65/AI_ONBOARD --skill identity-management

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 20 days oldThe repository was created 20 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Design and review authentication and authorization — sessions, tokens (JWT), OAuth2/OIDC, RBAC/ABAC, MFA, and password handling. Use when building or auditing login, access control, or any "who can do what" logic.

SKILL.md

2.0 KB, 438 tokens by cl100k_base, as published. Nobody here has run it

Identity management

The two questions: authentication (who are you?) and authorization (what may you do?). Most access bugs are authorization bugs — see the checklist and reference.md.

When to use

Building or reviewing login, sessions, access control, or any permission decision.

Authentication

  • Passwords: hash with a slow, salted KDF (Argon2id / bcrypt / scrypt) — never fast hashes, never plaintext. Enforce length over complexity; check against breached-password lists.
  • MFA: offer TOTP/WebAuthn for sensitive accounts; WebAuthn/passkeys where you can.
  • Sessions vs tokens: server sessions (opaque id + secure cookie) are simplest and revocable. JWTs are stateless but hard to revoke — keep them short-lived with a refresh flow, and validate alg, iss, aud, exp every time. Never accept alg: none.
  • OAuth2 / OIDC: use a library; use Authorization Code + PKCE; validate state (CSRF) and the id-token signature. Don't invent your own flow.

Authorization

  • Enforce on every action, server-side, deny-by-default. Never rely on a hidden UI element as a control.
  • Check the resource, not just the route — the #1 bug is IDOR (user A reads user B's record by id).
  • RBAC or ABAC, centrally enforced (middleware/policy layer), not scattered per-handler ifs.
  • Least privilege for the identity's scope and token lifetime.

On Cloudflare

For app-level access without building auth, Cloudflare Access (Zero Trust) gates apps by identity/policy; pair with Workers for fine-grained checks. See the cloudflare-one skill if vendored.

Verify

Pair with security-review/security-audit; specifically probe for IDOR, missing server-side checks, alg:none/unvalidated JWTs, and long-lived tokens.

Gives 0 of the 12 instructions most auth identity skills give in 438 tokens

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

  • hash passwords with bcrypt or argon2in 53 of 409, across 43 files
  • use parameterized queriesin 47 of 409, across 39 files
  • load SECRET_KEY from environment variablesin 23 of 409, across 14 files
  • validate all input server-sidein 19 of 409, across 11 files
  • refresh access tokens before expiryin 17 of 409, across 9 files
  • store tokens in httponly cookiesin 17 of 409, across 16 files
  • store refresh tokens securelyin 16 of 409, across 6 files
  • validate webhook signatures before processingin 15 of 409, across 5 files
  • sanitize user inputsin 15 of 409, across 9 files
  • implement rate limiting on auth endpointsin 14 of 409, across 9 files
  • encrypt sensitive data at restin 13 of 409, across 10 files
  • validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

  • hash passwords with a slow salted KDF
  • enforce server-side deny-by-default authorization on every action
  • check resource ownership not just the route
  • enforce RBAC or ABAC centrally via a policy layer
  • apply least privilege to token scope and lifetime
  • keep JWTs short-lived with a refresh flow

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.