agentsclimarketplace

Security identity access

Skill n-n-code/n-n-code-skills/.agents/skills/security-identity-access

Just Another Agent skill repository.

Install
npx -y skills add n-n-code/n-n-code-skills --skill security-identity-access

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Companion overlay for the local `security` workflow skill when the task centers on authentication, sessions, identity recovery, or tenant-scoped access boundaries. Use with `security` for session handling, verification and reset flows, MFA, invitation logic, callback-origin trust, and organization or tenant boundary enforcement.

SKILL.md

3.4 KB, 620 tokens by cl100k_base, as published. Nobody here has run it

Security Identity Access

Use this companion overlay with security when the task involves auth stacks, session systems, identity flows, invitation models, or multi-tenant organization boundaries.

Focus areas

  • session creation, storage, refresh, invalidation, and revocation behavior
  • password reset, email verification, recovery, and callback URL trust
  • MFA enablement, verification, backup-code storage, and trusted-device flows
  • OAuth/OIDC, SAML/SSO, account linking, passkeys/WebAuthn, device trust, and identity-provider callback handling
  • invitation, membership, role, active-organization, and tenant-scoping logic
  • origin checks, CSRF defenses, trusted origins, and cross-domain auth flows

Not For

  • generic user-model changes where auth or tenant boundaries are not the main risk
  • routine login or signup implementation work with no security review or hardening goal
  • generic RBAC discussions detached from actual session, identity, or tenant behavior

Workflow

  1. Map the auth surface: session transport, cookies or tokens, reset and verification endpoints, MFA state, invitation paths, active-org or tenant context, and privileged roles.
  2. Identify trust assumptions: which origins are trusted, which callbacks are accepted, who can invite, promote, switch orgs, revoke sessions, or recover accounts.
  3. Review boundary failures: account takeover paths, authz gaps, tenant-boundary leaks, stale-session risks, missing session revocation, insecure reset flows, and MFA bypasses.
  4. Check secure defaults: absolute callback URLs or strict origin validation, bounded invitation lifetime, email verification where appropriate, session revocation on password reset, org or membership limits, and encrypted or hashed MFA recovery material when supported.
  5. Report by boundary: state the impacted identity or tenant boundary, required attacker capability, and whether the issue leads to takeover, privilege escalation, or cross-tenant access.

Review rules

  • require explicit authorization on role changes, tenant switches, invitation acceptance, and privileged member-management actions
  • inspect whether active-organization or tenant context is server-enforced, not only client-selected
  • prefer short-lived, single-use recovery artifacts and invalidate older sessions after password reset when the platform supports it
  • verify callback and redirect handling with absolute URLs or trusted-origin checks; do not trust inferred origins in split frontend/backend deployments
  • treat MFA backup codes, OTP storage, and trusted-device markers as sensitive credentials

False-positive guards

  • do not flag a client-selected org or tenant switch if the server re-derives and enforces tenant scope on every sensitive action
  • do not flag every redirect or callback as unsafe when the code enforces a strict allowlist or trusted-origin validation
  • do not treat session persistence itself as a flaw when rotation, revocation, and transport protections match the deployment model

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most security skills give in 620 tokens

Counted across 648 of the 828 authors here whose files we hold, read 2026-08-07

  • Parameterize all database queriesin 68 of 648, across 51 files
  • Hash passwords using bcrypt, scrypt, or argon2in 49 of 648, across 36 files
  • Apply rate limiting to authentication endpointsin 48 of 648, across 24 files
  • Configure security headersin 35 of 648, across 19 files
  • Validate all inputsin 32 of 648, across 24 files
  • Validate all external input at the system boundaryin 29 of 648, across 19 files
  • Run containers as a non-root userin 28 of 648, across 15 files
  • Use httponly secure samesite cookies for sessionsin 26 of 648, across 15 files
  • Run dependency audits before every releasein 21 of 648, across 10 files
  • Encode output to prevent cross-site scriptingin 21 of 648, across 11 files
  • Copy dependencies before source codein 20 of 648, across 9 files
  • Store secrets in environment variablesin 20 of 648, across 18 files

Said here and by no other author read

  • require explicit authorization for role changes
  • require explicit authorization for tenant switches
  • require explicit authorization for invitation acceptance
  • enforce tenant context on the server
  • enforce strict trusted-origin validation for callbacks
  • treat MFA backup codes as sensitive credentials

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 326,984. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.