Secure Auth Patterns
v1.0.0Implement secure authentication and authorization using JWT, OAuth2, session management, RBAC, permissions, and resource ownership verification.
⭐ 0· 771·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
Name and description align with the included content: the SKILL.md and implementation playbook provide JWT, session, OAuth2, RBAC, and refresh-token patterns and code samples consistent with an authentication/authorization guidance skill. There are no unrelated binaries or unrelated capabilities requested.
Instruction Scope
The runtime instructions contain many concrete code samples that reference environment secrets and runtime components (e.g., process.env.JWT_SECRET, JWT_REFRESH_SECRET, SESSION_SECRET, REDIS_URL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, FRONTEND_URL) but the skill does not declare these as required. The playbook also demonstrates redirecting access tokens in a query parameter (res.redirect(...?token=...)), which is an insecure pattern that can leak tokens via referrers or logs. Overall the instructions stay within auth/authz scope but assume access to secrets and external services without making those requirements explicit.
Install Mechanism
This is an instruction-only skill with no install spec and no code files to execute: lowest install risk. Nothing is downloaded or written to disk by the skill itself.
Credentials
Registry metadata lists no required environment variables or credentials, yet the code samples assume multiple sensitive environment values (JWT_SECRET, JWT_REFRESH_SECRET, SESSION_SECRET, REDIS_URL, GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, FRONTEND_URL, etc.). The absence of declared required secrets is an incoherence: if you run or copy these examples into a runtime, you'll need secrets; the skill does not request or document how those should be provided safely.
Persistence & Privilege
The skill does not request persistent presence (always: false), does not modify other skills or global agent config, and does not request elevated platform privileges. Autonomous invocation remains allowed (platform default), but there are no extra persistence flags set by this skill.
What to consider before installing
This playbook appears to be legitimate guidance on implementing auth/authz, but be aware of two things before you use it: (1) the examples assume many secrets and external endpoints (JWT_SECRET, JWT_REFRESH_SECRET, SESSION_SECRET, REDIS_URL, GOOGLE_CLIENT_ID/SECRET, FRONTEND_URL, etc.) even though the skill metadata lists none — you should not paste real secrets into the agent or public prompts and you should plan how to supply these values securely (environment-only, secret manager, etc.); (2) some shown patterns can leak tokens (redirecting access tokens in a URL query string is risky). If you plan to adopt the examples, review and adapt them to your platform's secure secret storage, avoid placing tokens in URLs (prefer HttpOnly secure cookies or one-time server-side exchanges), and validate the code in a controlled dev environment before deploying.Like a lobster shell, security has layers — review code before you run it.
latestvk97273j4mk1y781mbqfcdbjdgh819qr1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.