authentication
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides educational content on secure authentication and authorization patterns. It includes clear 'GOOD' vs 'BAD' comparisons to help developers avoid common security pitfalls like hardcoded secrets or weak hashing algorithms.
- [SAFE]: All code snippets correctly implement security best practices, such as fetching sensitive cryptographic keys from environment variables (e.g., JWT_PRIVATE_KEY, OAUTH_CLIENT_SECRET) rather than hardcoding them.
- [SAFE]: The skill encourages the use of modern, high-work-factor hashing algorithms like Argon2id and Bcrypt for password security, as recommended by OWASP.
- [SAFE]: Implementation of constant-time comparisons (using hmac.compare_digest and crypto.timingSafeEqual) is included to prevent timing attacks during token or password verification.
- [SAFE]: The skill includes patterns for securing session management, including session regeneration after login and the use of httpOnly, secure, and SameSite cookie attributes.
Audit Metadata