The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provides templates for managing sensitive data, including sessions and OAuth tokens. It follows industry best practices by using HttpOnly, Secure, and SameSite cookie flags, as well as __Host- prefixes to prevent exfiltration. It explicitly warns against reading environment variables at the module level to avoid leakage into client-side bundles and recommends rotation on privilege changes.
[EXTERNAL_DOWNLOADS]: The skill references official documentation and libraries from TanStack, a well-known service in the web development ecosystem. It provides implementation templates rather than downloading or executing untrusted external scripts at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from cookies and OAuth callbacks, representing a standard auth attack surface.
Ingestion points: getRequestHeader('cookie') and request query parameters in references/templates/session-and-csrf.md and references/templates/oauth-pkce.md are used to retrieve session tokens and OAuth codes.
Boundary markers: The skill employs a two-layer defense strategy: beforeLoad for UI-level redirection and authMiddleware for enforcing authorization at the server-function (API) boundary.
Capability inventory: Handlers perform database operations (CRUD on users/sessions) and outgoing network requests for OAuth token exchange.
Sanitization: Implementation templates include Zod schema validation for request data, HMAC-based signing for cookie integrity, and constant-time password comparisons to prevent timing attacks.

start-auth