The Agent Skills Directory

[SAFE]: The skill mandates the use of memory-hard hashing algorithms such as Argon2id and bcrypt with appropriate cost factors to ensure resistance against brute-force and hardware-accelerated attacks.
[SAFE]: It emphasizes timing-safe comparisons using crypto.timingSafeEqual for all secret and token validations, preventing side-channel information leaks.
[SAFE]: Instructions for JWT management correctly prioritize signature verification (jwt.verify) over decoding and advocate for short-lived access tokens combined with rotated refresh tokens stored in secure, httpOnly cookies.
[SAFE]: Defensive patterns for OAuth, including the mandatory use of the state parameter and PKCE for public clients, are correctly documented to prevent CSRF and token interception.
[SAFE]: The skill provides guidance on preventing user enumeration by recommending generic error messages and consistent timing for authentication responses.

authentication