security-authentication
Security Authentication
Overview
Use this skill to design and review authentication flows that resist account takeover while preserving acceptable user friction.
Scope Boundaries
- Authentication factors, login flows, or account-recovery behavior are being introduced or changed.
- Session management (cookie/token TTL, refresh policy, revocation) needs to be defined.
- Risk-based controls (MFA, step-up auth, suspicious login handling) are required.
Templates And Assets
- Authentication assurance matrix:
assets/auth-assurance-matrix-template.md
Inputs To Gather
- Identity sources and trust level requirements (internal users, external users, federated identities).
- Threat assumptions (credential stuffing, phishing, token theft, session hijacking).
- Regulatory and product constraints (MFA mandates, session timeout policy, UX limits).
- Operational constraints (IdP availability, incident response expectations, observability baseline).
More from kentoshimizu/sw-agent-skills
graph-algorithms
Graph algorithm workflow for modeling entities/relations and selecting traversal, path, ordering, or flow strategies. Use when correctness or performance depends on graph representation and algorithm choice; do not use for schema-only modeling or deployment topology planning.
14powershell-style-guide
Style, review, and refactoring standards for PowerShell scripting. Trigger when `.ps1`, `.psm1`, `.psd1` files, or CI workflow blocks with `shell: pwsh` or `shell: powershell` are created, modified, or reviewed and PowerShell-specific quality controls (error handling, parameter validation, readability, operational safety) must be enforced. Do not use for Bash, generic POSIX `sh`, or language-specific application style rules. In multi-language pull requests, run together with other applicable `*-style-guide` skills.
11bash-style-guide
Style, review, and refactoring standards for Bash shell scripting. Trigger when `.sh` files, files with `#!/usr/bin/env bash` or `#!/bin/bash`, or CI workflow blocks with `shell: bash` are created, modified, or reviewed and Bash-specific quality controls (quoting safety, error handling, portability, readability) must be enforced. Do not use for generic POSIX `sh`, PowerShell, or language-specific application style rules. In multi-language pull requests, run together with other applicable `*-style-guide` skills.
11architecture-clean-architecture
Clean Architecture workflow for enforcing dependency direction, stable domain boundaries, and use-case-centered application design. Use when teams must separate business rules from frameworks and delivery mechanisms; do not use for isolated module cleanup without boundary implications.
11github-codeowners-management
Govern CODEOWNERS rules so review routing reflects real ownership and risk boundaries on GitHub. Use when repository ownership mapping or mandatory reviewer rules must be defined, updated, or audited; do not use for non-GitHub runtime architecture or data-layer design.
9redis-caching-patterns
Redis caching workflow for latency improvement with explicit key strategy, TTL/invalidation policy, and correctness bounds. Use when Redis-backed caching decisions are required for application performance; do not use for repository-wide architecture governance or release management policy.
9