auth-authz-patterns
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill serves as a comprehensive security reference guide, providing defensive patterns for OAuth2, OIDC, JWT, and access control (RBAC/ABAC).
- [SAFE]: Code examples demonstrate secure coding practices, including the use of environment variables (
process.env.CLIENT_SECRET) to avoid hardcoded credentials and the implementation of constant-time comparison (crypto.timingSafeEqual) to prevent timing attacks. - [SAFE]: The instructions explicitly identify and provide remediations for common security anti-patterns, such as insecure token storage in
localStorageand the use of thealg: nonesignature algorithm in JWTs. - [SAFE]: No automated downloads, remote code execution, or network exfiltration patterns were detected. The skill primarily consists of instructional markdown and code snippets for developer reference.
Audit Metadata