auth-implementation-patterns
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates standard, secure patterns for implementing authentication (JWT, sessions, OAuth2) and authorization (RBAC, permissions).
- [SAFE]: The code correctly uses environment variables (
process.env) to manage sensitive secrets like API keys and JWT signing keys, avoiding hardcoded credentials. - [SAFE]: Dependencies utilized in the examples (e.g.,
bcrypt,jsonwebtoken,passport,zod) are reputable and standard libraries for Node.js security. - [INDIRECT_PROMPT_INJECTION]: The skill includes logic for handling user-supplied data during registration and login processes, which represents a potential attack surface.
- Ingestion points: Data is ingested via
req.bodyin the registration and login endpoints inSKILL.md. - Boundary markers: The skill uses standard API route separation and middleware structures.
- Capability inventory: The patterns include database access (
db.users) and JWT signing capabilities. - Sanitization: The skill mitigates risks by implementing
zodfor input schema validation andbcryptfor secure password hashing.
Audit Metadata