The Agent Skills Directory

[SAFE]: The skill implements strong security defaults across multiple authentication strategies.
[SESSION_MANAGEMENT]: Correctly implements session ID regeneration after login to prevent session fixation attacks.
[PASSWORD_SECURITY]: Uses bcrypt for password hashing with appropriate salt rounds and includes checks against the 72-byte truncation limit of legacy bcrypt.
[AUTHORIZATION]: Implements Role-Based Access Control (RBAC) and explicit resource ownership checks to prevent Insecure Direct Object References (IDOR).
[RATE_LIMITING]: Provides patterns for Redis-backed rate limiting on sensitive endpoints to mitigate brute-force and credential stuffing attacks.
[JWT_SECURITY]: Uses explicit algorithm pinning ('HS256'), issuer, and audience validation in JWT verification logic.
[BEST_PRACTICES]: Explicitly warns against storing JWTs in localStorage and recommends httpOnly, secure, and sameSite cookie flags for defense-in-depth.

auth-implementation-patterns