start-core/auth-server-primitives
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides secure implementation patterns for session management, including the mandatory use of
HttpOnly,Secure, and__Host-cookie prefixes to mitigate XSS-based exfiltration and session hijacking. - [SAFE]: It includes specific guidance on preventing user enumeration and timing attacks during login and password reset flows by ensuring constant-time responses and uniform status codes regardless of user existence.
- [SAFE]: The documentation explicitly warns against common authorization pitfalls, such as trusting client-side route guards for server-side RPC protection and failing to verify ownership of resources (BOLA/IDOR protection).
- [SAFE]: It provides boilerplate for security-critical middleware, including CSRF protection via origin header validation and rate limiting for authentication endpoints to prevent credential stuffing.
Audit Metadata