authentication-security
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a utility script
scripts/generate-jwt-keys.shthat usesopensslto generate RSA keypairs for JWT signing. This script follows security best practices by setting restrictive file permissions (chmod 600) and advising against committing private keys to version control. - [EXTERNAL_DOWNLOADS]: The provided implementation templates for Node.js and Python reference standard, well-known libraries such as
jsonwebtoken,axios,PyJWT,argon2-cffi, andpyotp. These are appropriate for the skill's stated purpose of implementing secure authentication flows. - [SAFE]: The skill focuses on promoting high-security standards, including the use of PKCE for OAuth2 public clients, asymmetric signing (RS256) for JWTs, and secure cookie attributes (HttpOnly, Secure, SameSite) for session management. All network operations in the code examples are directed toward user-configurable endpoints or standard mock domains (e.g.,
example.com).
Audit Metadata