New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Validating Authentication Implementations

by jeremylongshore in jeremylongshore/tons-of-skills-marketplace

Validate authentication mechanisms for security weaknesses and compliance.

MITAuto-check passedBackend & APIs

Install Validating Authentication Implementations

skills CLI
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill validating-authentication-implementations -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install jeremylongshore/tons-of-skills-marketplace validating-authentication-implementations --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/validating-authentication-implementations .claude/skills/validating-authentication-implementations && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
validating-authentication-implementations
GitHub stars
2.8k
Token cost
~1.7k tokens
SKILL.md length
717 words
Files
7 (incl. scripts, references, assets)
Skills in repo
3,342
Repo updated
First seen
Licence
MIT

At a glance

Validate authentication mechanisms for security weaknesses and compliance.

  • Works in 10 steps: Identify all authentication entry points… → Examine password storage by locating… → Validate JWT implementations: check… → …
  • Reviewing login systems
  • SKILL.md covers Overview, Prerequisites, Instructions and Output, plus 3 more sections
  • Runs Python scripts from its folder

What it does

Validating Authentication Implementations is an agent skill from jeremylongshore/tons-of-skills-marketplace. Validate authentication mechanisms for security weaknesses and compliance. Use when reviewing login systems or auth flows. Trigger with 'validate authentication', 'check auth security', or 'review login'.

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. The skill folder holds 9 other files, including scripts, reference files and assets (for example `assets/README.md`, `references/README.md` and `scripts/README.md`). Compatibility notes: Designed for Claude Code

It sits in Backend & APIs, covering Authentication. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.

When your agent uses it

  • Reviewing login systems
  • With validate authentication
  • Check auth security

Example prompts

  • “validate authentication”
  • “check auth security”
  • “review login”
  • “/validating-authentication-implementations”

Requirements

  • Python 3
  • Compatibility (from SKILL.md): Designed for Claude Code
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)

Workflow steps

10 steps, taken from the first numbered list in SKILL.md.

  1. Identify all authentication entry points by scanning for login routes, token endpoints, session initialization, and OAuth callback…
  2. Examine password storage by locating hashing function calls -- verify use of bcrypt, scrypt, or Argon2id with appropriate cost factors…
  3. Validate JWT implementations: check signing algorithms (reject none, flag HS256 with weak secrets), verify exp, iat, aud, and iss claims…
  4. Assess session management: verify session IDs are regenerated after authentication, sessions have appropriate timeouts (idle and…
  5. Review OAuth/OIDC flows: confirm state parameter usage for CSRF protection, validate redirect URI whitelisting, check PKCE implementation…
  6. Evaluate MFA implementation: confirm MFA is available for privileged accounts, check TOTP secret storage encryption, verify backup code…
  7. Check account security controls: verify rate limiting on login endpoints, account lockout policies after failed attempts, secure password…
  8. Validate credential transmission: confirm all auth endpoints enforce HTTPS, passwords are never logged or included in URLs, and API keys…
  9. Classify each finding by severity and map to CWE identifiers and OWASP ASVS requirements.
  10. Produce a remediation plan with specific code changes for each finding.

What it can do on your machine

Read from SKILL.md and the folder at commit 80f86df. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Grep
    • Glob
    • Bash(security:*)
    • Bash(scan:*)
    • Bash(audit:*)

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 4 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • cheatsheetseries.owasp.org
    • pages.nist.gov
    • cwe.mitre.org
    • datatracker.ietf.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    Designed for Claude Code

    From compatibility in the SKILL.md frontmatter.

Context cost

Validating Authentication Implementations loads about 1.7k tokens when it runs, and up to ~1.7k if it reads all its reference files. Until then it costs about 62 tokens; SKILL.md has 717 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~62
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit 80f86df, republished under its MIT licence (© jeremylongshore). 717 words, ~1,662 tokens.

Download SKILL.mdSave it as .claude/skills/validating-authentication-implementations/SKILL.md (or your agent's skills folder). This skill also uses 6 other files; get the full folder from GitHub.
name
validating-authentication-implementations
description
Validate authentication mechanisms for security weaknesses and compliance. Use when reviewing login systems or auth flows. Trigger with 'validate authentication', 'check auth security', or 'review login'.
allowed-tools
Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)
compatibility
Designed for Claude Code
version
1.26.0
license
MIT
author
Jeremy Longshore <jeremy@intentsolutions.io>
tags
security, authentication, compliance

Validating Authentication Implementations

Overview

Validate authentication mechanisms across web applications, APIs, and backend services for security weaknesses, compliance gaps, and implementation flaws. This skill examines password hashing, JWT token handling, session management, OAuth flows, MFA implementation, and account security controls against OWASP and NIST standards.

Prerequisites

  • Access to the target codebase and configuration files in ${CLAUDE_SKILL_DIR}/
  • Familiarity with the authentication framework in use (Passport.js, Spring Security, Django Auth, NextAuth, etc.)
  • Standard shell utilities and Grep/Glob available for codebase scanning
  • Reference: ${CLAUDE_SKILL_DIR}/references/README.md for OWASP authentication cheat sheet, NIST password guidelines, and JWT RFC specifications

Instructions

  1. Identify all authentication entry points by scanning for login routes, token endpoints, session initialization, and OAuth callback handlers using Grep across route definitions and controller files.
  2. Examine password storage by locating hashing function calls -- verify use of bcrypt, scrypt, or Argon2id with appropriate cost factors. Flag any use of MD5, SHA-1, SHA-256 without key stretching, or plaintext storage as CWE-916 (Use of Password Hash With Insufficient Computational Effort).
  3. Validate JWT implementations: check signing algorithms (reject none, flag HS256 with weak secrets), verify exp, iat, aud, and iss claims are validated, confirm tokens are not stored in localStorage (XSS exposure), and check for proper refresh token rotation.
  4. Assess session management: verify session IDs are regenerated after authentication, sessions have appropriate timeouts (idle and absolute), cookies use HttpOnly, Secure, and SameSite=Strict or SameSite=Lax attributes, and session fixation protections are in place.
  5. Review OAuth/OIDC flows: confirm state parameter usage for CSRF protection, validate redirect URI whitelisting, check PKCE implementation for public clients, and verify token storage security.
  6. Evaluate MFA implementation: confirm MFA is available for privileged accounts, check TOTP secret storage encryption, verify backup code generation uses cryptographically secure randomness, and flag any MFA bypass paths.
  7. Check account security controls: verify rate limiting on login endpoints, account lockout policies after failed attempts, secure password reset flows (time-limited tokens, no user enumeration), and brute-force protections.
  8. Validate credential transmission: confirm all auth endpoints enforce HTTPS, passwords are never logged or included in URLs, and API keys use secure header transmission rather than query parameters.
  9. Classify each finding by severity and map to CWE identifiers and OWASP ASVS requirements.
  10. Produce a remediation plan with specific code changes for each finding.

Output

  • Authentication inventory: List of all auth mechanisms, endpoints, and flows in the codebase
  • Findings report: Each finding includes severity, CWE reference (e.g., CWE-287 Improper Authentication, CWE-384 Session Fixation, CWE-916 Weak Password Hash), affected file/line, and remediation steps
  • OWASP ASVS compliance matrix: Pass/fail status for ASVS V2 (Authentication) and V3 (Session Management) requirements
  • Token security analysis: JWT algorithm, claim validation status, storage mechanism, and expiration policy
  • Executive summary: Risk rating, total findings by severity, and top priority fixes
Show full SKILL.md (261 more words)Show less

Error Handling

ErrorCauseSolution
No authentication code foundIncorrect scan scope or unconventional auth patternsBroaden Grep patterns; check for third-party auth services (Auth0, Firebase Auth, Cognito) configured externally
Cannot determine hashing algorithmHashing abstracted behind frameworkInspect framework configuration files (e.g., config/auth.php, settings.py) for algorithm settings
JWT library version unknownDynamic dependency resolutionCheck lock files (package-lock.json, poetry.lock) for pinned versions and cross-reference known vulnerabilities
Session config not in codebaseSession management handled by infrastructureCheck reverse proxy configs (nginx, Apache), cloud session stores (Redis, DynamoDB), or PaaS settings
Rate limiting not detectableRate limiting at infrastructure layerNote as "unverifiable from codebase" and recommend confirming at the infrastructure level

Examples

JWT Implementation Review

Scan ${CLAUDE_SKILL_DIR}/src/auth/ and ${CLAUDE_SKILL_DIR}/src/middleware/ for JWT signing and verification logic. Flag any use of jwt.sign() with algorithm: 'none' or HS256 paired with a secret shorter than 256 bits as CWE-327 (Use of Broken Crypto Algorithm), severity critical. Verify that jwt.verify() validates exp, aud, and iss claims.

Password Storage Audit

Grep for bcrypt, argon2, scrypt, hashSync, pbkdf2 across the codebase. If password hashing uses crypto.createHash('md5') or hashlib.sha256() without PBKDF2 wrapping, flag as CWE-916, severity critical. Verify salt generation uses crypto.randomBytes() or equivalent CSPRNG.

Locate session configuration in ${CLAUDE_SKILL_DIR}/config/ or middleware setup files. Verify cookie attributes include httpOnly: true, secure: true, sameSite: 'strict', and maxAge under 24 hours. Flag missing httpOnly as CWE-1004 (Sensitive Cookie Without HttpOnly), severity high.

Resources

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (scripts, references, assets) in skills/.curated/validating-authentication-implementations of jeremylongshore/tons-of-skills-marketplace.

  • SKILL.md
  • assets/README.md
  • references/README.md
  • scripts/README.md
  • scripts/authentication_check.py
  • scripts/jwt_analyzer.py
  • scripts/password_policy_check.py

Open the folder on GitHubat commit 80f86df

Compare with similar skills

Validating Authentication Implementations next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Validating Authentication Implementations compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Validating Authentication Implementations this skilljeremylongshore/tons-of-skills-marketplace2.8k—~1.7kAutomated safety check: PassMIT
Fortify Developmentcoollabsio/coolify63k4 repos~1.9kAutomated safety check: PassMIT
Supabase Development and Debuggingsupabase/agent-skills2.7k3 repos~3.6kAutomated safety check: PassMIT
Better Auth Best Practiceslatitude-dev/latitude-llm4.7k7 repos~1.6kAutomated safety check: PassMIT
Gitnexus Exploringaws-samples/sample-kolya-br-proxy10612 repos~749Automated safety check: PassMIT-0
Supabasecurvenote/curvenote1705 repos~2.2kAutomated safety check: PassCustom licence

Similar skills

  • Fortify Development

    coollabsio/coolify

    ACTIVATE when the user works on authentication in Laravel. An agent skill from coollabsio/coolify.

    63k GitHub starsUsed in 4 repos~1.9k tokens
    Backend & APIsAuto-check passed

  • Supabase Development and Debugging

    supabase/agent-skills

    Official

    General Supabase skill for database, auth, Edge Functions, Realtime and storage work, plus client libraries, migrations, security audits, debugging and reading logs.

    2.7k GitHub starsUsed in 3 repos~3.6k tokens
    Backend & APIsAuto-check passed

  • Better Auth Best Practices

    latitude-dev/latitude-llm

    Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables.

    4.7k GitHub starsUsed in 7 repos~1.6k tokens
    Backend & APIsAuto-check passed

  • Gitnexus Exploring

    aws-samples/sample-kolya-br-proxy

    Official

    A skill your agent uses when the user asks how code works, wants to understand architecture, trace execution flows, or explore unfamiliar parts of the codebase.

    106 GitHub starsUsed in 12 repos~749 tokens
    Backend & APIsAuto-check passed

  • Supabase

    curvenote/curvenote

    A skill your agent uses when doing ANY task involving Supabase.

    170 GitHub starsUsed in 5 repos~2.2k tokens
    Backend & APIsAuto-check passed

  • Gemini Live API Dev

    google-gemini/gemini-skills

    Official

    A skill your agent uses when building real-time, bidirectional streaming applications with the Gemini Live API, or migrating legacy Live models (2.0/2.5/3.1) to Gemini 3.8 Live.

    4.3k GitHub stars~4.6k tokensUpdated 3 days ago
    Backend & APIsAuto-check passed

More from jeremylongshore/tons-of-skills-marketplace

All 3,342 skills in this repo

  • Performing Security Code Review

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.

    2.8k GitHub starsUsed in 2 repos~1.3k tokens
    Auto-check: notes

  • Adapting Transfer Learning Models

    jeremylongshore/tons-of-skills-marketplace

    Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.

    2.8k GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

  • Agent Context Loader

    jeremylongshore/tons-of-skills-marketplace

    Execute proactive auto-loading: automatically detects and loads agents.md files.

    2.8k GitHub stars~1.1k tokensUpdated yesterday
    Auto-check passed

  • Aggregating Performance Metrics

    jeremylongshore/tons-of-skills-marketplace

    Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.

    2.8k GitHub stars~1.2k tokensUpdated yesterday
    Auto-check passed

  • Analyzing Capacity Planning

    jeremylongshore/tons-of-skills-marketplace

    Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.

    2.8k GitHub stars~947 tokensUpdated yesterday
    Auto-check passed

  • Analyzing Database Indexes

    jeremylongshore/tons-of-skills-marketplace

    Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.

    2.8k GitHub stars~2k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Validating Authentication Implementations

What does Validating Authentication Implementations do?

Validate authentication mechanisms for security weaknesses and compliance. Validating Authentication Implementations is an agent skill from jeremylongshore/tons-of-skills-marketplace. Validate authentication mechanisms for security weaknesses and compliance.

When should I use Validating Authentication Implementations?

Validating Authentication Implementations fits situations like: reviewing login systems; with validate authentication; check auth security.

How do I install Validating Authentication Implementations in Claude Code?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill validating-authentication-implementations -a claude-code`. Or copy the skill folder (skills/.curated/validating-authentication-implementations in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/validating-authentication-implementations in your project. Claude Code loads it when a task matches its description.

How do I install Validating Authentication Implementations in Codex?

Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill validating-authentication-implementations -a codex`. Or copy the skill folder (skills/.curated/validating-authentication-implementations in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/validating-authentication-implementations in your project. Codex loads it when a task matches its description.

Can I use Validating Authentication Implementations in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill validating-authentication-implementations -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/validating-authentication-implementations, .gemini/skills/validating-authentication-implementations, .github/skills/validating-authentication-implementations and .opencode/skills/validating-authentication-implementations in your project.

What does Validating Authentication Implementations need to run?

Going by SKILL.md and its folder, Validating Authentication Implementations needs Python for the scripts in its folder. Our summary lists: Python 3. Its frontmatter pre-approves these tools: Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*). Compatibility (from SKILL.md): Designed for Claude Code.

Does Validating Authentication Implementations access the network?

SKILL.md names 4 domains. As links in the text: cheatsheetseries.owasp.org, pages.nist.gov, cwe.mitre.org and datatracker.ietf.org. This is read from the text; nothing was executed.

Is Validating Authentication Implementations safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Validating Authentication Implementations use?

Validating Authentication Implementations is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Validating Authentication Implementations use?

About 1.7k tokens (SKILL.md is roughly 6.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 17 tokens, read only when the agent opens those files.

What are the alternatives to Validating Authentication Implementations?

Skills that share tags, products or a category with Validating Authentication Implementations: Fortify Development (coollabsio/coolify, 63k stars), Supabase Development and Debugging (supabase/agent-skills, 2.7k stars), Better Auth Best Practices (latitude-dev/latitude-llm, 4.7k stars) and Gitnexus Exploring (aws-samples/sample-kolya-br-proxy, 106 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Validating Authentication Implementations?

jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,825 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 9, 2026.

Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.