How to use the Auth Implementation Patterns agent skill

What the skill makes the agent do

Agent skills are folders of instructions that an AI agent loads when a task matches the skill's description. This one covers authentication and authorization. Once it is active, the agent works from a structured playbook instead of general memory. It covers login, sessions, tokens (JWT), OAuth2 and social or enterprise SSO for identity, and roles and permissions (RBAC) for access control.

The skill pushes the agent toward established security practices. It recommends hashing passwords with bcrypt or argon2, using HTTPS, keeping access tokens short-lived (15 to 30 minutes at most), setting secure cookies with httpOnly, secure and sameSite flags, implementing CSRF protection for session-based auth, rate limiting auth endpoints, rotating secrets, logging security events, and using MFA where possible. It also flags common pitfalls such as storing JWTs in localStorage, having no token expiration, relying only on client-side checks, and trusting client data.

• Compares session-based auth (server-side state, session ID in a cookie) with token-based JWT auth (stateless, self-contained claims).
• Lists the pitfalls to avoid, including weak passwords, insecure password reset, and missing rate limits.
• Points to references/details.md for longer worked examples, such as a JWT generate-and-verify pattern in TypeScript with Express.

Install the skill in Claude

Download the skill ZIP from this page. You can install it for yourself across all projects, or only for one project.

For a personal install, unzip the file into your ~/.claude/skills/ folder. For a single project, unzip it into that project's .claude/skills/ folder. The skill's folder should contain SKILL.md and references/details.md.

If you use the Claude apps instead of a local setup, open Settings, go to Capabilities, then Skills, and upload the ZIP there.

• Personal: ~/.claude/skills/
• Project only: .claude/skills/ inside the project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How to trigger the skill with natural requests

You do not need a special command. The skill's description says it applies when implementing auth systems, securing APIs, or debugging security issues, so ask for that work in plain language and name the thing you are building. Mention the stack, the token or session approach, and any roles you need, because the agent can then match the guidance to your case.

Requests that work well describe a goal and a constraint. Requests that are too vague may not clearly match the skill, so name the auth topic directly.

• Add email and password login with session cookies to my Express app.
• Design RBAC for an admin, editor and viewer role on our REST API.
• Review this login flow for common auth weaknesses, such as token storage and missing rate limits.
• Set up Google sign-in with OAuth2 and explain where to validate the token on the server.
• Our JWT access tokens never expire. Help me find where that happens and fix it.

Example: reviewing an existing auth flow

Debugging is one of the strongest uses of this skill. Paste or point the agent at the code that issues and checks tokens, then ask it to check against the skill's best practices and pitfalls. The agent can then work through each item: where passwords are hashed, where cookies are set, whether tokens expire, whether authorization runs on the server, and whether login attempts are rate limited.

Treat the output as a checklist to verify against your own code, not as a finished audit. The agent will still need to read your real files to tell whether each point applies.

What the skill needs and safety notes

The skill lists no requirements. It does not run scripts and does not use the network, so it only supplies instructions that the agent reads. It is released under the MIT licence.

The skill is general guidance. It explains patterns rather than providing vetted code for your stack, and it may not match your threat model or compliance needs. For production systems, have an experienced security reviewer check the design and the implementation before release.

• Requires: nothing listed
• Runs scripts: no
• Uses network: no
• Licence: MIT

Tips for getting useful results

Give the agent your real context: the framework, whether clients are browsers or mobile apps, and who your users are. Ask for one area at a time, such as password storage or token lifetimes, so each answer can be checked properly. When the agent proposes a pattern, ask it to explain the threat that pattern prevents, which helps you judge whether it fits.

For longer worked examples, ask the agent to read references/details.md when the main guidance is not enough.

• Name your framework and client type (web, mobile, or API only).
• Ask for the reasoning behind each recommendation.
• Keep secrets out of the chat; use placeholders or environment variable names.