setup-flows-auth

setup-flows-auth is a skill for Claude Code from cognitedata/builder-skills. It costs 121 tokens per session (1,766 once invoked), scanned A, original, Apache-2.0.

A setup guide for connecting a React app to Cognite Data Fusion through Flows authentication. Cognite Data Fusion is Cognite’s platform for working with industrial data inside Fusion apps.

In plain words
What is it for?
Use it when migrating a React app to Flows or adding missing authentication. It covers the newer Apps API flow and the older Classic flow.
Why use it?
It chooses the appropriate authentication method and avoids changing an app that already has a valid setup.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

not rated 6repo yesterday A scan Socket: passSnyk: passSkillSpector: warn 121 tokens original Apache-2.0

Good fit Use it when migrating a React app to Flows or adding missing authentication. It covers the newer Apps API flow and the older Classic flow.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cognitedata/builder-skills/setup-flows-auth
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cognitedata/builder-skills --skill setup-flows-auth
Clone the repo
git clone --depth 1 https://github.com/cognitedata/builder-skills

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for setup-flows-auth

README.md
[![agentmods](https://agentmods.dev/badge/skills/cognitedata/builder-skills/setup-flows-auth/github.svg)](https://agentmods.dev/skills/cognitedata/builder-skills/setup-flows-auth)
Your own site
<a href="https://agentmods.dev/skills/cognitedata/builder-skills/setup-flows-auth"><img src="https://agentmods.dev/badge/skills/cognitedata/builder-skills/setup-flows-auth/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for setup-flows-auth

Your own site · 80×15
<a href="https://agentmods.dev/skills/cognitedata/builder-skills/setup-flows-auth"><img src="https://agentmods.dev/badge/skills/cognitedata/builder-skills/setup-flows-auth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 121 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,766 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Socket pass 18 Sept 2026
  • Snyk pass 18 Sept 2026
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 22
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00121 $0.01766
Opus 5.5 $0.00048 $0.00706
Sonnet 5.5 $0.00024 $0.00353
Haiku 4.5 $0.00012 $0.00177

Measured 2mo ago against content hash 9c7205575b34, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

setup-flows-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/setup-flows-auth/SKILL.md · 192 lines

How it starts

The opening of the file, as written. The whole thing — 192 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Set Up Flows Authentication

Wire a React app for Flows auth so it can talk to CDF inside Fusion. Two flows exist; pick one based on app.json.

Pick the flow

Read app.json if present:

app.json infra Flow Auth source Extra package
"appsApi" Apps API (new Fusion app host) connectToHostApp from @cognite/app-sdk @cognite/app-sdk
missing / other Classic (legacy Files API) DuneAuthProvider + useDune() from @cognite/dune —

No app.json? Ask the user. Default to Apps API — it's the default for npx @cognite/cli@latest apps create.

Step 1 — Read state, decide whether to act

Read package.json, src/main.tsx (or src/index.tsx), vite.config.ts, app.json.

A valid setup already exists if any of these is true — in which case do nothing and report no-op:

  • Classic: <DuneAuthProvider> from @cognite/dune wraps <App /> in the entry file.
  • Apps API, provider pattern: <CogniteSdkProvider> from @cognite/app-sdk/react wraps the app (in App.tsx or main.tsx), and nested components consume the client via useCogniteSdk(). Requires @cognite/app-sdk >= 0.5.1.

Detect the package manager from the lock file (pnpm-lock.yaml → pnpm, yarn.lock → yarn, otherwise npm).

Step 2 — Install missing deps

Classic flow:

Package Type
@cognite/dune runtime
@cognite/sdk runtime
@tanstack/react-query runtime
vite-plugin-mkcert dev

Apps API flow:

Package Type
@cognite/app-sdk runtime
@cognite/sdk runtime
@tanstack/react-query runtime
vite-plugin-mkcert dev

Skip anything already in package.json. Use the detected package manager (pnpm add, npm install, yarn add; -D / --save-dev for dev deps).

Step 3 — Vite config

Add only what's missing. Don't remove existing plugins.

Classic flow

import { fusionOpenPlugin } from "@cognite/dune/vite";
import mkcert from "vite-plugin-mkcert";

export default defineConfig({
  base: "./",
  plugins: [react(), mkcert(), fusionOpenPlugin(), /* ... */],
  server: { port: 3001 },
  worker: { format: "es" },
});

Read the full file on GitHub · 192 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 192 lines · 121 tokens per session scan A 9c7205575b34

Subscribe to this mod's changes

setup-flows-auth is a skill published in the GitHub repository cognitedata/builder-skills (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 121 tokens to every session and 1,766 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

setup-flows-auth compared with skills from other repositories

setup-flows-auth next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
setup-flows-authcognitedata/builder-skillsSkill6yesterdayApache-2.0A121Claude Code
langbot-devlangbot-app/LangBotSkill19ktodayApache-2.0A136Claude Code, Codex
trigger-realtime-and-frontendtriggerdotdev/trigger.devSkill17k3d agoApache-2.0A148Claude Code, Codex
devtools-event-clientTanStack/devtoolsSkill510yesterdayMITA79Claude Code, Codex
airflow-pluginsastronomer/agentsSkill4584d agoApache-2.0A147Claude Code
walkeros-create-destinationelbwalker/walkerOSSkill3492d agoMITA77Claude Code
walkeros-create-sourceelbwalker/walkerOSSkill3492d agoMITA65Claude Code