Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Dannykkh/skill-olympus --skill social-logingit clone --depth 1 https://github.com/Dannykkh/skill-olympusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dannykkh/skill-olympus/social-login)<a href="https://agentmods.dev/skills/dannykkh/skill-olympus/social-login"><img src="https://agentmods.dev/badge/skills/dannykkh/skill-olympus/social-login/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dannykkh/skill-olympus/social-login"><img src="https://agentmods.dev/badge/skills/dannykkh/skill-olympus/social-login.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 75 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 94 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 177 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 536 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium MCP Rug Pull · line 131 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.07506 |
| Opus 5 | $0.00040 | $0.03753 |
| Sonnet 5 | $0.00016 | $0.01501 |
| Haiku 4.5 | $0.00008 | $0.00751 |
Grade A, and why
social-login scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
1. 백엔드가 살아있나? (`curl` 확인) How it starts
The opening of the file, as written. The whole thing — 852 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Social Login Implementation Guide
소셜 로그인 구현 종합 가이드. Google, Apple, Kakao, Naver 4사를 React Native(Expo), Swift(iOS), Kotlin/Java(Android), Web 환경에서 구현합니다. 실제 프로덕션 삽질 경험에서 추출한 gotcha + 체크리스트 포함.
Trigger
다음 키워드에 자동 활성화:
- "소셜 로그인", "social login", "OAuth 로그인"
- "카카오 로그인", "네이버 로그인", "구글 로그인", "애플 로그인"
- "kakao login", "naver login", "google sign-in", "apple sign-in"
- "DEVELOPER_ERROR", "KOE205", "keyHash validation"
핵심 개념: "프론트만 값을 가지고 있으면 안 되는 거구나?"
이것이 소셜 로그인에서 가장 많이 하는 실수입니다.
[사용자] → [프론트엔드] → [소셜 프로바이더] → [프론트엔드] → [백엔드] → [DB]
① SDK로 로그인 ② 토큰 발급 ③ 토큰 전달 ④ 토큰 검증
| 단계 | 프론트엔드 | 백엔드 |
|---|---|---|
| ① 로그인 요청 | SDK로 소셜 로그인 UI 호출 | - |
| ② 토큰 획득 | idToken 또는 accessToken 받음 |
- |
| ③ 토큰 전달 | 백엔드 /auth/social API 호출 |
- |
| ④ 토큰 검증 | - | 소셜 서버에 직접 확인 (위조 방지) |
| ⑤ JWT 발급 | 우리 앱 JWT 저장 | 사용자 생성/조회 + JWT 생성 |
왜 백엔드도 키가 필요한가? 프론트에서 "카카오로 로그인했어요"라고만 하면 누구나 가짜 토큰을 보낼 수 있다. 백엔드가 카카오/구글 서버에 직접 물어봐서 진짜인지 확인해야 한다.
프로바이더별 백엔드 검증 방식
| 프로바이더 | 프론트가 보내는 것 | 백엔드 검증 방식 |
|---|---|---|
idToken (JWT) |
JWT의 aud(Client ID)가 우리 앱인지 검증 |
|
| Apple | iOS: idToken / Android: authorizationCode |
JWT 서명 검증 (JWKS) / code 교환 |
| Kakao | accessToken |
카카오 API로 사용자 정보 조회 |
| Naver | accessToken |
네이버 API로 사용자 정보 조회 |
플랫폼 × 프로바이더 매트릭스
각 조합마다 설정 방식이 완전히 다릅니다.
| React Native (Expo) | Swift (iOS) | Kotlin (Android) | Web | |
|---|---|---|---|---|
@react-native-google-signin + google-services.json |
GoogleSignIn pod |
credentials-manager + google-services.json |
gsi/client JS SDK |
|
| Apple | iOS: expo-apple-authentication (네이티브) / Android: 웹 OAuth |
AuthenticationServices (네이티브) |
웹 OAuth (Service ID 필요) | JS SDK + Service ID |
| Kakao | @react-native-seoul/kakao-login |
KakaoSDK pod |
kakao-sdk gradle |
Kakao JS SDK |
| Naver | @react-native-seoul/naver-login |
NaverThirdPartyLogin pod |
naver-sdk gradle |
Naver JS SDK |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 852 lines · 80 tokens per session scan A d03ba0414bb0
social-login is a skill published in the GitHub repository Dannykkh/skill-olympus (5 stars, last pushed today), licensed MIT. It adds 80 tokens to every session and 7,506 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
factory-api
API conventions for both server actions and tRPC builds. Covers the decision between them, per-mutation Zod input schemas, central router composition, pagination shape, multi-field search via Drizzle ilike + or(), mutation lifecycle hooks, conditional query enabling, stale-time defaults, error response shape and…
factory-auth
Auth and authorization conventions distilled across builds with three different auth stacks (Better Auth + orgs, Supabase Auth + RLS, Clerk). Covers the provider decision matrix, the unified wrapper interface (requireAuth / requireRole / withOrgContext), procedure tier stacking, session handling, OAuth callback…
factory-llm-workflows
LLM workflow conventions distilled from production agent/RAG work. Covers LangGraph TypedDict state schemas, node factory closures, conditional edge routing, structured output via JSON schema, prompt fallback patterns with optional PromptHub override, hybrid search with confidence gating + fallback supplement, SSE…
factory-api-route-engineer
Use when designing or implementing API endpoints — server actions, tRPC procedures, REST routes for external consumers. Carries the factory's API conventions — the server actions vs tRPC decision, procedure tier stacking, per-mutation Zod schemas, central router composition with manual registration, pagination…
factory-auth-wiring-specialist
Use when wiring auth into a new project, switching auth providers, or adding role/org features. Carries the factory's auth conventions — the provider decision matrix (Better Auth + orgs primary, Supabase + RLS for RLS-heavy cases, Clerk for consumer/SSO), the unified requireAuth / requireRole / withOrgContext wrapper…
factory-data-pipeline-engineer
Use when designing or implementing data ingestion, CSV imports, time-series storage, Python services that sit alongside Next.js, simulation pipelines, or external-API integration with submit/poll/fetch shapes. Carries the factory's data-pipeline conventions — TS scripts with Papa Parse, JSONB envelopes for…