Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add GoldenWing-360/claude-security-skills --skill auth-hardeninggit clone --depth 1 https://github.com/GoldenWing-360/claude-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/goldenwing-360/claude-security-skills/auth-hardening)<a href="https://agentmods.dev/skills/goldenwing-360/claude-security-skills/auth-hardening"><img src="https://agentmods.dev/badge/skills/goldenwing-360/claude-security-skills/auth-hardening/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/goldenwing-360/claude-security-skills/auth-hardening"><img src="https://agentmods.dev/badge/skills/goldenwing-360/claude-security-skills/auth-hardening.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.02554 |
| Opus 5 | $0.00039 | $0.01277 |
| Sonnet 5 | $0.00016 | $0.00511 |
| Haiku 4.5 | $0.00008 | $0.00255 |
Grade A, and why
auth-hardening scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 203 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auth Hardening
Authentication is where almost every public-facing app eventually gets attacked. The good news: a small set of patterns covers most of the threat surface, and the worst practices (password rotation every 90 days, "security questions") are actively harmful.
This skill is opinionated. The opinions track NIST SP 800-63B, OWASP ASVS, and industry consensus circa 2026.
When to invoke
- Building auth from scratch
- Reviewing an existing auth system before scaling user count
- Handling a credential-stuffing wave or a brute-force surge
- Planning MFA rollout for staff or customers
- After a password-reset abuse incident or account-takeover report
- Migrating from sessions to JWT (or back)
Password policy — what to require, what to drop
Require:
- Minimum length 12 characters, no maximum below 64. Length beats complexity.
- Allow all printable characters and spaces — including emoji and unicode. Reject only NULL bytes.
- Check against breached-password lists at signup and reset. Use Have I Been Pwned's k-anonymity range API (only first 5 chars of hash leave your server).
Drop:
- No mandatory rotation. NIST 800-63B explicitly removed periodic rotation in 2017 because it produces predictable patterns (
Password1!→Password2!). - No composition rules ("must contain a symbol"). They reduce entropy by making patterns predictable.
- No security questions. Mother's maiden name is on LinkedIn. Pet's name is on Instagram.
- No password hints stored anywhere users have ever seen them.
Rotation IS appropriate after: known compromise of the credential, MFA enrollment lapse, or staff offboarding.
Password storage
- Argon2id is the recommended default (memory-hard, side-channel resistant). Tune memory ≥ 64 MB, parallelism 1, iterations to hit ~250–500ms per hash on your hardware.
- bcrypt still acceptable (cost ≥ 12) — most languages have mature libraries.
- scrypt acceptable but less ergonomic than Argon2.
- Never roll your own. Even SHA-256 + salt is wrong here — too fast, GPU-friendly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 203 lines · 79 tokens per session scan A 888b645bd1d6
auth-hardening is a skill published in the GitHub repository GoldenWing-360/claude-security-skills (17 stars, last pushed 1mo ago), licensed MIT. It adds 79 tokens to every session and 2,554 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ux-audit
Walk through a live web app AS a real user to find usability + behavioural bugs that static reviews miss. REQUIRES proof of interaction (typing, clicking, sending, observing) before any verdict — a sweep that didn't interact terminates with verdict 'Incomplete'. Walks threads, exercises every element, runs the…
design-loop
Autonomous multi-page site builder using a baton-passing loop. Each iteration reads a task from .design/next-prompt.md, generates a page in HTML/Tailwind, integrates it into the site, verifies visually, then writes the next task to keep the loop alive. Use whenever the user asks to build an entire site autonomously…
product-showcase
Generate a comprehensive marketing website for a web app — multi-page with real screenshots, animated GIF walkthroughs, feature deep-dives, and workflow demonstrations. Browses the running app, captures screens and sequences, and produces a deployable site that actually teaches people what the product does. Especially…
tanstack-start
Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 +…
color-palette
Generate complete, accessible colour palettes from a single brand hex. Produces 11-shade scale (50-950), semantic tokens, dark mode variants, Tailwind v4 CSS output, WCAG contrast checks. Use whenever the user supplies a brand hex and asks for a palette, mentions setting up a design system, wants Tailwind theme…
deep-research
Deep research and discovery before building something new. Explores local projects for reusable code, researches competitors, reads forums and reviews, analyses plugin ecosystems, investigates technical options, and produces a comprehensive research brief. Three depths: focused (30 min), wide (1-2 hours), deep (3-6…