Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/int2t05/engineering-skills/auth-implementationnpx skills add int2t05/engineering-skills --skill auth-implementationgit clone --depth 1 https://github.com/int2t05/engineering-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/int2t05/engineering-skills/auth-implementation)<a href="https://agentmods.dev/skills/int2t05/engineering-skills/auth-implementation"><img src="https://agentmods.dev/badge/skills/int2t05/engineering-skills/auth-implementation.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00101 | $0.01492 |
| Opus 5 | $0.00051 | $0.00746 |
| Sonnet 5 | $0.00020 | $0.00298 |
| Haiku 4.5 | $0.00010 | $0.00149 |
Grade A, and why
auth-implementation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auth Implementation
Build authentication correctly the first time. Auth is the #1 place engineers
introduce security holes — this skill gives language-agnostic patterns for
sessions, tokens, OAuth, password hashing, and authorization. It builds what
security-review later audits; align terminology with that skill.
When to use
- Implementing login, session management, token issuance, or password hashing
- Adding OAuth2/OIDC (social login, SSO) or service-to-service authentication
- Building RBAC/ABAC authorization checks (verify ownership, not just auth)
- Choosing session-vs-token strategy and refresh-token rotation for a new app
Not for: auditing existing auth for vulnerabilities (use security-review); designing the auth architecture at system level (use architecture); general implementation workflow (use implement — this skill supplies the auth-domain patterns, not the slice/TDD loop).
Steps
1. Choose session vs token
First-party web app with a server you control → server-side sessions (httpOnly cookie). API-first, microservices, or cross-domain → JWT (stateless). Hybrid (session cookie + access token for API calls) is common and fine. See the decision matrix in references/token-patterns.md. Never store tokens in localStorage.
2. Hash passwords correctly
bcrypt (cost ≥ 12), argon2id (preferred for new systems), or scrypt. These algorithms generate and embed a per-password salt internally — do not roll your own salt. Verify with the library's constant-time compare (bcrypt.compare, not ===). Never MD5, SHA-1, or SHA-256 for passwords — they are too fast to resist brute force.
3. Session management (if session-based)
- Cookie flags:
httpOnly(no JS access),secure(HTTPS only),sameSite=Lax(orStrictfor same-site forms). - Rotate the session ID on login and on any privilege change.
- Set absolute + idle timeout; extend idle on activity.
- Server-side invalidation on logout — delete the session record, do not just clear the cookie.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 87 lines · 101 tokens per session scan A 3bb40e0e3dd2
auth-implementation is a skill published in the GitHub repository int2t05/engineering-skills (3 stars, last pushed 15d ago), licensed MIT. It adds 101 tokens to every session and 1,492 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
writing-skills
Use when creating new skills, editing existing skills, or verifying skills work before deployment.
finishing-a-development-branch
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work.
test-driven-development
Use when implementing any feature or bugfix, before writing implementation code.
receiving-code-review
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation.
writing-plans
Use when you have a spec or requirements for a multi-step task, before touching code.