Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/martinolivero/saas-builder/authnpx skills add MartinOlivero/saas-builder --skill authgit clone --depth 1 https://github.com/MartinOlivero/saas-builderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/martinolivero/saas-builder/auth)<a href="https://agentmods.dev/skills/martinolivero/saas-builder/auth"><img src="https://agentmods.dev/badge/skills/martinolivero/saas-builder/auth.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00121 | $0.01234 |
| Opus 5 | $0.00060 | $0.00617 |
| Sonnet 5 | $0.00024 | $0.00247 |
| Haiku 4.5 | $0.00012 | $0.00123 |
Grade A, and why
auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auth
This skill makes the two decisions every SaaS gets wrong: which auth provider and how to model permissions. It picks a vetted provider over hand-rolled auth, and a permission model that fits the product.
Analogy: auth is the lock and the guest list for your building. You don't forge your own lock (you'd leave it pickable) — you buy a good one and decide who gets which key.
The one rule
Don't roll your own auth. Password hashing, session rotation, OAuth flows, and reset tokens are where subtle, catastrophic bugs live. Use a provider or a battle-tested library. (Pairs with the secure-coding skill, which covers the OWASP auth-failure defenses.)
Discovery (max 3 questions, only if unknown)
- Is this B2C (individual users) or B2B (organizations/teams with members)?
- Do you need enterprise SSO (SAML/OIDC) for buyers — now or soon?
- What's the stack/backend — Supabase, plain Vercel + Postgres, or full-stack TypeScript?
Step 1 — Pick the provider (decision tree)
| Situation | Use | Why |
|---|---|---|
| Building with an agent / on InsForge | InsForge Auth | Agentic-native — the agent wires auth + RLS through its own skills/MCP; every query scopes to the user in SQL. |
| Already on Supabase | Supabase Auth | Free, RLS-native — every query scopes to the user in SQL. Most-proven ecosystem. |
| Want the best React DX / drop-in components, not tied to a backend | Clerk | Best components, orgs/teams built in. ~$0.02/MAU after a free tier. |
| Full-stack TypeScript, want self-hosted control | Better Auth (~28k⭐) | TS-native, framework-agnostic, orgs/RBAC/passkeys/SSO. |
| Enterprise SSO is a buyer requirement | Auth0 / WorkOS | SAML/OIDC, directory sync, the enterprise checkboxes. |
Default for a fresh React + Vite + Postgres SaaS with no SSO need: InsForge Auth if you're building agent-first, Supabase Auth if on Supabase, or Clerk otherwise. All three scope to the user via RLS — match the auth host to the DB host from the data-modeling skill.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 65 lines · 121 tokens per session scan A 750e2d499bcb
auth is a skill published in the GitHub repository MartinOlivero/saas-builder (2 stars, last pushed 18d ago), licensed MIT. It adds 121 tokens to every session and 1,234 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
architecture-paradigm-microkernel
Applies microkernel architecture with minimal core and plugin extensibility. Use when building platforms where third parties extend core functionality.
plan
Use when a task needs structured planning before implementation. Supports --delegate and round=N[,M].
preplan
Use when a problem needs clarification and agreement before planning begins. Supports --deep and --delegate.
ralph
Use when implementing a plan or executing a prompt that requires verified completion.
pathfind
Use when you have problems but don't know what to build.
analyze
Use when deep investigation is needed — project structure, requirement gaps, or root cause diagnosis. Supports --delegate.