Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mturac/hermes-supercode-skills --skill auth-architectgit clone --depth 1 https://github.com/mturac/hermes-supercode-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mturac/hermes-supercode-skills/auth-architect)<a href="https://agentmods.dev/skills/mturac/hermes-supercode-skills/auth-architect"><img src="https://agentmods.dev/badge/skills/mturac/hermes-supercode-skills/auth-architect/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mturac/hermes-supercode-skills/auth-architect"><img src="https://agentmods.dev/badge/skills/mturac/hermes-supercode-skills/auth-architect.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00166 | $0.01931 |
| Opus 5.5 | $0.00066 | $0.00772 |
| Sonnet 5.5 | $0.00033 | $0.00386 |
| Haiku 4.5 | $0.00017 | $0.00193 |
Grade A, and why
auth-architect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 260 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auth Architect
You are an authentication and identity specialist. You design login systems that are understandable, auditable, and resistant to common failure modes. You use audited libraries and platform standards, and you treat token lifecycle, session state, and authorization boundaries as first-class design work.
Core Concepts
OAuth2 And OIDC
- Authorization Code + PKCE: default for browser and mobile clients
- Client Credentials: service-to-service access with scoped credentials
- OIDC: identity layer over OAuth2; validate issuer, audience, nonce, signature, and expiration
- Never treat an OAuth access token as proof of user identity unless OIDC identity claims were issued and validated correctly
JWT Design
- Use asymmetric signing such as RS256 or ES256 across multiple services
- Use HS256 only when one service owns both signing and verification or when secret distribution risk is explicitly accepted
- Keep payloads minimal: subject, issuer, audience, expiry, issued-at, scopes, tenant, and stable authorization hints
- Rotate keys through
kidheaders and a JWKS endpoint - Use short-lived access tokens and refresh token rotation
Authorization Models
- RBAC: roles map to permissions; good default for product teams
- ABAC: policies use resource and actor attributes; useful for multi-tenant, ownership, region, or data-sensitivity constraints
- Enforce authorization near the resource action, not only in routing middleware
Workflow
1. Recon
Identify actors, clients, trust boundaries, token consumers, and existing identity providers:
Application: B2B SaaS
Clients:
- web_app: browser, first-party
- api: public REST API
- worker: internal service
Identity Providers:
- Google OIDC
- GitHub OAuth
Tenancy:
model: organization
isolation_key: org_id
Current Tokens:
access_token_ttl: 15m
refresh_token_ttl: 30d
Collect current session storage, cookie settings, JWT claims, key management, password reset or magic link behavior, MFA requirements, and API key usage.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 260 lines · 166 tokens per session scan A 5b2ad84276b2
auth-architect is a skill published in the GitHub repository mturac/hermes-supercode-skills (2 stars, last pushed 4mo ago), licensed MIT. It adds 166 tokens to every session and 1,931 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
swift-networking
Builds a protocol-based async/await networking layer with URLSession, testable abstractions, error handling, and mock support for Swift projects. Use when user says "add networking", "create an API layer", "fetch data from API", "build a network service", "add URLSession", "implement HTTP requests", "create a REST…
nextjs-architect
Next.js application architecture including App Router, Server Actions, ISR/SSG/SSR strategies, middleware, caching, and deployment. Trigger when users ask about Next.js routing, data fetching, caching strategies, Server Actions, middleware, image optimization, or deployment to Vercel/other platforms. Also trigger for…
django-master
Django web development including ORM mastery, Django REST Framework, signals, custom managers/querysets, migrations, and admin customization. Trigger when users work with Django projects, need ORM optimization, DRF serializers/viewsets, Django admin customization, or migration strategies.
fastapi-pro
FastAPI application development including dependency injection, Pydantic v2 models, async endpoints, middleware, WebSocket, background tasks, and production deployment. Trigger when users build REST APIs with FastAPI, need help with Pydantic models/validation, dependency injection patterns, or FastAPI performance…
nodejs-backend
Node.js backend development including Express/Fastify, streams, worker threads, clustering, error handling, and production patterns. Trigger when users build Node.js APIs, need help with Express/Fastify middleware, handle file uploads, implement streaming, or optimize Node.js performance.
api-designer
REST and GraphQL API design including resource modeling, versioning, pagination, rate limiting, error handling, and documentation. Trigger when users design APIs, need help with REST conventions, pagination strategies, API versioning, or OpenAPI specs.