Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Notysoty/openagentskills --skill auth-flow-plannergit clone --depth 1 https://github.com/Notysoty/openagentskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/notysoty/openagentskills/auth-flow-planner)<a href="https://agentmods.dev/skills/notysoty/openagentskills/auth-flow-planner"><img src="https://agentmods.dev/badge/skills/notysoty/openagentskills/auth-flow-planner.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.02094 |
| Opus 5 | $0.00014 | $0.01047 |
| Sonnet 5 | $0.00005 | $0.00419 |
| Haiku 4.5 | $0.00003 | $0.00209 |
Grade A, and why
Auth Flow Planner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Auth Flow Planner
What this skill does
This skill designs a complete authentication and authorization flow for any application. It covers the full lifecycle: registration, login, session management, token refresh, password reset, role-based access control, and all the edge cases (expired tokens, concurrent sessions, brute force protection). The output is a detailed design document with flow diagrams, endpoint definitions, data models, and security considerations — ready to hand off to engineering.
Use this when starting a new application, when auditing an existing auth system, or when extending your auth with new features (OAuth, MFA, roles).
How to use
Claude Code / Cline
Copy this file to .agents/skills/auth-flow-planner/SKILL.md in your project root.
Then ask:
- "Use the Auth Flow Planner skill to design auth for our SaaS app."
- "Plan the authentication system for a multi-tenant API using the Auth Flow Planner skill."
Provide context about:
- Application type (web app, mobile app, API-only, SaaS)
- User types (end users, admins, API consumers)
- Required features (social login, MFA, teams/orgs, API keys)
- Tech stack (language, framework, existing auth libraries)
- Compliance requirements if any (HIPAA, SOC2, GDPR)
Cursor
Add the instructions below to your .cursorrules or paste them into the Cursor AI pane with your application context.
Codex
Provide the application context and ask Codex to follow the instructions below to produce the auth design.
The Prompt / Instructions for the Agent
When asked to plan an authentication flow, follow these steps:
Step 1 — Understand requirements
Gather:
- What user types need to authenticate?
- What needs to be protected (API routes, pages, data scopes)?
- What auth methods are needed (email/password, OAuth, magic link, API key, MFA)?
- What session approach: stateless JWT, stateful sessions (DB/Redis), or both?
- Are there multiple roles or permission levels?
- Are there multi-tenant concerns (organizations, workspaces)?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 244 lines · 27 tokens per session scan A 9395543b43e0
Auth Flow Planner is a skill published in the GitHub repository Notysoty/openagentskills (9 stars, last pushed 24d ago), licensed MIT. It adds 27 tokens to every session and 2,094 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dotnet-auth-audit
A security-audit workflow for authentication and authorization in .NET applications. Authentication checks who a user is; authorization checks what that user is allowed to do.
nextjs-authentication
Secure token storage (HttpOnly Cookies) and Middleware patterns. Use when implementing authentication, secure session storage, or auth middleware in Next.js.
extract-source-sample
Given the path to a finished content-goose ad-run folder, extract everything that defines that ad — recipe shot list, VO script, characters, voices, world, atom-skills, master mp4 — and emit a source-sample.json in the exact shape the upload-ad-sample skill writes to the Goose Ads library. Also links every character…
comprehensive-enrichment
Enrich any person or company from any identifier — email, name, LinkedIn URL, domain, company name, Twitter/X handle. Use when asked to enrich, look up, or research a lead, contact, person, or company.
google-search-ads-builder
End-to-end Google Search Ads campaign builder. Performs deep keyword research (competitor SEO, review language mining, Reddit/HN community terminology, site audit), builds keyword architecture with funnel mapping and intent classification, creates ad group structure, generates headline/description variants, builds…
create-chatgpt-mockup
Render pixel-accurate ChatGPT mobile (iOS) screen mockups in light mode from a thread JSON. Supports user text bubbles, user image attachments, assistant markdown prose, citation chips, the OpenAI spiral logo, the Apps-SDK GPT chip in the composer, and three header styles (model-tag, plain title, "Get Plus"). Fixed…