Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/qauth-labs/qauth/securitynpx skills add qauth-labs/qauth --skill securitygit clone --depth 1 https://github.com/qauth-labs/qauthWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.02067 |
| Opus 5 | $0.00032 | $0.01033 |
| Sonnet 5 | $0.00013 | $0.00413 |
| Haiku 4.5 | $0.00006 | $0.00207 |
Grade A, and why
security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security (QAuth)
Standards-aligned security for QAuth: authentication, authorization, rate limiting, timing-safe operations, secrets, and dependency hygiene. Use this skill when implementing or reviewing security-sensitive code, handling CVEs, or aligning with OWASP and related standards.
When to Use This Skill
- Implementing or changing auth flows (login, token, PKCE, JWT)
- Adding rate limits, error handling, or audit logging
- Handling secrets, keys, or environment configuration
- Reviewing code for OWASP API Security risks
- Addressing dependency vulnerabilities (npm/pnpm audit, CVE)
Quick Reference
| Concern | QAuth pattern |
|---|---|
| Passwords | Argon2id via @node-rs/argon2; never store plaintext; validate strength (zxcvbn) |
| Timing | Constant-time comparison for PKCE (crypto.timingSafeEqual); minimum response time on login/token/refresh |
| Rate limiting | Per-route and global via @fastify/rate-limit; Redis store; env-driven limits |
| Errors | Generic messages for auth failures (no user enumeration); domain errors from @qauth-labs/shared-errors |
| Secrets | Keys in env/secrets manager; never in images or logs; see ADR-001 for JWT keys |
| Audit | Log auth/token events to audit_logs (success/failure, IP, userAgent, metadata) |
| Dependencies | Run pnpm audit (or npm audit); fix or document exceptions; track CVEs |
OWASP API Security Top 10:2023 — Checklist
- API1 Broken Object Level Authorization: Check object IDs against current user/realm; validate every access by ID.
- API2 Broken Authentication: Strong auth (OAuth 2.1 + PKCE, JWT with Ed25519); no default/weak creds; rate limit auth endpoints.
- API3 Broken Object Property Level Authorization: Don't over-expose or mass-assign; validate input and response shape.
- API4 Unrestricted Resource Consumption: Rate limit (global + per-route); limit payload size; timeouts.
- API5 Broken Function Level Authorization: Enforce admin vs user; validate scope and client type.
- API6 Unrestricted Access to Sensitive Business Flows: Rate limit login, token, register, resend-verification; consider CAPTCHA/MFA for sensitive flows.
- API7 SSRF: Validate and allowlist URLs when fetching remote resources; no user-controlled URLs to internal services.
- API8 Security Misconfiguration: Secure defaults; no debug in production; HTTPS; lock headers (CORS, etc.).
- API9 Improper Inventory Management: Document endpoints; version APIs; remove or protect deprecated/debug routes.
- API10 Unsafe Consumption of APIs: Validate and sanitize data from third-party APIs; don't trust upstream blindly.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 122 lines · 63 tokens per session scan A 1b09947b0438
security is a skill published in the GitHub repository qauth-labs/qauth (24 stars, last pushed 7d ago), licensed Apache-2.0. It adds 63 tokens to every session and 2,067 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
write-e2e-test
Write end-to-end (e2e) tests for authgear-server. Use when the user asks to write, add, or create e2e tests. The tests live in e2e/tests/ and are YAML-driven.
add-portal-screen
Add screens or components to the portal frontend. Use when the user asks to create a new portal page, screen, tab, or UI component.
api-design
Review or design APIs for Authgear. In review mode, evaluates a design draft against the checklist. In ideation mode, develops a design from a description and self-reviews it.
update-deps
Audit and fix dependency vulnerabilities in Go and Node.js packages. Runs govulncheck for Go and npm audit for each package.json directory. Commits fixes directory by directory.
new-siteadmin-api
Full pipeline for adding a new Site Admin API feature — from OpenAPI spec through implementation plan to working service. Use when adding a new endpoint or filling in real data for an existing stub.
update-portal-ui
Guidelines for updating or designing pages in the portal React frontend (portal/src). Covers component conventions, link rendering rules, i18n patterns, and common pitfalls.