Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add seandkendall/kiro-config --skill cognito-passkey-authgit clone --depth 1 https://github.com/seandkendall/kiro-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/seandkendall/kiro-config/cognito-passkey-auth)<a href="https://agentmods.dev/skills/seandkendall/kiro-config/cognito-passkey-auth"><img src="https://agentmods.dev/badge/skills/seandkendall/kiro-config/cognito-passkey-auth/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/seandkendall/kiro-config/cognito-passkey-auth"><img src="https://agentmods.dev/badge/skills/seandkendall/kiro-config/cognito-passkey-auth.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 12 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 143 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 238 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 275 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 293 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 294 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 295 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 300 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 143 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 164 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 237 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 275 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 365 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.02705 |
| Opus 5 | $0.00017 | $0.01352 |
| Sonnet 5 | $0.00007 | $0.00541 |
| Haiku 4.5 | $0.00003 | $0.00270 |
Grade A, and why
cognito-passkey-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 371 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Amazon Cognito — Custom UI with Passkeys, Social Login & Face ID
Overview
Full custom authentication UI (no Hosted UI) using Cognito User Pools with:
- Email + Password (standard)
- Sign in with Apple
- Sign in with Google
- Passkey / WebAuthn (FIDO2)
- Face ID / Touch ID (biometric after initial auth)
- Magic Link (passwordless email)
CDK Configuration
User Pool
from aws_cdk import (
aws_cognito as cognito,
Duration,
)
user_pool = cognito.UserPool(self, 'RoadCastUserPool',
user_pool_name='roadcast-users',
self_sign_up_enabled=True,
sign_in_aliases=cognito.SignInAliases(email=True, phone=True),
auto_verify=cognito.AutoVerifiedAttrs(email=True),
standard_attributes=cognito.StandardAttributes(
email=cognito.StandardAttribute(required=True, mutable=True),
fullname=cognito.StandardAttribute(required=True, mutable=True),
phone_number=cognito.StandardAttribute(required=False, mutable=True),
),
custom_attributes={
'avatar_url': cognito.StringAttribute(mutable=True),
'preferences': cognito.StringAttribute(mutable=True),
},
password_policy=cognito.PasswordPolicy(
min_length=8,
require_lowercase=True,
require_uppercase=True,
require_digits=True,
require_symbols=False,
temp_valid_duration=Duration.days(7),
),
account_recovery=cognito.AccountRecovery.EMAIL_ONLY,
removal_policy=RemovalPolicy.RETAIN,
mfa=cognito.Mfa.OPTIONAL,
mfa_second_factor=cognito.MfaSecondFactor(sms=True, otp=True),
)
App Client (Custom UI — no Hosted UI)
app_client = user_pool.add_client('RoadCastMobileClient',
user_pool_client_name='roadcast-ios',
generate_secret=False, # Public client for mobile
auth_flows=cognito.AuthFlow(
user_password=True, # Email + password
user_srp=True, # Secure Remote Password
custom=True, # Custom auth (magic link, passkey)
),
o_auth=cognito.OAuthSettings(
flows=cognito.OAuthFlows(authorization_code_grant=True),
scopes=[cognito.OAuthScope.OPENID, cognito.OAuthScope.EMAIL, cognito.OAuthScope.PROFILE],
callback_urls=['roadcast://auth/callback'],
logout_urls=['roadcast://auth/logout'],
),
prevent_user_existence_errors=True,
access_token_validity=Duration.hours(1),
id_token_validity=Duration.hours(1),
refresh_token_validity=Duration.days(30),
)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 371 lines · 34 tokens per session scan A 6ccc842350a8
cognito-passkey-auth is a skill published in the GitHub repository seandkendall/kiro-config (8 stars, last pushed today), licensed Apache-2.0. It adds 34 tokens to every session and 2,705 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
aws-cdk
AWS CDK infrastructure development in TypeScript. Use when creating stacks, constructs, L2/L3 patterns, CDK testing, synth/deploy pipelines or organizing IaC code.
aws-lambda-typescript
AWS Lambda development with TypeScript. Use when writing Lambda handlers, bundling with esbuild, using AWS SDK v3/Powertools, strict typing or optimizing Node.js Lambda performance.
aws-serverless
Building production-ready serverless applications on AWS. Use when working with Lambda, API Gateway, SQS, SNS, DynamoDB Streams, SAM/CDK deployment or optimizing cold starts.
aws-terraform
AWS infrastructure with Terraform. Use when creating modules, managing remote state, writing tftest.hcl tests, refactoring IaC or following HashiCorp style guide.
aws-architecture
AWS architecture decisions, serverless patterns, event-driven design, service boundaries and Well-Architected Framework. Use when designing system architecture or making infrastructure tradeoffs.
aws-lambda-python
AWS Lambda development with Python. Use when writing Lambda handlers, packaging with layers, using boto3/Powertools, structured logging or optimizing Python Lambda performance.