Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wedabro/bro-skills --skill speckit.identity-accessgit clone --depth 1 https://github.com/wedabro/bro-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wedabro/bro-skills/speckit.identity-access)<a href="https://agentmods.dev/skills/wedabro/bro-skills/speckit.identity-access"><img src="https://agentmods.dev/badge/skills/wedabro/bro-skills/speckit.identity-access/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wedabro/bro-skills/speckit.identity-access"><img src="https://agentmods.dev/badge/skills/wedabro/bro-skills/speckit.identity-access.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.00883 |
| Opus 5 | $0.00015 | $0.00441 |
| Sonnet 5 | $0.00006 | $0.00177 |
| Haiku 4.5 | $0.00003 | $0.00088 |
Grade A, and why
speckit.identity-access scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mission
Design identity and access flows that are standards-based, usable, auditable,
and safe under failure. Use this skill for authentication and authorization
architecture; use speckit.security to audit the completed implementation and
speckit.backend to implement service boundaries.
Required Inputs
- Actors, roles/permissions, tenancy, data sensitivity, regulatory constraints, supported clients, recovery needs, and existing identity provider contracts.
- The feature spec, threat model, session/token storage constraints, and user lifecycle requirements (join, change role, disable, recover, delete).
Protocol
0. Identity Decision Record
- State authenticators, relying parties, identity provider, trust boundaries, token/session model, credential storage, recovery channel, audit events, and availability/failure behavior before implementation.
- Choose the simplest standards-based flow compatible with the clients. For browser/native delegated login, prefer OAuth 2.0/OIDC authorization code with PKCE; do not use implicit flow or expose client secrets in public clients.
1. Authentication and Sessions
- Verify issuer, audience, signature, expiry, nonce/state, redirect URI, and required claims before accepting an identity assertion. Use short-lived, scoped credentials and rotation/revocation appropriate to the risk.
- Use secure, HttpOnly, SameSite cookies for browser sessions when practical; protect state-changing cookie requests from CSRF. Never put secrets or long-lived credentials in URLs, logs, browser storage, or client bundles.
- Implement rate limits, credential-stuffing defenses, secure password hashing where passwords exist, MFA/passkey enrollment, recovery, logout, session invalidation, and concurrent-session policy deliberately.
2. Authorization and Tenancy
- Model permissions around actions and resources, not UI visibility. Enforce RBAC, ABAC, or policy checks server-side on every sensitive read and write.
- Check object ownership, organization/tenant membership, role state, and scope at the use-case boundary. Never trust a client role, owner ID, or tenant ID.
- Propagate actor, tenant, delegated authority, and correlation context through APIs, jobs, caches, and data access. For tenant systems, add database-level isolation where feasible and test cross-tenant denial explicitly.
- Define privileged/admin break-glass access, approval, audit, expiry, and review. Apply least privilege by default and deny on missing context.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 86 lines · 30 tokens per session scan A 6190238abdba
speckit.identity-access is a skill published in the GitHub repository wedabro/bro-skills (2 stars, last pushed 15d ago), licensed MIT. It adds 30 tokens to every session and 883 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
科研可视化工具
A research-visualisation workflow for examining data and producing publication-ready charts for scientific papers.
math-modeling
A workflow for mathematical modelling, where real-world questions are represented with mathematics and solved with code or analysis.
math-modeling
A workflow for mathematical modelling, where real-world questions are represented with mathematics and solved with code or analysis.
DOCX工具
A tool for creating, editing, checking, and converting Microsoft Word DOCX files. It also handles LaTeX research papers, mathematical formulas, tables, tracked changes, and comments.
LaTeX工具
A tool for creating, compiling, and checking mathematical modelling papers written in LaTeX, a document system often used for technical writing.
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and…