Community编程与开发github.com

Anmolop97/Agent-Skills

掌握JWT、OAuth2、会话管理和RBAC等认证与授权模式,构建安全、可扩展的访问控制系统。用于实现认证系统、保护API或调试安全问题。

Agent-Skills 是什么?

该技能旨在帮助开发者和AI代理快速掌握并实现行业标准的认证与授权模式,包括JWT、OAuth2、会话管理、基于角色的访问控制(RBAC)等。它提供了从威胁建模到策略执行的全流程指导,适用于构建安全的REST或GraphQL API、集成OAuth2/社交登录或SSO,以及调试相关安全漏洞。技能支持区域包括会话令牌、OIDC协议、密钥存储与轮换、日志审计等实践,并强调了最小权限原则和凭证安全存储的重要性。该技能主要面向Agent-SDK平台(如Claude Code、Cursor、Codex)的用户,通过详细的资源文件(如`resources/implementation-playbook.md`)提供可操作的模式和示例,确保快速落地生产级安全方案。

兼容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/Anmolop97/Agent-Skills/tree/HEAD/skills/auth-implementation-patterns

Installed? Explore more 编程与开发 skills: steipete/bluebubbles, steipete/eightctl, steipete/blucli · View all 6 →

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

文档

认证与授权实现模式

使用行业标准模式和现代最佳实践,构建安全、可扩展的认证与授权系统。

使用此技能的场景

  • 实现用户认证系统
  • 保护REST或GraphQL API
  • 添加OAuth2/社交登录或SSO
  • 设计会话管理或RBAC
  • 调试认证或授权问题

不使用此技能的场景

  • 仅需要UI文案或登录页面样式
  • 任务仅涉及基础设施,没有身份关联问题
  • 无法更改认证策略或凭据存储

使用指导

  • 定义用户、租户、流程和威胁模型约束。
  • 选择认证策略(会话、JWT、OIDC)和令牌生命周期。
  • 设计授权模型和策略执行点。
  • 规划密钥存储、轮换、日志记录和审计要求。
  • 如需详细示例,请打开 resources/implementation-playbook.md。

安全注意事项

  • 切勿记录密钥、令牌或凭据。
  • 实施最小权限原则,并确保密钥的安全存储。

资源

  • resources/implementation-playbook.md:提供详细的模式和示例。

Individual skills in this repo

This repo contains 4 individual skills — each has its own dedicated page.

Anmolop97/Agent-Skills

Searches, installs, updates, and lists skills from the Antigravity Skill Vault. Use when choosing or managing workspace or global skills through the npm CLI.

Anmolop97/Agent-Skills

Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.

Anmolop97/Agent-Skills

Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration. TRIGGER — read BEFORE opening the target file; don't skip because it "looks like a one-liner" — whenever: the prompt names Claude/Anthropic in any form (Claude, Anthropic, Fable, Opus, Sonnet, Haiku, `anthropic`, `@anthropic-ai`, `claude-*`, `us.anthropic.*`, `[1m]`); the user asks about an LLM (pricing/model choice/limits/caching) — never answer from memory; OR the task is LLM-shaped with provider unstated (agent/MCP/tool-definition/multi-agent/RAG/LLM-judge/computer-use; generate/summarize/extract/classify/rewrite/converse over NL; debugging refusals/cutoffs/streaming/tool-calls/tokens). SKIP only when another provider is being worked on (overrides all triggers): OpenAI/GPT/Gemini/Llama/Mistral/Cohere/Ollama named in the query; OR `grep -rE 'openai|langchain_openai|google.generativeai|genai|mistralai|cohere|ollama'` over the project hits (run this grep FIR...

Anmolop97/Agent-Skills

Searches, installs, updates, and lists skills from the Antigravity Skill Vault. Use when choosing or managing workspace or global skills through the npm CLI.

相关技能