会话认证、社交登录提供商、CSRF 保护以及安全 Cookie 模式的实现指南。
该技能提供了一整套构建安全 Web 应用程序认证体系的规则和最佳实践。它专注于会话管理，推荐对 API 间的通信使用 JWT，对面向用户的 Web 应用则采用基于会话的认证方式。技能涵盖了多种社交登录提供商（最低要求 Google 和 GitHub）、无密码魔法链接、基于角色的访问控制以及强大的 CSRF 防护。其核心在于通过使用 httpOnly 和安全 Cookie 来避免常见的前端存储漏洞，并强调使用 bcrypt 或 argon2 等经过验证的库进行密码哈希，而不是自行实现。该技能适用于任何需要健壮认证层的 Web 开发项目，尤其在 Next.js、Nuxt 或类似框架中，它提供了清晰的媒介件拦截、会话检查和 Cookie 配置模式，帮助开发者快速构建安全、可扩展的认证系统。
npx skills add https://github.com/YepAPI/skills/tree/HEAD/skills/authuser.role 字段配合中间件检查httpOnly、secure、sameSite: "lax"、合理的 maxAgeThis repo contains 20 individual skills — each has its own dedicated page.
WCAG 2.1 AA — semantic HTML, keyboard navigation, screen readers.
Experiment setup, variant splitting, statistical significance, and feature flag integration.
CRUD generators, data tables, user management, role-based access, and bulk operations.
Monitor what ChatGPT and Gemini say about your brand using YepAPI.
Queue workers with BullMQ/Inngest/Trigger.dev, job retries, dead letter queues, concurrency.
Commander.js, interactive prompts with Clack, spinners, colors, config files, exit codes, and npm publishing.
cmdk integration, Cmd+K trigger, fuzzy search, grouped actions, keyboard navigation, and dynamic action registration.
Content planning with trend and sentiment data from YepAPI.
Content calendar, keyword-driven planning, and content briefs.
Theme switching with CSS variables, system preference detection, next-themes, and persistence.
Threaded comments, @mentions, reactions, moderation queue, optimistic UI, and cursor pagination.
Competitive analysis between domains using YepAPI.
Layout grids, KPI cards, data tables with sorting/filtering, sidebar navigation, and responsive breakpoints.
Data encryption — TLS everywhere, AES-256-GCM for PII, bcrypt passwords, encrypted backups.
Chart patterns with Recharts/Nivo/D3, responsive containers, color scales, and accessibility.
Drizzle schema definition, push vs migrate, type-safe queries, relations, transactions, and prepared statements.
Upload handling, resize/compress, CDN delivery, blur placeholders, and next/image patterns.
Local business and Google Maps research using YepAPI.
Cursor-based pagination, IntersectionObserver, virtualized lists with @tanstack/react-virtual, and scroll position restoration.
Chat UI components, streaming responses with AI SDK, context window management, and RAG patterns.
ElevenLabs text-to-speech with mac-style say UX.
Oracle CLI second-model review/debug/refactor/design with selected files, dry-run token checks, API or browser engine.
Capture and automate macOS UI with the Peekaboo CLI.
Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".
Build a throwaway prototype to flesh out a design — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.
Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".