工作階段驗證、社交登入提供者、CSRF 保護以及安全 Cookie 模式。
此技能為網頁應用程式定義了一套全面的驗證與授權實務守則，涵蓋工作階段管理、社交登入整合、CSRF 保護以及安全 Cookie 設定。它強制採用基於工作階段的驗證，僅在 API 對 API 的情境下使用 JWT，確保路由保護中介層能確認有效工作階段後才渲染內容。該技能指定至少支援 Google 與 GitHub 作為社交登入提供者，並建議使用魔法連結做為密碼替代方案，以提升安全性與使用者體驗。同時也透過 `user.role` 欄位強制實施基於角色的存取控制，搭配中介層驗證，並在所有變更端點上加入 CSRF 保護。安全性方面要求 Cookie 必須設定 `httpOnly`、`secure`、`sameSite: "lax"` 以及適當的 `maxAge`，並實施重新整理令牌輪換機制。此技能適用於 Claude Code、Cursor、Codex 等 AI 代理平台，能幫助開發者避免將令牌儲存在 localStorage、自製密碼雜湊或缺少伺服器驗證的客戶端角色檢查等常見陷阱。
npx skills add https://github.com/YepAPI/skills/tree/HEAD/skills/authuser.role 欄位搭配中介層檢查httpOnly、secure、sameSite: "lax"、適當的 maxAgeThis repo contains 20 individual skills — each has its own dedicated page.
WCAG 2.1 AA — semantic HTML, keyboard navigation, screen readers.
Experiment setup, variant splitting, statistical significance, and feature flag integration.
CRUD generators, data tables, user management, role-based access, and bulk operations.
Monitor what ChatGPT and Gemini say about your brand using YepAPI.
Queue workers with BullMQ/Inngest/Trigger.dev, job retries, dead letter queues, concurrency.
Commander.js, interactive prompts with Clack, spinners, colors, config files, exit codes, and npm publishing.
cmdk integration, Cmd+K trigger, fuzzy search, grouped actions, keyboard navigation, and dynamic action registration.
Content planning with trend and sentiment data from YepAPI.
Content calendar, keyword-driven planning, and content briefs.
Theme switching with CSS variables, system preference detection, next-themes, and persistence.
Threaded comments, @mentions, reactions, moderation queue, optimistic UI, and cursor pagination.
Competitive analysis between domains using YepAPI.
Layout grids, KPI cards, data tables with sorting/filtering, sidebar navigation, and responsive breakpoints.
Data encryption — TLS everywhere, AES-256-GCM for PII, bcrypt passwords, encrypted backups.
Chart patterns with Recharts/Nivo/D3, responsive containers, color scales, and accessibility.
Drizzle schema definition, push vs migrate, type-safe queries, relations, transactions, and prepared statements.
Upload handling, resize/compress, CDN delivery, blur placeholders, and next/image patterns.
Local business and Google Maps research using YepAPI.
Cursor-based pagination, IntersectionObserver, virtualized lists with @tanstack/react-virtual, and scroll position restoration.
Chat UI components, streaming responses with AI SDK, context window management, and RAG patterns.
ElevenLabs text-to-speech with mac-style say UX.
Oracle CLI second-model review/debug/refactor/design with selected files, dry-run token checks, API or browser engine.
Capture and automate macOS UI with the Peekaboo CLI.
Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".
Build a throwaway prototype to flesh out a design — a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.
Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".