Sonnet Amplified fullstack engine. 34 modes, SEC-01~15 OWASP security, 13 runtime hooks, 75% token reduction. Install: npx @smorky85/aurakit
Auskunft, Rechnungslegung und Schadensschätzung im Datenbankrecht nach §§ 97 101 UrhG: Dreigliedrige Schadensberechnung (konkreter Schaden, Herausgabe Verletzergewinn,…
Steuerberater: auslagerung an freie mitarbeiter - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit,…
Steuerberater: auslandsmandant und steuerdaten - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit,…
Wirtschaftsprüfer: auslandsmandat und ethics code - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit,…
Patentanwälte: auslandsvertreter und correspondent risk - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik,…
Vertiefter Skill fuer Audit Trail Freigaben. Fuehrt durch Intake, Rechtsrahmen, Beleglage, Risikoampel, Dokumentation, Freigabe und naechste Schritte im Aussenwirtschafts-, Zoll-…
Notare: auszahlungsanweisung konflikt - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit, Belegplan und…
Modern authentication and security patterns for web applications. Expert in JWT tokens, OAuth2 flows, session management, RBAC, MFA, API security, and zero-trust architectures.
负责认证与会话类漏洞检测：认证绕过/暴力破解/会话管理/OAuth/SAML/ 密码重置绕过/验证码绕过/不安全随机数/用户枚举/OIDC/CSRF。 受控密码测试为条件执行：根据用户授权、测试账号情况、验证码类型和登录保护强度自主决策。 泄露的 JWT/密钥/硬编码凭据由 api-agent 验证，不在本 Agent 职责内。
Review and analyze authentication and authorization patterns for security vulnerabilities.
Use when adding authentication, authorization, guards, or security middleware in a Lexigram application
Audit your authentication implementation for security flaws. Use when you need to verify your auth is actually secure.
Plan, implement, test, and diagnose server-side Swift authentication and authorization for Vapor and Hummingbird services, including Basic and Bearer auth, JWT, sessions, OAuth or…
Interactive setup for Azure DevOps authentication. Prompts for organization, project, and repo, validates a Personal Access Token, and saves credentials to gitignored…
Detect authentication and authorization bypass vulnerabilities including missing auth middleware, JWT algorithm confusion, IDOR, and session fixation.
Designs how a system knows who someone is and what they may do — login, sessions, tokens, roles, and permission checks.
Use when reviewing auth callbacks and edge API routes for state validation, randomness quality, rate limiting, token and cookie handling, and security-signal triage in this…
Find the weaknesses in an application's login and session design (passwords, sessions and cookies, OAuth and OIDC with PKCE, state and redirect URIs, MFA, password reset, account…
Read-only review of authentication AND authorization flows — session/token model, cookie flags, CSRF, token rotation, password-reset/email-verification, OAuth redirect/state, and…
Better Auth integration specialist for user authentication, sessions, and security management
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems.
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems.
Implements secure authentication patterns including login/registration, session management, JWT tokens, password hashing, cookie settings, and CSRF protection.
Authentication and authorization patterns - JWT, OAuth2, sessions, RBAC, ABAC, passkeys, and MFA. Use for: authentication, authorization, jwt, oauth, oauth2, session, login, rbac,…
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems.
OAuth 2.1 + JWT authentication security best practices. Use when implementing auth, API authorization, token management. Follows RFC 9700 (2025).
OAuth 2.1, JWT (RFC 8725), encryption, and authentication security expert. Enforces 2026 security standards.
JWT authentication with Better Auth, token verification, user isolation, and security middleware. Use when implementing auth, protecting endpoints, or verifying tokens.
Reviews authentication and authorization implementation for session management, CSRF, cookie security, and auth flow vulnerabilities with findings, severity assessment, and fix…
Autonomous validation of authentication security. Checks password hashing, cookie configuration, CSRF protection, and session management for OWASP compliance.
Use when a ticket touches how a user proves who they are — login, logout, sessions, cookies, JWTs, refresh tokens, password reset, OAuth/OIDC sign-in with a provider, API keys —…
Security-first authentication, authorization, and session management architect for modern web + mobile apps using Supabase Auth.
Signer abstraction patterns in Amethyst. Use when working with event signing, choosing between a local keypair (`NostrSignerInternal`), a remote NIP-46 bunker signer…
Identity, JWT rules, session management, and security logic for authentication. Use when building or modifying login, registration, password resets, token generation, or…
Authentication and authorization expert for OAuth, sessions, JWT, MFA, and identity securityUse when "authentication flow, login system, oauth integration, jwt tokens, session…
Authentication system design and implementation guidance with Python examples using strict typing. Use when: (1) Designing authentication flows (signup, login, logout, refresh),…
Guidelines for implementing Auth0 authentication with best practices for security, rules, actions, and SDK integration
Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth…
Production-grade authentication & authorization covering JWT, cookies, sessions, hashing, MFA, OAuth2, RBAC, and permissions across all frameworks (Next.js, Express.js, F — from…
OAuth 2.1 compliant authentication flows (MANDATORY Q2 2026). PKCE required for ALL clients, Implicit Flow removed, modern token security.
Manages authentication flow for MutuaPIX (Laravel Sanctum + Next.js), handles mock mode security, and validates environment configurations
Expert guidance on authentication implementation including OAuth 2.0/OIDC, JWT tokens, session management, and secure password handling.
Comprehensive authentication implementation guidance including JWT best practices, OAuth 2.0/OIDC flows, Passkeys/FIDO2/WebAuthn, MFA patterns, and secure session management.
Use to review authentication for security weaknesses — credential storage, session/token handling, brute-force and enumeration resistance, reset/OTP/MFA flows, and…
[STUB - Not implemented] Authentication security including JWT validation, session management, and OAuth2/OIDC flows. PROACTIVELY activate for: [TODO: Define on implementation].
Design and implement authentication and authorization systems. Use when setting up user login, JWT tokens, OAuth, session management, or role-based access control.
Production-grade authentication & authorization covering JWT, cookies, sessions, hashing, MFA, OAuth2, RBAC, and permissions across all frameworks (Next.js, Express.js, F — from…
Design sign-in so credentials are hashed with a slow algorithm, guessing is rate limited, and sessions rotate on login to defeat fixation.
Turn validated security behavior into tested detection content. Use for Sigma, osquery, YARA-X routing, endpoint queries, SIEM rules, cloud or application detections, correlation…
Author a new Cody skill and ship it end-to-end. Writes skills//SKILL.md, commits on the secret-agent-skills-bank branch (Cody's own branch), and fast-forwards main to the…
Author, test, tune, and document YARA-X detection rules from validated artifact evidence. Use when malware, suspicious files, scripts, documents, or binary features need local…
Use to review authorization for security holes — IDOR/BOLA, missing ownership/tenant checks, privilege escalation, trusting client-supplied IDs/roles, and function-level access…
Use for user-authorized black-box web security testing, especially when asked to act like a hacker, test a public site for data leakage or unauthorized modification, review…
Use this to access external services/CLIs/APIs: Gmail/gh/Github/Stripe etc. or when running any bash command, script, or curl/wget that makes outbound HTTP calls.
Inject secrets into subprocesses via environment variables. You never see secret values — authy run injects them directly.
Hunt for authorization bypass vulnerabilities including IDOR, privilege escalation, missing access controls, broken object-level authorization.
Autonomous task execution with testing and security. Works through all tasks without stopping.
Automated IT helper for detecting and fixing code issues. Use when code fails tests, linting, type-checking, or has security vulnerabilities.
Automate database backup processes with scheduling, compression, and encryption. Supports PostgreSQL (pg_dump), MySQL (mysqldump), MongoDB (mongodump), and SQLite.