auth▌

Scaffold and implement authentication in TypeScript/JavaScript apps with Better Auth framework detection, database adapter setup, and OAuth integration. \n \n Detects frameworks (Next.js, SvelteKit, Nuxt, Astro, Express, Hono), databases (Prisma, Drizzle, MongoDB, raw drivers), and existing auth libraries through project scanning \n Supports email/password, OAuth (Google, GitHub, Apple, Microsoft, Discord, Twitter), magic links, passkeys, and phone authentication with configurable email verifica

Authenticate a user session against Xero — either via OAuth 2.0 / OIDC (recommended, supported) or as a fallback by scripting the password form at login.xero.com/identity/user/login. Documents the canonical URL, form schema, anti-bot stack (Akamai + browsercheck + AspNetCore antiforgery), and all five branch outcomes (MFA, SSO, passkey, lockout, invalid credentials).

Configure and manage CloudBase authentication providers including anonymous, SMS, email, WeChat, Google, and OAuth methods. \n \n Supports 8+ authentication methods: anonymous login, username/password, SMS, email (Tencent Cloud or custom SMTP), WeChat Open Platform, Google OAuth, SAML, CAS, and Dingding \n Query current login strategy via DescribeLoginStrategy , then modify provider settings with ModifyLoginStrategy or ModifyProvider API calls \n Email authentication offers dual configuration: b

### offensive-jwt - JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parame - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

### offensive-oauth - - **Skill Name**: oauth-attacks - Practical, repeatable guidance for authorized security work. - Includes procedures, checks, and references for this skill.

Sync cookies from local Chrome to a Browserbase persistent context for authenticated browsing.

Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices.

Convex authentication setup with provider selection, user management, and access control patterns. \n \n Supports multiple auth providers: Convex Auth, Clerk, WorkOS AuthKit, Auth0, and custom JWT, with provider detection from repo signals before setup \n Guides identity mapping to a users table, getCurrentUser helpers, and authorization patterns for ownership, admin, and team access checks \n Includes provider-specific reference files for package installation, environment variables, client wiri

Set up Firebase Authentication with multiple identity providers and secure data access. \n \n Supports email/password, phone number, anonymous, federated providers (Google, Facebook, Twitter, GitHub, Microsoft, Apple), and custom auth integration \n Users are identified by unique UIDs with optional properties including email, display name, photo URL, and email verification status \n Authentication via CLI enables Google Sign In, anonymous auth, and email/password; other providers require Firebas

Server-side identity and user lookup for CloudBase Node.js backends and cloud functions. \n \n Retrieve caller identity ( uid , customUserId , openId ) in cloud functions using getUserInfo() for authorization and personalization decisions. \n Query CloudBase user profiles by uid or login identifier (phone, email, username, custom ID) using getEndUserInfo() and queryUserInfo() . \n Issue custom login tickets from Node backends to bridge existing user systems into CloudBase without requiring separ