Authentication Flow
Login, signup, password reset, SSO, MFA, and authentication UX patterns.
Install
$ agentstack add skill-dragoon0x-everything-design-taste-authentication-flow ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-dragoon0x-everything-design-taste-authentication-flow) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Authentication Flows
Sign Up
- Minimum fields: Email and password (or just email for magic link)
- Social sign-in options above the form (Google, GitHub, Apple)
- Password requirements shown proactively, not after failed attempt
- Email verification via link, not code (less friction)
Log In
- Email + password as default
- "Remember me" checkbox
- "Forgot password?" link visible near password field
- Show/hide password toggle
- Rate limit failed attempts (show "try again in X seconds")
Password Reset
- Enter email → 2. Check email → 3. Set new password → 4. Confirmed
- Don't confirm whether the email exists (security)
- Reset links expire (1 hour typical)
- Invalidate old passwords on reset
Multi-Factor Authentication
- SMS codes are the minimum (but weakest)
- Authenticator apps are better (TOTP)
- Passkeys/WebAuthn are best (no codes needed)
- Recovery codes: show once, make user save them
- Don't force MFA setup during onboarding (ask after first valuable action)
Single Sign-On
- Prominent SSO buttons with correct brand colors and logos
- "Continue with Google" not "Sign in with Google" (works for both login and signup)
- Handle account linking (same email, different auth method)
Session Management
- Show active sessions in settings
- Allow remote logout
- Auto-logout after inactivity (configurable for sensitive apps)
- Extend session silently on activity (no popup interruptions)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: Dragoon0x
- Source: Dragoon0x/everything-design-taste
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.