skill-ihatesea69-kiro-kit-better-auth · by Install
$ agentstack add skill-ihatesea69-kiro-kit-better-auth ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-ihatesea69-kiro-kit-better-auth) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Better Auth
Activate this skill when implementing authentication or authorization systems.
When to Use
- Adding authentication to an application
- Implementing OAuth flows (Google, GitHub, Discord)
- Setting up JWT or session-based auth
- Implementing role-based access control (RBAC)
- Adding multi-factor authentication (TOTP, SMS)
- Managing user sessions and token refresh
- Implementing passkeys/WebAuthn
Authentication Patterns
JWT (Stateless)
- Short-lived access tokens (15-60 minutes)
- Long-lived refresh tokens (7-30 days, stored securely)
- Rotate refresh tokens on use (detect token theft)
- Include minimal claims (user ID, roles)
- Validate signature, expiry, and issuer on every request
Session-Based (Stateful)
- Store sessions server-side (Redis for distributed)
- Use httpOnly, secure, sameSite cookies
- Implement session rotation on privilege escalation
- Set absolute and idle timeouts
- Invalidate all sessions on password change
OAuth 2.1
- Use PKCE for all flows (including server-side)
- Validate state parameter to prevent CSRF
- Store tokens encrypted at rest
- Implement token refresh before expiry
- Handle provider-specific scopes and claims
Authorization Patterns
- RBAC: roles with permission sets
- ABAC: attribute-based policies for complex rules
- Resource-based: check ownership before access
- Always check authorization server-side (never trust client)
Security Rules
- Hash passwords with bcrypt (cost 12+) or argon2id
- Use constant-time comparison for tokens
- Implement account lockout after failed attempts
- Log all auth events for audit trail
- Never store plain-text passwords or tokens
- Validate redirect URIs strictly (no open redirects)
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ihatesea69
- Source: ihatesea69/kiro-kit
- License: MIT
- Homepage: https://www.npmjs.com/package/kiro-kit
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.