OAuth
AuthCommonly used with
Skills using OAuth (167)
blog-google
Google API integration for blog performance: PageSpeed Insights, CrUX Core Web Vitals with 25-week history, Search Console performance, URL Inspection, Indexing API, GA4 organic traffic, NLP entity analysis for E-E-A-T, YouTube video search for embedding, and Google Ads Keyword Planner. Progressive feature availability based on credential tier (API key, OAuth/service account, GA4, Ads). Shares config with claude-seo at ~/.config/claude-seo/google-api.json. Use when user says "google data", "page speed", "core web vitals", "search console", "indexation", "GA4", "keyword research", "nlp entities", "blog performance", "youtube search", "google api setup".
skill-copilot-provider
GitHub Copilot CLI as optional zero-cost provider via copilot -p programmatic mode
api-docs-writer
Write clear, developer-facing API documentation. Use when asked to document an API endpoint, write API reference docs, create a developer guide, or turn a raw spec/Postman collection into documentation. Produces endpoint documentation with descriptions, parameters, request/response examples, and error codes.
blackbox
Delegate coding tasks to the Blackbox AI multi-model CLI.
mcp-oauth-remote-gateway
Manual OAuth for remote MCP servers on headless gateways.
x-api
X/Twitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.
add-gcal-tool
Add Google Calendar as an MCP tool (list calendars, list/search/create events, free/busy queries) using OneCLI-managed OAuth. Multi-calendar and multi-account supported. Mirrors /add-gmail-tool's stub pattern — no raw credentials ever reach the container; OneCLI injects real tokens at request time.
use-native-credential-proxy
Opt out of the OneCLI gateway and supply Anthropic credentials from .env instead. For users who want simple .env-based credential management without the OneCLI agent vault. Reads the API key or OAuth token from .env and injects it into the container's API requests.
agent-code-goal-planner
Agent skill for code-goal-planner - invoke with $agent-code-goal-planner
authentication-patterns
Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.
api-design-patterns
Comprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices
copilot-sdk-e2e-dev
Spin up a live local Omnigent server and exercise the GitHub Copilot SDK harness end-to-end — build copilot agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the copilot harness (omnigent/inner/copilot_executor.py, copilot_harness.py, omnigent/onboarding/copilot_auth.py) or its auth / model / tool-bridge behavior.
ros2-web-integration
Patterns and best practices for integrating ROS2 systems with web technologies including REST APIs, WebSocket bridges, and browser-based robot interfaces. Use this skill when building web dashboards for robots, streaming camera feeds to browsers, exposing ROS2 services as REST endpoints, or implementing bidirectional WebSocket communication between web UIs and ROS2 nodes. Trigger whenever the user mentions rosbridge, rosbridge_suite, roslibjs, FastAPI with ROS2, Flask with rclpy, WebSocket for robot telemetry, MJPEG streaming, WebRTC for robots, REST API wrapping ROS2 services, web-based robot control, browser robot interface, robot dashboard, CORS configuration for robots, or any web-to-ROS2 bridge pattern. Also trigger for authentication on robot web interfaces, rate limiting sensor streams, video streaming from robot cameras to browsers, or running async web frameworks alongside the ROS2 executor. Covers rosbridge_suite, FastAPI, Flask, WebSocket, and WebRTC approaches.
ha-integration-dev
Home Assistant custom integration development in Python. Covers custom_components, DataUpdateCoordinator, config_flow, OAuth2, conversation agent, HACS publishing, device registry, entity platforms, services, repair issues, diagnostics, Bluetooth integrations, and multi-coordinator patterns.
secure-auth
Secure authentication implementation patterns. Use when implementing user login, registration, password reset, session management, JWT authentication, OAuth, MFA, or passkeys. Provides production-ready patterns aligned with NIST SP 800-63B-4, OWASP 2026 cheat sheets, OAuth 2.1, and WebAuthn L3, with breach-driven lessons.
changelog-gen
Changelog 生成器 - 从 Git 历史自动生成 CHANGELOG
bernstein-plan
Create and manage multi-step execution plans in Bernstein. Plans decompose complex goals into stages with dependencies. Use when the user wants to plan a complex feature, break down a large task, or review an execution plan before agents start working.
feishu-docx
Export, write, and manage Feishu/Lark cloud documents. Supports docx, sheets, bitable, wiki, WeChat article import/export, drive management, and browser-based export for public or browser-readable docs. Use this skill when you need to read, analyze, write, or manage content in a Feishu knowledge base.
hunt-misc
Hunting skill for misc vulnerabilities. Built from 225 public bug bounty reports. Use when hunting misc on any target.
hunt-open-redirect
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.
seo-google
Google SEO APIs: Search Console (Search Analytics, URL Inspection, Sitemaps), PageSpeed Insights v5, CrUX field data with 25-week history, Indexing API v3, and GA4 organic traffic. Provides real Google field data for Core Web Vitals, indexation status, search performance, and organic traffic trends. Use when user says "search console", "GSC", "PageSpeed", "CrUX", "field data", "indexing API", "GA4 organic", "URL inspection", "google api setup", "real CWV data", "impressions", "clicks", "CTR", "position data", "LCP", "INP", "CLS", "FCP", "TTFB", or "Lighthouse scores".
wjs-looping-feedback
Use when the user wants to add an in-site feedback loop to a website repo — a floating "提个建议" button where allowlisted visitors submit suggestions that become a GitHub Issue, which GitHub Actions turns into an automatic code change via Claude Code, auto-merges and deploys, and records on a /_feedback dashboard with one-click revert. Triggers — "给网站加个反馈对话框", "提一句话就自动改网站", "装上反馈闭环", "feedback loop", "/wjs-looping-feedback".
ops-home
Smart home command center via Homey Pro. Devices, flows, scenes, energy, climate, presence, alarms. Works via Homey local API (preferred) + Athom cloud API fallback. Configure once via /ops:setup.
ops-integrate
Add any SaaS API as a first-class integration. Provide the service name — ops-integrate discovers auth patterns, tests connectivity, and registers the API in your partner registry so it's available to other skills.
ops-rotate
Multi-account Claude Max rotator. Status, manual rotation, account list, add-account wizard, and CRS relay-pool auto-prioritization. Requires account_rotation_enabled=true in plugin settings.
ops-rotate-setup
Interactive OAuth init wizard for the multi-account Claude rotator. Walks through every account in the rotation config and, for any account missing a valid keychain token, delegates to the proven `rotate.mjs` magic-link flow (browser-driver cascade + Gmail polling), which writes the verified OAuth token to `Claude-Rotation-<key>` (key = account label or email, keychain account `$USER`). Re-runnable any time. Standalone alias of the same step inside `/ops:setup`.
corezoid
Universal Corezoid assistant. Use when the user asks anything about Corezoid processes, wants to work with process JSON files, mentions process nodes, MCP tools, process validation, or any Corezoid-specific task. Also use when the user mentions "Corezoid", "BPM process", "conv.json", "push process", "run task", or asks for general platform knowledge. This skill provides deep knowledge of the platform model and guides you to use the Corezoid MCP tools correctly.
corezoid-init
Corezoid environment setup specialist. Use when the user wants to connect to Corezoid, set up credentials, authenticate, pull a project, configure the environment, or start working with a Corezoid project for the first time. Activate when the user says "init", "setup", "connect to corezoid", "login", "pull workspace", "configure environment", or "get started".
git-workflow
Git 工作流专家。规范化版本控制，确保提交历史清晰可追溯。支持 Conventional Commits 规范、Pull Request 最佳实践、分支管理策略和自动化工作流。
rotate-secrets
Rotate webhook HMACs, API keys, OAuth tokens, and update gateway configs atomically
evidence-hygiene
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results table for rate-limit attacks), Chrome DevTools Console PoC patterns (credentials include so cookies are not echoed, labeled console.log), screenshot capture order, filename conventions, post-submission rotation hygiene. Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII. Pairs with bugcrowd-reporting and report-writing.
fastapi-senior-dev
Senior Python Backend Engineer skill for FastAPI. Use when scaffolding production-ready APIs, enforcing clean architecture, optimizing async patterns, or auditing FastAPI codebases.
wjs-cleaning-spam
Use when the user complains about spam on his X/Twitter posts — 同城面付 / 寻固炮 / 线下上门 / 免费破处 这类引流号在他推文下刷的 emoji 垃圾回复 — and wants them removed. Covers the last 7 days (X recent-search window). Triggers — "把这些spam删掉", "清理X垃圾回复", "推文下面好多引流号", "clean spam replies", "/wjs-cleaning-spam".
gws
Use the gws CLI for Google Calendar, Gmail, Drive, Sheets, Docs, Tasks, and cross-service Workspace workflows.
rest-patterns
Quick reference for RESTful API design patterns, HTTP semantics, caching, and rate limiting. Triggers on: rest api, http methods, status codes, api design, endpoint design, api versioning, rate limiting, caching headers.
component-patterns
Architecture patterns, code generation guides, and reference documentation for building Prismatic custom components.
sales-attio
Attio platform help — AI-native CRM with custom objects, relationship database, deal pipelines, email sequences, automations, and built-in enrichment for 80,000+ startups. Covers custom data model design (objects, attributes, relationships), pipeline configuration, workflow automations, email sequences, AI agents (Ask Attio), reporting, API integration (REST, OAuth 2.0, 100+ endpoints, webhooks, MCP server), and pricing tiers (Free/Plus/Pro/Enterprise). Use when Attio data model doesn't fit your workflow, deal pipeline stages need restructuring, automations aren't firing correctly, API or webhook integration isn't working, or not sure if Attio is the right CRM for your team. Do NOT use for general CRM data hygiene strategy (use /sales-data-hygiene), outbound sequences across platforms (use /sales-cadence), contact enrichment strategy (use /sales-enrich), or tool integration patterns (use /sales-integration).
adobe-firefly-api-batch-image-generator
Calls Adobe Firefly's text-to-image and generative fill APIs for batch asset creation. Manages Adobe IMS OAuth tokens and enforces Content Credentials (C2PA) metadata on all outputs.
api-design
Generates RESTful and GraphQL API designs with OpenAPI specs, proper resource naming, HTTP method usage, status codes, pagination, filtering, error responses, versioning strategies, and GraphQL schema patterns. Triggers on: "design API", "create API spec", "OpenAPI", "REST endpoint design", "GraphQL schema".
git-workflow
Helps with git workflows including conventional commit messages, branching strategies, merge conflict resolution, and changelog generation. Triggers on: "git commit message", "branching strategy", "resolve conflict", "generate changelog".
architecture-design
Guidelines for designing scalable and modular system architecture.
google-workspace
Gmail, Google Calendar, Drive, Sheets via Google APIs
google-contacts
Search, add, edit, and manage contacts in Google Contacts via the People API. Use for any task involving looking up contact details, adding new contacts to Google, updating phone numbers or emails, or browsing the contact list. Trigger when the user says "google contacts", "look up contact", "add to contacts", "add to google contacts", "find their number", "update their email", "search contacts for", or any reference to managing contacts in Google. This is a STANDALONE connector -- completely separate from the workspace CRM system. Do NOT trigger for CRM operations (use /crm for that). Do NOT trigger for Exchange/Outlook contacts.
api-gateway
API gateway for calling third-party APIs with managed auth. Use this skill when users want to interact with external services like Slack, HubSpot, Salesforce, Google Workspace, Stripe, and more.
add-discord
Add Discord bot channel integration to Deus.
alternative-payments-api-patterns
Use this skill when working with the Alternative Payments API - OAuth2 client-credentials authentication, REST structure, cursor pagination, rate limiting (5 req/sec), error handling, and the read + safe-write capability posture. Covers token minting, bearer auth, idempotency, and the deliberate exclusion of direct payment creation.
atlassian-mcp
Use when querying Jira issues, searching Confluence pages, creating tickets, updating documentation, or integrating Atlassian tools via MCP protocol.
fastapi-expert
Use when building high-performance async Python APIs with FastAPI and Pydantic V2. Invoke for async SQLAlchemy, JWT authentication, WebSockets, OpenAPI documentation.
java-architect
Use when building enterprise Java applications with Spring Boot 3.x, microservices, or reactive programming. Invoke for WebFlux, JPA optimization, Spring Security, cloud-native patterns.
cloud-identity-and-auth
Identity, authentication, authorization, and token management for cloud platforms. Covers Keystone-style scoped tokens, OAuth 2.0 flows, OpenID Connect, JWT structure and pitfalls, federation with SAML/OIDC, service-to-service auth with mTLS and SPIFFE, principle of least privilege, IAM role design, and the service catalog pattern (public/internal/admin endpoints). Use when designing authn/authz for a multi-tenant cloud service, integrating with an identity provider, or reviewing IAM policies for over-privilege.
backend-validation
Use this skill when validating a backend API or WebSocket endpoint end-to-end, including acquiring an OIDC bearer token for authenticated calls. Trigger whenever the user asks to test/validate/smoke-check a backend, write a Hurl test, hit a WebSocket, acquire an access token, exercise an OIDC flow, debug a 401, or verify an endpoint works with real auth. Applies to projects that use Hurl for HTTP tests, websocat for WebSocket probes, and oauth2c or curl-based flows for token acquisition (Authentik, Keycloak, Okta, Auth0, any RFC 6749 / OIDC Core provider). Prefer this skill over ad-hoc curl + bash when the user has more than one endpoint to check, chained auth flows, or anything resembling a regression test — because the Hurl + cached-refresh-token pattern is 10× less code and survives the next session.
aevatar-feasibility-advisor
Decide — honestly — whether a thing the user wants to build on Aevatar is possible, what its prerequisites are, or why it cannot be done, BEFORE anyone starts building. Use this first whenever a user describes a goal rather than a concrete artifact — "can aevatar do X", "I want a bot that…", "build me something that posts to Twitter / reads my GitHub / replies on Telegram", "is it possible to…", "automate … every day", "let Lark Base trigger a workflow". It teaches the one hard premise (every third-party capability is brokered by NyxID), the two distinct surfaces (outbound connector vs inbound channel), external HTTP trigger options such as Lark Base automation, how to check what is actually connectable, the prerequisite for each capability class, what is host-gated (and so not self-serve), and what is genuinely impossible without new NyxID/Aevatar platform work — so you can negotiate scope and give the user a straight answer plus next steps instead of over-promising. It scopes; it does not build (hand off to
aevatar-platform-map
Entry point, panorama, and router for the entire Aevatar skill family — load this FIRST whenever someone wants to build, run, publish, schedule, externally trigger, or operate anything on Aevatar ("create an agent team", "make a workflow / member", "publish or bind a service", "register it with NyxID", "set up a recurring / cron run", "invoke my service", "let Lark Base trigger my workflow"), wants to know whether something is even possible ("can Aevatar do X?", "能不能用 aevatar 实现"), or just wants to know what Aevatar can do. It teaches the object model (scope → team → member[workflow|script|gagent] → service → schedule/external trigger), how to authenticate as a NyxID-bearer REST client, how to resolve your scope, and the two caller modes (client REST vs in-session server-side tools). It does not do the work itself — it routes you to the right companion skill (feasibility-advisor, workflow-authoring, team-builder, service-publisher, scheduler, plus diagnostics probes and the safety-net fallback), held together
aevatar-scheduler
Create and manage cron schedules that fire an Aevatar service on a recurring basis, authenticated as the scope owner via NyxID — over the REST API. Use when a user wants to "schedule", "run on a cron", "set up a recurring run", "run every day/hour/Monday", "automate this service on a timer", "preview a cron", "pause/resume/disable a schedule", or "run it now" — or hits token_expired on a scheduled run's late steps. It builds the schedule against a published service (identity + endpoint + payload + serving revision), uses scope-owner NyxID auth (which requires the owner's NyxID broker binding), documents the fire-time credential's fixed 5-minute lifetime and how to design runs around it, and covers preview, enable/disable, run-now, update, and delete. Publish the service first with the service-publisher skill.
aevatar-service-publisher
Publish an Aevatar member, team, or workflow as an invocable service and (host permitting) register it with NyxID, then verify, invoke, or wire external HTTP triggers such as Lark Base automation — all over the REST API. Use when a user wants to "publish/bind a service", "expose my workflow/team as a service", "register it with NyxID", "make it callable", "get the service slug/URL", "invoke my service", "let Lark Base call my workflow", "trigger this workflow from an external webhook", or "version/deploy/roll out a service". It covers the simple scope binding, reading back a member's published service, the full account-level service lifecycle (revision → publish → deploy → rollout), how to confirm the NyxID registration (slug + status), how to invoke an endpoint, and how to distinguish direct NyxID proxy triggering from host-gated externalExposure. Build the team/member first with the team-builder skill.
aevatar-team-builder
Build an Aevatar agent team and its members over the REST API. Use when a user wants to "create a team", "add a member", "make a workflow member / script member / gagent member", "set the team's entry point", or "assemble agents into a team". It creates the team, creates members whose implementation is a workflow (most common), a script, or a hosted gagent, binds each member's concrete implementation (the workflow YAML is attached here), waits for the async binding to succeed, and sets the team entry member. Author the workflow YAML first with the workflow-authoring skill; publish the result as a service with the service-publisher skill.
aevatar-triage
Use AFTER something goes wrong while using Aevatar — a user hits an error, failure, or confusing behavior and you must find whether it lives in Aevatar, NyxID, or Ornn, then act. Triggers - "aevatar is erroring", "why did my workflow fail", "my scheduled run did not fire", "my bot does not reply", "connector 401/403", "skill won't pull/upload", "is this an aevatar, nyxid, or ornn bug", "file an issue", "am I using this right". It attributes the failure by tracing the request path, pulls that layer's real public source for a code-grounded root cause citing file and line, then branches - draft and, only on explicit user confirmation, file a precise GitHub issue when behavior violates the layer's published contract, or explain the correct usage from the code when it is a usage mistake. The after-it-breaks counterpart to aevatar-feasibility-advisor; never auto-files, de-dups first, never claims a root cause without a code citation. Works locally (git + gh) and server-side (nyxid_proxy + api-github).
aevatar-workflow-authoring
Author, validate, and persist an executable aevatar workflow from a natural-language request — use it when the user wants to create, build, set up, or automate a multi-step task as a runnable aevatar workflow (make a workflow that…, automate…, build a pipeline…, set up a recurring…). It generates workflow YAML, dispatch-validates it, then saves it as a reusable workflow that can be re-run and watched in the observatory. Not for running an existing workflow — search for that and start it instead.
fallback-to-calling-agent
Universal try-catch fallback for the aevatar model. Use whenever, after a genuine attempt, you cannot complete the user's request with available server-side capabilities — no matching skill/workflow/connector/tool, a terminal failure, or a task that inherently needs the caller's local environment (files, shell, local context). Instead of failing opaquely or fabricating, return the original request verbatim to the calling agent so it can finish with its own local tools. Generic by design — addresses "the calling agent" with no hardcoded client or skill names.
nyxid
Brokers credentials for downstream services so the agent never sees raw API keys or OAuth tokens. Use when the user explicitly mentions NyxID; asks to broker, store, proxy, connect, or manage credentials or a credential-backed service; manages NyxID credential nodes, SSH, MCP, or other NyxID resources; or must call a protected downstream API using an available NyxID-managed credential because no suitable authenticated native path is available. Do not use merely because a service is external, for public or unauthenticated APIs or webhooks, for standard Git operations, or for ordinary GitHub work when local `gh` is authenticated. A GitHub username supplied only to select an account is not a trigger. Operate exclusively through the `nyxid` CLI.
security-audit
Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing authentication and authorization patterns, identifying OWASP vulnerabilities (injection, XSS, CSRF), or addressing security concerns about implementations.
retro
프로젝트 회고 생성. 세션 노트 + git log 기반으로 지식을 공통/프로젝트별로 분류하여 아카이브. "회고", "retro", "/retro" 요청 시 사용.
swing-clarify
Prevents premature execution on ambiguous requests. Analyzes request clarity using 5W1H decomposition, surfaces hidden assumptions, and generates structured clarifying questions before work begins. Use at the start of any non-trivial task, or when a request could be interpreted multiple ways. Triggers on "뭘 원하는건지", "요구사항 정리", "clarify", "what exactly", "scope", "requirements", "정확히 뭘", "before we start".
whoop-copilot
Read real WHOOP recovery/strain/sleep/workout data via the official WHOOP developer API (OAuth 2.0) and reason about it directly — training advice, recovery trends, sleep debt, whether today is a good day to push hard. Can also act on that reasoning by writing to macOS Calendar/Reminders (adjust today's training, block recovery time, log a note) via AppleScript. Triggered when the user asks about their WHOOP data, recovery score, strain, sleep, wants training/schedule advice grounded in it, or wants today's calendar/reminders adjusted based on it (e.g. "我今天recovery怎么样", "该不该练", "帮我看看这周睡眠趋势", "根据我的恢复情况调整今天安排").
fastapi-senior-dev
Senior Python Backend Engineer skill for FastAPI. Use when scaffolding production-ready APIs, enforcing clean architecture, optimizing async patterns, or auditing FastAPI codebases.
token-formatter
Convert verbose docs/markdown/text into token-efficient formats. Use when user wants to reduce token count, compress content for LLM context, or optimize for AI consumption.
openloomi
Use local OpenLoomi from Codex. Triggers: Loomi, OpenLoomi, personal assistant, memory, workspace context, setup, install openloomi, setup openloomi, 一键装好并跑起来, finalize openloomi, fix openloomi, openloomi tour, guided tour, walk me through openloomi, show me everything, 一条龙, 体验一下, 带我看一下.
fastapi-scaffolder
Scaffolds FastAPI endpoints with OpenAPI documentation, Pydantic v2 request/response models, JWT authentication, rate limiting, and health checks. Python analog of minimal-api-scaffolder. Use when creating REST APIs, adding endpoints, setting up FastAPI projects, or configuring API infrastructure.
security
Application security best practices and patterns
api-client
Authenticated HTTP API client with retry logic, rate limiting, response parsing, and structured error handling. Supports OAuth2, API key, and bearer token auth.
oauth-integrator
OAuth and API authentication — OAuth 2.0 flows, PKCE, token lifecycle, JWT validation, and provider integration
auth-security
JWT, OAuth 2.0 / OIDC, session management, CSRF, password hashing, and MFA enforcement — Applies to: when generating login / signup / password-reset flows; when generating JWT issuance or verification; when generating OAuth 2.0 / OIDC client or server code; when wiring session cookies, CSRF tokens, MFA
saas-security
Detect tokens, misconfigurations, and admin red flags for major SaaS platforms (GWS, Atlassian, Notion, HubSpot, Salesforce, BambooHR, Workday, Odoo, chat platforms, Zoom, Calendly, NetSuite) — Applies to: when wiring a SaaS API key or OAuth token into code; when reviewing a SaaS connector / webhook / SCIM bridge; when triaging suspicious SaaS admin activity; when authoring infrastructure that proxies SaaS traffic; when answering a SaaS-related security question
fastapi-skills
FastAPI framework patterns, best practices, and implementation guides
spring-skills
Spring Boot framework patterns, best practices, and implementation guides
hubspot
HubSpot CRM administration assistant. Routes natural-language requests to specialist sub-agents for contacts, companies, deals, workflows, lists, pipelines, users, properties, associations, engagements, and analytics, with human-in-the-loop approval for every write. Supports OAuth 2.0 and Private App token authentication.
gmail-read
Search and read the user's Gmail: find messages, open one or a whole thread, and list or download attachments. Use when the user asks what is in their inbox, whether someone emailed them, to check or summarize mail, to find a message about a topic or from a person, to read a thread, or to save a file someone sent. Read-only: it never sends, labels, or deletes anything.
gmail-setup
Connect a Gmail account to this machine, and diagnose it when Gmail calls start failing. Use when the user wants to set up, connect, or authorize Gmail; when they add a second account; when they ask why email stopped working; or when any gmail command returns auth_required, auth_expired, scope_insufficient, client_invalid, or api_not_enabled. Covers the one-time Google Cloud project and OAuth client, the login flow, multiple accounts as profiles, and `gmail doctor`.
sota-identity-access
State-of-the-art identity and access management engineering (2026) for BUILDING/configuring identity infrastructure AND AUDITING it — federation, IdPs, authorization models, the joiner-mover-leaver lifecycle, privileged/break-glass access, workload identity, MFA/passkeys, and assurance levels; audits cover orphaned accounts, over-privileged roles, weak MFA, long-lived tokens, and SAML misconfig. Owns identity INFRASTRUCTURE and access-management DESIGN, not app-level login/session/JWT mechanics (sota-code-security owns those). Trigger keywords: IAM, IdP, OIDC, OAuth 2.1, PKCE, DPoP, PAR, RAR, JAR, FAPI, SAML, SCIM, provisioning, deprovisioning, RBAC, ABAC, ReBAC, Zanzibar, OpenFGA, SpiceDB, OPA, Cedar, Kanidm, Keycloak, Authentik, Zitadel, Entra, Okta, SSO, single logout, MFA, passkey, FIDO2, WebAuthn, step-up, conditional access, CAEP, PAM, break-glass, just-in-time, SPIFFE, access review, NIST 800-63, IAL, AAL, FAL, Active Directory, Kerberos, Kerberoasting, ADCS, RBCD, gMSA, dMSA, LAPS, krbtgt.
security-auth
Authentication and authorization patterns for secure access control. Use when: (1) Implementing JWT authentication, (2) OAuth2/OIDC integration, (3) Building RBAC/ABAC systems, (4) Session management, (5) MFA implementation. Auto-detects: auth, jwt, oauth, oidc, rbac, abac, permission, session, token, refresh, login, password, mfa, 2fa
fastapi-architect
Framework-specific delta on rest-api-architect — FastAPI 0.136 on Python 3.14. Feature layout, Pydantic v2 request/response separation, async DI with lifespan, URL-prefix versioning, RFC 7807 errors, in-house OAuth2+JWT or external IdP. Read rest-api-architect first for the cross-cutting REST conventions. Use when scaffolding or reviewing a FastAPI service.
mcp-architect
MCP (Model Context Protocol) 2025-11-25 server standards — tool/resource/prompt primitives, capability negotiation, Streamable HTTP transport with Mcp-Session-Id, OAuth 2.1 + RFC 8707 resource indicators, tool annotations (readOnly/destructive/idempotent), structured output, JSON-RPC error mapping, prompt-injection and SSRF defenses, MCP Inspector testing. Python (FastMCP) and Go (official SDK) recipes. Use when designing, reviewing, or scaffolding an MCP server.
backend-building
Backend building that grafts tRPC + Drizzle ORM + Hono onto an existing webapp-building frontend. Supports incremental features (db, auth). Use when the user needs a backend, API, database, server, authentication, or wants to add tRPC/Drizzle to their webapp-building project. Requires webapp-building first.
backend-building-swarm
Swarm-aware backend building that grafts tRPC + Drizzle ORM + Hono onto an existing webapp-building-swarm frontend. Grafts in place on a worktree of the shared repo (created via swarm-workspace) and commits on a backend branch the main agent merges. Supports incremental features (db, auth) and fullstack-template provisioning (--template). Use when the user needs a backend, API, database, server, or authentication in a swarm setup. Requires webapp-building-swarm first.
secure-auth
Implement authentication securely — authentication vs authorization, password hashing (argon2id/bcrypt), sessions vs JWT (storage, expiry, refresh, revocation), MFA, OAuth2/OIDC flows, and defenses against credential stuffing, session fixation, and CSRF. Worked examples + a runnable password-policy check.
x-api
Use when interacting with the X (Twitter) API programmatically - posting tweets, threads, media, reading timelines, or searching. Covers v2 endpoints, the v1.1 media upload endpoint, OAuth 1.0a vs Bearer token rules, reply/thread payload shapes, rate-limit headers, and error handling.
security-review
Re-analyze Hot Sheet's attack surface for security issues at release time, with proactive research using the latest advisories. Use before each release (or on demand) to audit every externally-reachable surface and file remediation tickets.
commit-messages
Generate clear, conventional commit messages from git diffs. Use when writing commit messages, reviewing staged changes, or preparing releases.
dianpo
点破一段技术机制背后不明显的心智模型——角色是谁、token/凭证/密钥/证书归谁所有、谁在向谁证明什么、为什么设计成这个形状。资深工程师一句话能点明的东西("这个 token 是 OpenAI 的"),这个 skill 负责替用户点明。Use this whenever the user pastes a config, endpoint, protocol description, PR/work note, or auth flow and wants to understand it — trigger on "帮我理解", "点破", "这是谁的 token/key", "谁验证谁", "为什么要这么设计", "为什么非要这样/绕一圈", "没看懂这个流程", "who owns this token", "whose cert/key is this", "who signs what", "who is verifying whom", "who trusts whom", "give me the mental model", "explain this mechanism/design", "why is it designed this way" — and also proactively whenever explaining any challenge/verification/handshake/webhook/signature/receipt/attestation/OAuth-like mechanism, or certificate/CA/mTLS/SSO/SAML trust chains, where credential ownership is easy to misread.
auth-flow-architect
Design authentication and authorization architectures - OAuth2/OIDC flow selection, JWT vs opaque tokens, refresh token rotation with reuse detection, session management and revocation, token storage rules per client type (SPA, mobile, server, M2M), the BFF pattern, RBAC/scopes/permissions modeling, and multi-tenant claims. Use when building or reviewing login/auth for an app, choosing between sessions and JWTs, integrating an identity provider (Auth0, Keycloak, Entra ID, Cognito), securing an SPA or mobile app, designing API-to-API auth, fixing token expiry/refresh bugs, or when the user asks how to do auth properly.
kuaishou
Publish video to the user's own 快手 (Kuaishou) account and read their works via the Kuaishou open platform. Use when the user mentions 快手, Kuaishou, 发快手, 发布到快手, 我的快手作品, or wants to post a generated video to their Kuaishou account.
hlzd-rfp-response
B2B 询盘 / 邮件响应自动化 —— 8 大邮箱配置矩阵（Gmail/网易/QQ/Outlook/企业微信/飞书/阿里云/自建）+ Gmail OAuth + IMAP/IMAPS + 凭证加密 + 飞书卡片配置向导。
appdirect
Every documented AppDirect marketplace operation in one binary, plus offline sync and billing-reconciliation joins. Trigger phrases: `reconcile appdirect billing`, `which appdirect payments failed this week`, `what changed in appdirect subscriptions`, `show my appdirect pipeline`, `appdirect company 360`, `use appdirect`, `run appdirect-cli`.
mcp-oauth-remote-gateway
Manual OAuth for remote MCP servers on headless gateways.
api-security-assessment
Use when assessing the security of an API — testing for BOLA/broken object-level authorization, broken authentication, excessive data exposure, rate limiting, and JWT flaws against the OWASP API Security Top 10 and OAuth 2.0/OIDC. Triggers on "API security assessment", "OWASP API Top 10", "BOLA", "JWT validation", "rate limiting".
backend-master-agent
Backend implementation playbook — API endpoints, database models/migrations, auth, query optimization, and the framework-specific traps that break servers in production. Use when implementing or reviewing server-side code: FastAPI / Django / Flask / Express / NestJS / Go / Axum handlers, SQLAlchemy / Prisma / Mongoose / Tortoise models, JWT / OAuth / session auth, bcrypt / argon2 password hashing, rate limiting, N+1 query fixes, async/event-loop bugs, or when a handoff spec asks for "the backend" of a feature.
auth-session-patterns
Build authentication and session handling correctly the first time — OAuth/OIDC flows, session-vs-token storage per platform (httpOnly cookies on web, secure keychain/MMKV on mobile), refresh-token rotation, CSRF, and RBAC basics. Use when adding sign-in, wiring an OAuth/OIDC provider, choosing where a session or token lives, implementing token refresh, or scoping role/permission checks. Triggers on auth, login, sign-in, OAuth, OIDC, session, token, refresh, CSRF, RBAC, permissions.
changelog-generator
从 Git 提交记录自动生成用户友好的 CHANGELOG，按 Conventional Commits 分类归组，支持版本号推断。由 documenter 在 /ship 流程中调用。
flowleap-auth
Authenticate the FlowLeap CLI — OAuth 2.0 device flow login (user code + verification URL), long-lived fl_pat_ personal API tokens for headless agents, status checks, and targeted logout. Trigger when a FlowLeap command fails with 401/unauthenticated, when setting up credentials for an agent or CI, or when the user asks to log in to FlowLeap or mint, list, or revoke API tokens.
spring-boot-microservices
Design, scaffold, and review modern Java Spring Boot microservices. Use this skill for ANY Spring Boot, Spring Cloud, or Java backend work — building or reviewing REST APIs in Java, Spring Data JPA / Hibernate (including N+1 and @Transactional issues), Spring Security (OAuth2, JWT), Spring Cloud Gateway, Resilience4j circuit breakers and timeouts, Kafka consumers and the transactional outbox, Micrometer / Actuator / OpenTelemetry observability, Testcontainers tests, caching with Redis, containerizing a Java service, Kubernetes probes, or zero-downtime deploys and database migrations. Trigger it whenever the user says things like "design a service", "scaffold a Spring Boot project", "add a gateway / config server / tracing / circuit breaker", "review my Spring Boot code", "is this service production-ready", "fix this N+1 or slow endpoint", "secure this API with JWT", "split this monolith", or "upgrade Spring Boot 2 to 3" — even when they never say the word "microservice". Targets the current GA generation (Spr
Showing top 100 of 167 skills using OAuth by quality score.
See all 167 skills via search →Integration detected automatically from skill content. Some results may be false positives.