Totp 2fa Skill

totp-2fa — an Agent Skill for TOTP two-factor authentication

An [Agent Skill](https://code.claude.com/docs/en/skills) for implementing **TOTP two-factor authentication** (RFC 6238) — the kind Google Authenticator, Aegis, 1Password and Authy generate — correctly and securely.

TOTP is small enough to implement in twenty lines and easy enough to get subtly wrong. Most defects are not in the algorithm: they are in **enrollment**, **storage** and **verification policy**. This skill covers all four, and says plainly which of its guidance is specification-backed and which is practice.

Install

npx skills add JoeBosi/totp-2fa-skill

Or clone into your agent's skills directory:

git clone https://github.com/JoeBosi/totp-2fa-skill \
  ~/.claude/skills/totp-2fa

Works with Claude Code and any agent that reads `SKILL.md` files.

What's inside

SKILL.md                              the skill: checklist, procedure, advice, verifications
references/
  algorithm.md                        Base32, HMAC, dynamic truncation, the time counter
  enrollment.md                       re-auth, pending state, one-time display, destruction
  verification.md                     window, replay, timing-safe compare, throttling
  storage-and-recovery.md             encryption at rest, key management, recovery codes
  pitfalls.md                         symptom -> cause, for debugging and for audits
  testing.md                          the RFC test vectors and how to use them
  libraries.md                        otplib, pyotp and others — with verified defaults
  sources.md                          what each source actually says, and what it doesn't
examples/
  node/totp.js, totp.test.js          reference implementation, 35 checks
  python/totp.py, test_totp.py        reference implementation, 30 checks

Verification

Both reference implementations pass **every official test vector** in RFC 4226 Appendix D and RFC 6238 Appendix B, and were **cross-ve