kensaurus

Auth Flows — Security skill for Claude Code

Security community

Read-only audit of app-layer auth — route×gate matrix, getSession vs getUser, middleware-as-only-gate.

How to install Auth Flows

Installs to ~/.claude/skills/kensaurus-cursor-kenji-auth-flows/SKILL.md

Terminal
mkdir -p ~/.claude/skills/kensaurus-cursor-kenji-auth-flows && curl -fsSL https://raw.githubusercontent.com/kensaurus/cursor-kenji/HEAD/commands/auth-flows.md -o ~/.claude/skills/kensaurus-cursor-kenji-auth-flows/SKILL.md

Restart Claude Code, or start a new session, for it to be picked up.

What Auth Flows does

description: "Read-only audit of app-layer auth — route×gate matrix, getSession vs getUser, middleware-as-only-gate" argument-hint: "[app or auth path]"

Auth-Flows Audit

Run the **`audit-auth-flows`** skill: map every protected route to the gate that actually covers it, grep server-side `getSession()` used as authorization, and treat middleware-as-the-only-gate as a finding even after CVE-2025-29927 is patched.

**Read-only — do not patch.** Data-layer RLS stays on `plan-rls-audit`.

Alternatives in Security

  • OpenTag — Open-source, channel-native agent gateway for Slack 499 ★
  • Node9 Proxy — The Execution Security Layer for the Agentic Era 209 ★
  • Security Audit Stride — Chạy checklist bảo mật OWASP Top 10 + STRIDE trước bước review cuối của Tech Lead trong WF-REVIEW-CRIT (luôn c 90 ★

Full documentation available on GitHub

View Source Repository

Related Skills

Auth Audit — Security skill for Claude Code

Auth Audit

Full auth & session audit: login flow, session/cookie security, JWT handling, middleware safety, privilege esc

Security community
Module Audit — Security skill for Claude Code

Module Audit

Pre-ship module audit pipeline (rev 4). 7-stage matrix audit covering form components × 4 lenses + 10 cross-cu

Security community
Auth Security UX Specialist — Security skill for Claude Code

Auth Security UX Specialist

Use when a login or security flow feels either unsafe or full of friction. Signup, password reset, 2FA and pas

Security community
Pfm — Security skill for Claude Code

Pfm

MANDATORY — route every change to CLAUDE.md, .claude/, the .codex/ mirror or templates/ here. /pfm {change req

Security community
Security Audit — Security skill for Claude Code

Security Audit

Audit de securite complet d'une web app (OWASP Top 10, CWE/CVE, headers, auth, paywall, infra). Genere un rapp

Security community
Security Audit Database — Security skill for Claude Code

Security Audit Database

Use when auditing a database-backed app for the most common database security mistakes — multi-tenant data lea

Security community

Related Agents

Nextjs Builder — Data & AI agent for Claude Code

Nextjs Builder

Next.js App Router network-boundary implementer — Server Component data fetching, Server Actions, route handle

Data & AI community
Canvas To Code Auditor — Security agent for Claude Code

Canvas To Code Auditor

Read-only codebase audit for the target surface declared in Gate 0. Returns route status, components/hooks/lib

Security community
Frontend Regression Reviewer — Design agent for Claude Code

Frontend Regression Reviewer

Focused reviewer for frontend route, client-state, and UX regressions in this repository. Use when work touche

Design community