iOSใขใใชใฎใณใผใ็ฝฒๅใปใใญใใธใงใใณใฐๆฏๆดใ่จผๆๆธ็ฎก็ใProvisioning Profile็ฎก็ใKeychain่จญๅฎใCI/CD็ฐๅขใงใฎ็ฝฒๅ่จญๅฎใชใฉใใณใผใ็ฝฒๅใซ้ขใใๅ ๆฌ็ใชใตใใผใใๆไพใใใใ็ฝฒๅใจใฉใผใ่งฃๆฑบใใใใใ่จผๆๆธใๆดๆฐใใใใใCIใง็ฝฒๅใ่จญๅฎใใใใใจ่จใฃใๆใซไฝฟ็จใใใ
OAuth 2.1 Token Endpoint implementation guide. Use when implementing token endpoint requirements beyond OpenID Connect, including grant types, token response format, Cache-Control headers, CORS support, and error handling. Covers OAuth 2.1 Section 3.2 and Section 4 requirements.
Security pattern for implementing access control and authorization. Use when designing permission systems, implementing RBAC/ABAC, preventing unauthorized access, addressing privilege escalation, or ensuring users can only perform allowed actions on permitted resources. Addresses "Entity performs disallowed action" problem.
Validate workflows and node requests against Genfeed OSS core scope. Ensures only OSS-included nodes are used and flags Cloud-only features. Use before implementing workflows or when users request new nodes.
SSO integration guidance for fort-nix services. Use when adding authentication to a service, choosing an SSO mode, configuring oauth2-proxy, or troubleshooting auth issues. Triggers on fort.cluster.services sso config, oauth2-proxy setup, OIDC integration, or auth header injection.
Authenticate to web app and verify session state with Chrome DevTools session sharing
Security pattern for delegating cryptographic operations and key management to an external service. Use when designing systems that should not possess cryptographic keys directly. Implementation of Cryptographic Key Management pattern. Examples include Android Keystore, iOS KeyChain, AWS KMS, Azure Key Vault, Google Cloud KMS. Reduces risk of key leakage and cipher misconfiguration.
validation audit quality check startup initialization integrity
CROSS-CUTTING: Security patterns and best practices for ALL PACT phases. Provides OWASP Top 10 guidance, authentication/authorization patterns, input validation, secure coding practices, secrets management, and security testing checklists. Use when: implementing authentication, handling user input, storing secrets, designing authorization, reviewing code for vulnerabilities, planning security tests.
Automatically refresh AWS SSO authentication tokens when encountering expiration errors. Use when AWS MCP tools fail due to expired SSO sessions.
Debug CSRF token issues and authentication problems including 403 Forbidden errors, cookie issues, JWT tokens, OAuth flows, and session management. Use when troubleshooting CSRF verification failed, 403 errors on POST requests, login not working, or token refresh issues.
Design and implement secure admin APIs in Next.js 16 with hardened security, RBAC, CSRF protection, tenant isolation, and audit logging. Use when creating new admin API routes, implementing security controls, or ensuring API compliance with corporate security standards.
Create security zones and assign rights to profiles. Use when registering controllers.
Use this skill when working with the 1Password CLI (`op` command) for secrets management, retrieving API keys, injecting secrets into development environments, or any task involving 1Password vault operations. Triggers on: "1password", "op command", "secrets management", "api keys from vault", "op run", "op read", "service account token".
Generate JWTs for GitHub App authentication. Direct JWT generation for app-level operations, installation discovery, and bootstrapping workflows.
Security pattern for input validation and sanitization. Use when implementing input handling, preventing injection attacks (SQL, XSS, command), ensuring data integrity, or processing data from untrusted sources. Addresses "Entity provides unexpected data" problem.
Manage incoming internet traffic and reverse proxy configuration on the home network gateway. Configure Caddy, OAuth2 authentication, fail2ban security, and traffic routing.
security-auditor skill Trigger terms: security audit, vulnerability scan, OWASP, security analysis, penetration testing, security review, threat modeling, security best practices, CVE Use when: User requests involve security auditor tasks.
Design threat mitigation, input validation, and secure execution. Use when: sdd-design assigns Security Considerations section. Triggers: "security design", "threat model", "input validation", "xss prevention"
Audit cryptographic implementations for weak algorithms, insecure defaults, predictable randomness, key management issues, and timing attacks. Use when reviewing security-critical crypto code.
Implement rate limiting for API endpoints. Use when user mentions "rate limit", "quota", "usage tracking", "throttle", or "limit requests".
