auth-permission-baseline
Checklist-driven security baseline for managing roles, permissions, and sensitive interface access.
Install
mkdir -p .claude/skills/auth-permission-baseline && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/11384" && unzip -o skill.zip -d .claude/skills/auth-permission-baseline && rm skill.zipInstalls to .claude/skills/auth-permission-baseline
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
建立鉴权与授权基线，防止未授权访问与越权。用于新增账号体系、角色权限、敏感接口上线检查。关键词: authentication, authorization, RBAC, 输入校验, 审计日志.Key capabilities
- →Define identity authentication and token lifecycle.
- →Define the tripartite relationship of roles, resources, and operations.
- →Implement permission assertions before business logic for each interface.
- →Perform input whitelist validation and sensitive log desensitization.
- →Cover tests for unauthenticated access, unauthorized access, and normal access.
How it works
This skill establishes an authentication and authorization baseline by defining identity authentication, token lifecycles, and role-resource-operation relationships. It ensures that permission assertions are in place before business logic and that input validation and log desensitization are performed.
Inputs & outputs
When to use auth-permission-baseline
- →Auditing new authentication systems
- →Checking interface security
- →Validating RBAC implementations
About this skill
Auth Permission Baseline
When to Use This Skill
- 新增登录态或令牌机制
- 新增角色权限与资源访问控制
- 敏感操作接口上线前检查
Prerequisites
- 已定义角色、资源、操作的基本模型
- 已明确鉴权组件与日志策略
Step-by-Step Workflows
- 定义身份认证和 token 生命周期。
- 定义角色、资源、操作三元关系。
- 每个接口先写权限断言再写业务逻辑。
- 执行输入白名单校验和敏感日志脱敏。
- 覆盖未登录、越权、正常访问三类测试。
References
When not to use it
- →When there is no new login state or token mechanism.
- →When there are no new role permissions or resource access controls.
- →When sensitive operation interfaces are not going online.
Prerequisites
Limitations
- →Requires a defined basic model for roles, resources, and operations.
- →Requires clear authentication components and logging strategies.
How it compares
This workflow systematically integrates security checks into the development process, unlike a manual approach that might overlook critical authorization steps.
Compared to similar skills
auth-permission-baseline side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| auth-permission-baseline (this skill) | 0 | 1mo | No flags | Intermediate |
| 1password | 27 | 2mo | Review | Intermediate |
| security-compliance | 19 | 7mo | Review | Advanced |
| information-security-manager-iso27001 | 11 | 7mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
security-compliance
davila7
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
information-security-manager-iso27001
davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
cursor-sso-integration
jeremylongshore
Configure SSO and enterprise authentication in Cursor. Triggers on "cursor sso", "cursor saml", "cursor oauth", "enterprise cursor auth", "cursor okta". Use when working with cursor sso integration functionality. Trigger with phrases like "cursor sso integration", "cursor integration", "cursor".
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.