Two Factor Authentication Best Practices

This skill provides guidance and enforcement rules for implementing secure two-factor authentication (2FA) using Better Auth's twoFactor plugin.

This skill is an instructional guide and appears internally consistent, but exercise normal caution before using any third-party auth guidance: 1) Verify the authenticity and security record of the better-auth package and its CLI (review its repository, npm package, and maintainers) before installing into production. 2) Ensure you implement secure sendEmail/sendOTP delivery and protect any mailer credentials separately. 3) Run database migrations in a safe way (backup data first) and review what fields/tables are added. 4) Store OTPs/backup codes using encrypted or hashed storage as recommended; display backup codes only once and advise users to save them. 5) Avoid skipVerificationOnEnable in production unless you understand the recovery/attack tradeoffs. 6) Confirm rate limits, allowedAttempts, and trust-device settings align with your threat model. The skill itself makes no surprising requests, but you should audit the actual dependencies and your implementation before deployment.

Type: OpenClaw Skill Name: twofactor Version: 0.1.0 The skill bundle provides documentation and code examples for implementing two-factor authentication using the 'better-auth' library. The `SKILL.md` file contains no prompt injection attempts against the AI agent, nor does it include any malicious code snippets, data exfiltration, persistence mechanisms, or other harmful behaviors. The content is purely instructional, focuses on security best practices, and appears to be a legitimate guide for developers.