Secure Auth Patterns

Implement secure authentication and authorization using JWT, OAuth2, session management, RBAC, permissions, and resource ownership verification.

This playbook appears to be legitimate guidance on implementing auth/authz, but be aware of two things before you use it: (1) the examples assume many secrets and external endpoints (JWT_SECRET, JWT_REFRESH_SECRET, SESSION_SECRET, REDIS_URL, GOOGLE_CLIENT_ID/SECRET, FRONTEND_URL, etc.) even though the skill metadata lists none — you should not paste real secrets into the agent or public prompts and you should plan how to supply these values securely (environment-only, secret manager, etc.); (2) some shown patterns can leak tokens (redirecting access tokens in a URL query string is risky). If you plan to adopt the examples, review and adapt them to your platform's secure secret storage, avoid placing tokens in URLs (prefer HttpOnly secure cookies or one-time server-side exchanges), and validate the code in a controlled dev environment before deploying.

Type: OpenClaw Skill Name: secure-auth-patterns Version: 1.0.0 The skill bundle provides comprehensive documentation and code examples for implementing secure authentication and authorization patterns (JWT, OAuth2, session management, RBAC, password security). All content, including markdown instructions and code snippets, is educational and focuses on security best practices. There is no evidence of prompt injection attempts against the AI agent, data exfiltration, malicious execution, persistence mechanisms, or any other indicators of intentional harmful behavior. The use of environment variables and database interactions in code examples is standard for the stated purpose of building secure applications, not for compromising the agent or its environment.