[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M730P0PVJ6YA3DA1PR9RJM0B":3,"skill-same:01M730P0PVJ6YA3DA1PR9RJM0B":47},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":23,"commitSha":24,"skillDirectory":25,"forksCount":26,"repositoryHtmlUrl":27,"repositoryHomepageUrl":28,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M730P0PVJ6YA3DA1PR9RJM0B","auth-strategy-patterns",null,"Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fauth-strategy-patterns\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: auth-strategy-patterns\ndescription: Pluggable authentication strategy architecture. Passport.js strategy pattern, bearer token strategy, local strategy, strategy switching between token\u002Fkey\u002Fsignature auth, and session-less agent auth. Sources: jaredhanson\u002Fpassport.\norigin: yana-ai — synthesized from jaredhanson\u002Fpassport (MIT)\nlicense: Apache-2.0\nversion: 1.0.0\ncompatibility: yana-ai >= 1.3.49\n---\n\n# \u002Fauth-strategy-patterns\n\n## When to Use\n\n- Agent HTTP server needs interchangeable auth strategies (bearer, API key, mTLS)\n- Building middleware that dispatches to different auth mechanisms per endpoint\n- Abstracting auth so the same agent code works in dev (simple) and prod (PKI)\n- Multi-strategy: try Bearer first, fallback to API key\n\n## Do NOT use for\n\n- CLI-only agents with no HTTP server (use direct JWT verify)\n- Stateful session-based auth (agents are stateless — use JWT, not sessions)\n\n---\n\n## Bearer token strategy (Express)\n\n```javascript\nimport passport        from 'passport'\nimport { Strategy as BearerStrategy } from 'passport-http-bearer'\nimport { verifyToken } from '.\u002Fjwt-verification.js'\n\npassport.use('bearer', new BearerStrategy(async (token, done) => {\n  try {\n    const payload = verifyToken(token)\n    done(null, payload, { scope: payload.scopes })\n  } catch (err: any) {\n    done(null, false, { message: err.message })\n  }\n}))\n\n\u002F\u002F Protect endpoint\napp.post('\u002Fapi\u002Ftool-call',\n  passport.authenticate('bearer', { session: false }),\n  (req, res) => {\n    const agent = req.user as { sub: string; scopes: string[] }\n    if (!agent.scopes.includes('tool:exec')) {\n      return res.status(403).json({ error: 'insufficient scope' })\n    }\n    \u002F\u002F handle tool call\n  }\n)\n```\n\n---\n\n## API key strategy\n\n```javascript\nimport { Strategy as HeaderAPIKeyStrategy } from 'passport-headerapikey'\n\npassport.use('api-key', new HeaderAPIKeyStrategy(\n  { header: 'X-Yamtam-Key', prefix: '' },\n  false,\n  async (apiKey, done) => {\n    const agent = await lookupAgentByKey(apiKey)\n    if (!agent) return done(null, false)\n    done(null, agent)\n  }\n))\n```\n\n---\n\n## Strategy router (try Bearer, fallback API key)\n\n```javascript\nimport { RequestHandler } from 'express'\n\nexport function multiAuth(...strategies: string[]): RequestHandler {\n  return (req, res, next) => {\n    const tryStrategy = (i: number) => {\n      if (i >= strategies.length) {\n        return res.status(401).json({ error: 'authentication required' })\n      }\n      passport.authenticate(strategies[i], { session: false }, (err, user) => {\n        if (err)   return next(err)\n        if (!user) return tryStrategy(i + 1)\n        req.user = user\n        next()\n      })(req, res, next)\n    }\n    tryStrategy(0)\n  }\n}\n\napp.use('\u002Fapi\u002F', multiAuth('bearer', 'api-key'))\n```\n\n---\n\n## Session-less agent auth (no serialize\u002Fdeserialize)\n\n```javascript\n\u002F\u002F Explicitly opt out of sessions for stateless agents\npassport.serializeUser((user, done) => done(null, user))\npassport.deserializeUser((user, done) => done(null, user as Express.User))\n\u002F\u002F Or simply pass { session: false } to every authenticate() call\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ session: true (default) without session middleware → crashes on serialization\n❌ No scope check after authentication → authenticated agent can call any endpoint\n❌ Fallback strategy more permissive than primary → attacker bypasses bearer with weak key\n❌ done(err) vs done(null, false) — error triggers 500, false triggers 401\n❌ Bearer token from Authorization header not trimmed → 'Bearer TOKEN' not 'TOKEN'\n❌ Passport.initialize() middleware not added → req.user undefined silently\n```\n","# \u002Fauth-strategy-patterns\n\n## When to Use\n\n- Agent HTTP server needs interchangeable auth strategies (bearer, API key, mTLS)\n- Building middleware that dispatches to different auth mechanisms per endpoint\n- Abstracting auth so the same agent code works in dev (simple) and prod (PKI)\n- Multi-strategy: try Bearer first, fallback to API key\n\n## Do NOT use for\n\n- CLI-only agents with no HTTP server (use direct JWT verify)\n- Stateful session-based auth (agents are stateless — use JWT, not sessions)\n\n---\n\n## Bearer token strategy (Express)\n\n```javascript\nimport passport        from 'passport'\nimport { Strategy as BearerStrategy } from 'passport-http-bearer'\nimport { verifyToken } from '.\u002Fjwt-verification.js'\n\npassport.use('bearer', new BearerStrategy(async (token, done) => {\n  try {\n    const payload = verifyToken(token)\n    done(null, payload, { scope: payload.scopes })\n  } catch (err: any) {\n    done(null, false, { message: err.message })\n  }\n}))\n\n\u002F\u002F Protect endpoint\napp.post('\u002Fapi\u002Ftool-call',\n  passport.authenticate('bearer', { session: false }),\n  (req, res) => {\n    const agent = req.user as { sub: string; scopes: string[] }\n    if (!agent.scopes.includes('tool:exec')) {\n      return res.status(403).json({ error: 'insufficient scope' })\n    }\n    \u002F\u002F handle tool call\n  }\n)\n```\n\n---\n\n## API key strategy\n\n```javascript\nimport { Strategy as HeaderAPIKeyStrategy } from 'passport-headerapikey'\n\npassport.use('api-key', new HeaderAPIKeyStrategy(\n  { header: 'X-Yamtam-Key', prefix: '' },\n  false,\n  async (apiKey, done) => {\n    const agent = await lookupAgentByKey(apiKey)\n    if (!agent) return done(null, false)\n    done(null, agent)\n  }\n))\n```\n\n---\n\n## Strategy router (try Bearer, fallback API key)\n\n```javascript\nimport { RequestHandler } from 'express'\n\nexport function multiAuth(...strategies: string[]): RequestHandler {\n  return (req, res, next) => {\n    const tryStrategy = (i: number) => {\n      if (i >= strategies.length) {\n        return res.status(401).json({ error: 'authentication required' })\n      }\n      passport.authenticate(strategies[i], { session: false }, (err, user) => {\n        if (err)   return next(err)\n        if (!user) return tryStrategy(i + 1)\n        req.user = user\n        next()\n      })(req, res, next)\n    }\n    tryStrategy(0)\n  }\n}\n\napp.use('\u002Fapi\u002F', multiAuth('bearer', 'api-key'))\n```\n\n---\n\n## Session-less agent auth (no serialize\u002Fdeserialize)\n\n```javascript\n\u002F\u002F Explicitly opt out of sessions for stateless agents\npassport.serializeUser((user, done) => done(null, user))\npassport.deserializeUser((user, done) => done(null, user as Express.User))\n\u002F\u002F Or simply pass { session: false } to every authenticate() call\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ session: true (default) without session middleware → crashes on serialization\n❌ No scope check after authentication → authenticated agent can call any endpoint\n❌ Fallback strategy more permissive than primary → attacker bypasses bearer with weak key\n❌ done(err) vs done(null, false) — error triggers 500, false triggers 401\n❌ Bearer token from Authorization header not trimmed → 'Bearer TOKEN' not 'TOKEN'\n❌ Passport.initialize() middleware not added → req.user undefined silently\n```\n",{},"main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa",".claude\u002Fskills\u002Fauth-strategy-patterns",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-14 13:24:09",{"source":7,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill auth-strategy-patterns",{"tool":39,"command":40},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill auth-strategy-patterns",{"tool":42,"command":43},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill auth-strategy-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fauth-strategy-patterns\u002FSKILL.md",true,[],[48,56,63,71,79,87],{"skillNo":49,"name":50,"nameZh":6,"description":51,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":52,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":18},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":18},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":67,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":18},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":75,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":18},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":83,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":18},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":18},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]