认证鉴权
认证与授权
better-auth
ovachiever
Build authentication systems for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, and RBAC. Self-hosted alternative to Clerk/Auth.js. IMPORTANT: Requires Drizzle ORM or Kysely for D1 - no direct D1 adapter. v1.4.0 (Nov 2025) adds stateless sessions, ESM-only (breaking), JWT key rotation, SCIM provisioning. v1.3 adds SSO/SAML, multi-team support. Use when: self-hosting auth on Cloudflare D1, migrating from Clerk, implementing multi-tenant SaaS, or troubleshooting D1 adapter errors, session serialization, OAuth flows, TanStack Start cookie issues, nanostore session invalidation.
auth-implementation-patterns
ovachiever
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
strategy-session
breethomas
Your product soundboard. Work through product decisions conversationally - Claude gathers context, challenges assumptions, captures decisions, and creates Linear issues.
dhh-rails-reviewer
ratacat
"Use this agent when you need a brutally honest Rails code review from the perspective of David Heinemeier Hansson. This agent excels at identifying anti-patterns, JavaScript framework contamination in Rails codebases, and violations of Rails conventions. Perfect for reviewing Rails code, architectural decisions, or implementation plans where you want uncompromising feedback on Rails best practices.\n\n<example>\nContext: The user wants to review a recently implemented Rails feature for adherence to Rails conventions.\nuser: \"I just implemented a new user authentication system using JWT tokens and a separate API layer\"\nassistant: \"I'll use the DHH Rails reviewer agent to evaluate this implementation\"\n<commentary>\nSince the user has implemented authentication with patterns that might be influenced by JavaScript frameworks (JWT, separate API layer), the dhh-rails-reviewer agent should analyze this critically.\n</commentary>\n</example>\n\n<example>\nContext: The user is planning a new Rails feature and wan..."
onboarding-specialist
ncklrs
Expert customer onboarding guidance for accelerating time-to-value and ensuring successful implementations. Use when designing onboarding programs, creating kickoff frameworks, building implementation plans, or optimizing customer activation. Use for training delivery, go-live readiness, sales-to-CS handoffs, early warning detection, and tech-touch automation.
senior-product-marketer
ncklrs
Expert product marketing guidance for SaaS growth - trial acquisition, user activation to first value, and freemium-to-paid conversion. Use when writing landing pages, onboarding flows, email sequences, pricing pages, upgrade prompts, or any growth/conversion copy.
ship-score
mjwhansen
Conduct a SHIP interview to score and prioritize a product feature or bug. Use when the user runs /ship-score, asks to "score a feature", "prioritize the backlog", or wants to interview and score product features using the SHIP framework (Strategic Heft + Income - Perspiration).
whatsapp-web-js
goncy
Provides expert guidance on WhatsApp Web JS, including how to use the WhatsApp Web JS API to send and receive messages, create groups, and more. Use when working with WhatsApp Web JS, WhatsApp Web JS API, or WhatsApp Web JS SDK.
owasp-security-review
jgamaraalv
"Review code and architectures against the OWASP Top 10:2025 — the ten most critical web application security risks. Use when: (1) reviewing code for security vulnerabilities, (2) auditing a feature or codebase against OWASP categories, (3) providing remediation guidance for identified vulnerabilities, (4) writing new code and needing secure coding patterns. Triggers: 'review for security', 'OWASP audit', 'check for vulnerabilities','security checklist', 'is this code secure', 'security review', 'fix vulnerability'."
commit
jpoutrin
Guided git commit with atomic commit analysis and conventional commit format
bl-undo
jpoutrin
Undo git-branchless operations - recover from mistakes interactively
security-engineering
mujez
Application security and infrastructure security expert. Use when reviewing code for vulnerabilities, implementing authentication/authorization, securing APIs, hardening infrastructure, threat modeling, implementing encryption, or conducting security audits. Covers OWASP Top 10, secure coding, DevSecOps, and compliance.
pocketbase-best-practices
greendesertsnow
PocketBase development best practices covering collection design, API rules, authentication, SDK usage, query optimization, realtime subscriptions, file handling, and deployment. Use when building PocketBase backends, designing schemas, implementing access control, setting up auth flows, or optimizing performance.
page-cro
almeidamarcell
When the user wants to optimize, improve, or increase conversions on any marketing page — including homepage, landing pages, pricing pages, feature pages, or blog posts. Also use when the user says "CRO," "conversion rate optimization," "this page isn't converting," "improve conversions," or "why isn't this page working." For signup/registration flows, see signup-flow-cro. For post-signup activation, see onboarding-cro. For forms outside of signup, see form-cro. For popups/modals, see popup-cro.
onboarding-cro
almeidamarcell
When the user wants to optimize post-signup onboarding, user activation, first-run experience, or time-to-value. Also use when the user mentions "onboarding flow," "activation rate," "user activation," "first-run experience," "empty states," "onboarding checklist," "aha moment," or "new user experience." For signup/registration optimization, see signup-flow-cro. For ongoing email sequences, see email-sequence.
pubnub-security
pubnub
Secure PubNub applications with Access Manager, encryption, and TLS
morph-skill
morph-l2
AI Agent skill for Morph L2 — wallet, explorer, DEX swap, cross-chain bridge with order management, EIP-8004 agent identity & reputation, and alt-fee gas payment
analytics-tracking
almeidamarcell
When the user wants to set up, improve, or audit analytics tracking and measurement. Also use when the user mentions "set up tracking," "GA4," "Google Analytics," "conversion tracking," "event tracking," "UTM parameters," "tag manager," "GTM," "analytics implementation," or "tracking plan." For A/B test measurement, see ab-test-setup.
entire
almeidamarcell
Capture AI agent sessions in your git workflow. Use for setup, rewinding to checkpoints, exploring session history, and troubleshooting.
Gin
clawvpsai
Production-grade Gin (Go) web framework development — build robust APIs and web apps without common pitfalls.
appsec-expert
martinholovsky
"Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments."
api-expert
martinholovsky
"Expert API architect specializing in RESTful API design, GraphQL, gRPC, and API security. Deep expertise in OpenAPI 3.1, authentication patterns (OAuth2, JWT), rate limiting, pagination, and OWASP API Security Top 10. Use when designing scalable APIs, implementing API gateways, or securing API endpoints."
fastapi-expert
martinholovsky
"Expert FastAPI developer specializing in production-ready async REST APIs with Pydantic v2, SQLAlchemy 2.0, OAuth2/JWT authentication, and comprehensive security. Deep expertise in dependency injection, background tasks, async database operations, input validation, and OWASP security best practices. Use when building high-performance Python web APIs, implementing authentication systems, or securing API endpoints."
fastapi
martinholovsky
REST API and WebSocket development with FastAPI emphasizing security, performance, and async patterns