Run any Skill in Manus with one click

auth-semantics

Stars1

Forks1

UpdatedJuly 17, 2026 at 00:26

Preserve authentication, authorization, session, permission, access-control, and availability semantics. Use when changing login/session flows, permission checks, API auth errors, gated UI, role-based access, token refresh, logout behavior, unavailable states, or security-sensitive user access paths.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

robertmsale

robertmsale/skizzles

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

2 files

SKILL.md

readonly

name	auth-semantics
description	Preserve authentication, authorization, session, permission, access-control, and availability semantics. Use when changing login/session flows, permission checks, API auth errors, gated UI, role-based access, token refresh, logout behavior, unavailable states, or security-sensitive user access paths.

Auth Semantics

Use this skill when a change touches auth, sessions, permissions, or access control. The goal is to preserve precise security semantics while improving behavior.

Distinguish States

Keep these states separate:

unauthenticated: no valid identity/session is present
invalid session: identity was expected but token/session is expired, revoked, corrupt, or otherwise unusable
unauthorized: identity is valid but lacks permission for the action/resource
unavailable: the system cannot determine or serve the state because a dependency is unavailable
invalid request: the caller supplied malformed or unsupported input

Do not collapse these into one generic failure path unless the product contract explicitly requires that.

Security Rules

Do not broaden privileges to make a flow pass.
Do not force logout on mere permission denial unless that is the intended contract.
Do not treat dependency outages as authorization denials.
Do not reveal sensitive resource existence through error wording unless the product contract allows it.
Do not replace server-side enforcement with UI-only hiding.
Preserve audit/logging behavior where relevant.
Ensure retries or refreshes cannot loop forever or mask denied permissions.

UI/API Behavior

For UI, show the truthful state:

login needed
access denied
session expired
temporarily unavailable
invalid input

For APIs, preserve status/error semantics used by callers. If the change alters status codes, error variants, response shapes, redirects, or retry behavior, treat that as a compatibility surface and verify affected callers.

Verification

Inspect both enforcement and presentation:

server/middleware/guard checks
client gating and navigation
token refresh/session invalidation paths
error mapping
tests or fixtures for denied, expired, unauthenticated, and unavailable cases
logs/audit paths when applicable

Final claims should state which auth states were exercised or inspected and why privileges were not broadened.

More from this repository

same repository

fourth-wall

robertmsale/skizzles

Coordinate work through a bounded native Codex MultiAgentV2 task graph. Read before the first subagent spawn or orchestration action in a task. Use for complexity-aware model dispatch, behavioral roles, task messaging, worker-to-worker ownership delegation, dependency fan-out, review loops, goal checkpoints, warm handoffs, synchronization, and recovery. Do not use for routine single-agent work or communication across unrelated top-level Desktop tasks.

2026-07-241

install-skizzles

robertmsale/skizzles

Choose, install, diagnose, update, or uninstall Skizzles from its canonical repository. Use when a user wants plain Codex skills, the complete Skizzles plugin harness, source-linked hot reload, an isolated copied install, optional Container Lab compatibility checks, or help making a new task pick up an installed version.

2026-07-241

codex-container-lab

robertmsale/skizzles

Use Skizzles' bundled Container Lab launcher to create, run attached commands in, inspect, synchronize, and destroy disposable Docker Compose labs with isolated Git workspaces. Use when Docker/Compose isolation, reproducible experiments, or guarded file synchronization would help.

2026-07-211

package-skizzles

robertmsale/skizzles

Stage, inspect, and validate the Skizzles versioned plugin from its canonical source tree. Use when changing plugin inputs, checking generated-plugin drift, preparing a reviewable package checkpoint, or diagnosing packaging validation failures.

2026-07-171

release-skizzles

robertmsale/skizzles

Prepare a safe, versioned Skizzles release from canonical source. Use when an approved release version must be aligned across package metadata, rebuilt into the plugin, validated, and handed off for a separate tag, publication, or live cutover decision.

2026-07-171

cargo-build-optimize

robertmsale/skizzles

Profile and reduce Rust/Cargo build times through measured, behavior-preserving optimization campaigns. Use when a Rust workspace has slow cold builds, slow warm rebuilds, giant crates, duplicate dependencies, expensive macros/codegen, poor Cargo parallelism, or when asked to apply the fasterthanli.me Rust build profiling methodology, split crates for build speed, inspect cargo timings, or run a long-running /goal-driven build optimization effort.

2026-07-171

name	auth-semantics
description	Preserve authentication, authorization, session, permission, access-control, and availability semantics. Use when changing login/session flows, permission checks, API auth errors, gated UI, role-based access, token refresh, logout behavior, unavailable states, or security-sensitive user access paths.

Auth Semantics

Use this skill when a change touches auth, sessions, permissions, or access control. The goal is to preserve precise security semantics while improving behavior.

Distinguish States

Keep these states separate:

unauthenticated: no valid identity/session is present
invalid session: identity was expected but token/session is expired, revoked, corrupt, or otherwise unusable
unauthorized: identity is valid but lacks permission for the action/resource
unavailable: the system cannot determine or serve the state because a dependency is unavailable
invalid request: the caller supplied malformed or unsupported input

Do not collapse these into one generic failure path unless the product contract explicitly requires that.

Security Rules

Do not broaden privileges to make a flow pass.
Do not force logout on mere permission denial unless that is the intended contract.
Do not treat dependency outages as authorization denials.
Do not reveal sensitive resource existence through error wording unless the product contract allows it.
Do not replace server-side enforcement with UI-only hiding.
Preserve audit/logging behavior where relevant.
Ensure retries or refreshes cannot loop forever or mask denied permissions.

UI/API Behavior

For UI, show the truthful state:

login needed
access denied
session expired
temporarily unavailable
invalid input

Verification

Inspect both enforcement and presentation:

server/middleware/guard checks
client gating and navigation
token refresh/session invalidation paths
error mapping
tests or fixtures for denied, expired, unauthenticated, and unavailable cases
logs/audit paths when applicable

Final claims should state which auth states were exercised or inspected and why privileges were not broadened.