Stats
Actions
Tags
Help us improve
Share bugs, ideas, or general feedback.
From claudecode-research-harness-workflow
Helps implement authentication and payment features using Clerk, Supabase Auth, or Stripe. Provides security checklists for credential handling, session management, and payment verification.
npx claudepluginhub maxwell2732/claudecode-research-harness-workflow --plugin claudecode-research-harness-workflowHow this skill is triggered — by the user, by Claude, or both
Slash command
/claudecode-research-harness-workflow:authThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
A set of skills responsible for implementing authentication and payment features.
Guides technical evaluation of code review feedback: read fully, restate for understanding, verify against codebase, respond with reasoning or pushback before implementing.
Share bugs, ideas, or general feedback.
A set of skills responsible for implementing authentication and payment features.
| Feature | Details |
|---|---|
| Authentication | See references/authentication.md |
| Payments | See references/payments.md |
Since authentication and payment features always carry high security risk, always display the following before starting work:
🔐 Security Checklist
This work is security-critical. Please confirm the following:
### Authentication
- [ ] Passwords are hashed (bcrypt/argon2)
- [ ] Session management is secure (HTTPOnly Cookie)
- [ ] CSRF protection is implemented
- [ ] Rate limiting (brute-force protection)
### Payments
- [ ] Sensitive data (card numbers, etc.) is not stored on the server
- [ ] Stripe/payment provider SDK is used correctly
- [ ] Webhook signature verification
- [ ] Amount tampering prevention (amount finalized server-side)
### Common
- [ ] Error messages are not overly detailed (prevent information leakage)
- [ ] Sensitive information is not written to logs
⚠️ Caution Level: 🔴 High
This feature carries the following risks:
- Credential exposure
- Unauthorized access
- Fraudulent payment manipulation
Expert review is recommended.
🔐 Building login and payment features safely
1. **"Hash" passwords**
- Store passwords in a form that cannot be reversed
- Safe even if data is leaked
2. **Do not store card information on your server**
- Delegate to a dedicated service like Stripe
- Never store anything on your own server
3. **Keep error messages vague**
- Use "Authentication failed" instead of "Password is incorrect"
- Don't give hints to malicious actors