This skill should be used when the user is building or reviewing login flows, magic links, SSO (SAML/OIDC), multi-factor authentication (MFA), OTP input fields, password reset, or session management. Covers the modern auth stack hierarchy, MFA fatigue prevention, session expiry UX, and GDPR compliance for authentication.
npx claudepluginhub oborchers/fractional-cto --plugin saas-design-principlesThis skill uses the workspace's default tool permissions.
10% of active SaaS users get stuck in password reset flows monthly, and 75% of those quit. That is a potential 7.5% monthly user base loss from authentication friction alone.
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
10% of active SaaS users get stuck in password reset flows monthly, and 75% of those quit. That is a potential 7.5% monthly user base loss from authentication friction alone.
Support three methods, in order of preference:
The lowest-friction option. Airtable found 94% of enterprise users preferred them. Send a one-time link to the user's email — no password to remember.
Non-negotiable for enterprise customers and SOC 2 compliance. Integrate with identity providers like Okta, Azure AD, Google Workspace.
For high-security contexts or users who prefer passwords. Always pair with multi-factor authentication.
The implementation details matter enormously:
OTP input fields:
input type="text" inputmode="numeric" — NOT type="number" (which allows scroll-wheel changes and scientific notation)autocomplete="one-time-code" for iOS/macOS autofillPreventing MFA fatigue:
Never let the reset flow become a dead end:
For applications accessible to EU citizens:
Working implementations in examples/:
examples/otp-input.md — OTP digit input with correct HTML attributes, auto-advance, paste support, and auto-submit in React and Vueexamples/session-expiry-modal.md — Countdown warning modal with session extension and post-logout notificationWhen reviewing or building authentication:
type="text" inputmode="numeric", not type="number"autocomplete="one-time-code"