auto-authenticator-localUse when the user wants a local-first TOTP helper for accounts they personally own or are explicitly authorized to access. This skill stores TOTP seeds in sy...
Install via ClawdBot CLI:
clawdbot install lucaszh7/auto-authenticator-localGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
curl -fsSL https://raw.githubusercontent.com/LucasZH7/auto-authenticator-local/mCalls external URL not in known-safe list
https://github.com/LucasZH7/auto-authenticator-local.gitUses known external API (expected, informational)
raw.githubusercontent.comAI Analysis
The skill's core functionality is legitimate and privacy-focused, storing TOTP seeds locally in OS credential vaults. The primary risk stems from the external script download (curl command) which could be a supply-chain attack vector if the repository is compromised, but this is not an active data exfiltration or credential harvesting pattern.
Generated Mar 21, 2026
A freelance developer uses this skill to securely manage TOTP codes for their personal GitHub, AWS, and email accounts on their local machine. It helps them avoid storing seeds in plaintext files while ensuring quick access for legitimate logins during development work.
An IT administrator at a small business deploys this skill to handle TOTP codes for company-owned accounts like cloud services and internal tools. They use it to migrate from insecure methods to OS-native secure storage, ensuring only authorized staff can generate codes with explicit requests.
A privacy-focused individual adopts this skill to move away from cloud-based authenticator apps, storing TOTP seeds locally on their device for personal banking and social media accounts. It provides a guide to securely transition without risking secret exposure online.
A university lab manager implements this skill for students to access shared research accounts with proper authorization. It enforces safe handling of TOTP seeds in secure storage, preventing misuse by requiring explicit code generation for each login session.
A distributed team uses this skill to integrate TOTP codes into approved local login flows for collaborative tools like project management software. It ensures codes are generated only on request, maintaining security while supporting remote work without bypassing MFA policies.
Offer the core skill as free, open-source software to build a community, then charge for premium features like advanced integration guides, priority support, or enterprise security audits. Revenue comes from subscriptions and consulting services.
Bundle this skill with other privacy tools into a paid package for businesses, focusing on compliance and secure local storage. Revenue is generated through annual licenses, custom deployment support, and training workshops for IT teams.
Integrate this skill into popular developer platforms or IDEs as a paid add-on, providing seamless TOTP management for coding accounts. Revenue streams include one-time purchases, in-app upgrades, and partnerships with tech companies.
💬 Integration Tip
Ensure the host machine has a working secure storage backend like keyring installed; if not, guide the user to set it up before use to avoid plaintext fallbacks.
Scored Apr 19, 2026
Audited Apr 17, 2026 · audit v1.0
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Start and complete WordPress.com OAuth and publish posts through the WordPress.com REST API. Use when you need to generate an authorization URL, exchange cal...
Configures Firebase Authentication — providers, security rules, custom claims, and React auth hooks
Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation i...