otp-challengerEnable agents and skills to challenge users for fresh two-factor authentication proof (TOTP or YubiKey) before executing sensitive actions. Use this for identity verification in approval workflows - deploy commands, financial operations, data access, admin operations, and change control.
Install via ClawdBot CLI:
clawdbot install ryancnelson/otp-challengerGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
/etc/passwdHardcoded API key or token pattern found in skill definition
ghp_aBcDeFgH...Potentially destructive shell commands in tool definitions
rm -rf /Accesses system directories or attempts privilege escalation
/var/log/Generated Mar 21, 2026
Require OTP verification before executing deployment commands like kubectl apply or terraform apply in CI/CD pipelines. This ensures only authorized personnel can trigger production changes, reducing the risk of unauthorized deployments or configuration drift.
Integrate OTP challenges before processing high-value financial operations such as wire transfers or payment approvals. This adds an extra layer of security to prevent fraud and ensure compliance with financial regulations.
Use OTP verification to grant access to sensitive data like PII exports or customer records. This helps organizations comply with data protection laws by ensuring only verified users can retrieve or modify critical information.
Require OTP authentication before performing admin operations such as user permission changes or system modifications. This mitigates insider threats and unauthorized administrative actions in enterprise environments.
Implement OTP challenges for change control processes in industries like energy or manufacturing. This ensures that critical system changes are authorized and logged, supporting audit trails and regulatory compliance.
Offer the skill as part of a security-focused SaaS platform, charging a monthly or annual fee per user or organization. This model provides recurring revenue and scales with customer adoption, targeting businesses needing enhanced authentication workflows.
Sell enterprise licenses for on-premises or private cloud deployments, including customization and support services. This model caters to large organizations with strict security requirements, generating high-value contracts and long-term partnerships.
Provide a free basic version with limited features, such as TOTP support, and charge for advanced capabilities like YubiKey integration or custom failure hooks. This model attracts a broad user base and upsells to paying customers for enhanced functionality.
💬 Integration Tip
Ensure all required binaries like jq and python3 are installed, and set up environment variables for OTP_SECRET or YubiKey credentials before integrating into workflows to avoid configuration errors.
Scored Apr 19, 2026
Calls external URL not in known-safe list
https://github.com/ryancnelson/otp-challengerAI Analysis
The skill's core purpose of OTP verification is legitimate, and the external URL is its own documented GitHub repository. However, the OTP_FAILURE_HOOK environment variable is flagged as a 'privilegedFeature' that can execute arbitrary shell commands, introducing a potential escalation vector if an attacker can control this hook.
Audited Apr 16, 2026 · audit v1.0
Use when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS/CSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review.
gws CLI: Shared patterns for authentication, global flags, and output formatting.
Set up Gmail API access via gog CLI with manual OAuth flow. Use when setting up Gmail integration, renewing expired OAuth tokens, or troubleshooting Gmail authentication on headless servers.
Automate OAuth login flows with user confirmation via Telegram. Supports 7 providers: Google, Apple, Microsoft, GitHub, Discord, WeChat, QQ. Features: - Auto-detect available OAuth options on login pages - Ask user to choose via Telegram when multiple options exist - Confirm before authorizing - Handle account selection and consent pages automatically
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Build secure authentication with sessions, JWT, OAuth, passwordless, MFA, and SSO for web and mobile apps.