otp-challengerEnable agents and skills to challenge users for fresh two-factor authentication proof (TOTP or YubiKey) before executing sensitive actions. Use this for identity verification in approval workflows - deploy commands, financial operations, data access, admin operations, and change control.
Install via ClawdBot CLI:
clawdbot install ryancnelson/otp-challengerGrade Good — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
/etc/passwdHardcoded API key or token pattern found in skill definition
ghp_aBcDeFgH...Potentially destructive shell commands in tool definitions
rm -rf /Accesses system directories or attempts privilege escalation
/var/log/Generated Mar 21, 2026
Require OTP verification before executing deployment commands like kubectl apply or terraform apply in CI/CD pipelines. This ensures only authorized personnel can trigger production changes, reducing the risk of unauthorized deployments or configuration drift.
Integrate OTP challenges before processing high-value financial operations such as wire transfers or payment approvals. This adds an extra layer of security to prevent fraud and ensure compliance with financial regulations.
Use OTP verification to grant access to sensitive data like PII exports or customer records. This helps organizations comply with data protection laws by ensuring only verified users can retrieve or modify critical information.
Require OTP authentication before performing admin operations such as user permission changes or system modifications. This mitigates insider threats and unauthorized administrative actions in enterprise environments.
Implement OTP challenges for change control processes in industries like energy or manufacturing. This ensures that critical system changes are authorized and logged, supporting audit trails and regulatory compliance.
Offer the skill as part of a security-focused SaaS platform, charging a monthly or annual fee per user or organization. This model provides recurring revenue and scales with customer adoption, targeting businesses needing enhanced authentication workflows.
Sell enterprise licenses for on-premises or private cloud deployments, including customization and support services. This model caters to large organizations with strict security requirements, generating high-value contracts and long-term partnerships.
Provide a free basic version with limited features, such as TOTP support, and charge for advanced capabilities like YubiKey integration or custom failure hooks. This model attracts a broad user base and upsells to paying customers for enhanced functionality.
💬 Integration Tip
Ensure all required binaries like jq and python3 are installed, and set up environment variables for OTP_SECRET or YubiKey credentials before integrating into workflows to avoid configuration errors.
Scored Jun 19, 2026
Calls external URL not in known-safe list
https://github.com/ryancnelson/otp-challengerAI Analysis
The skill's core purpose of OTP verification is legitimate, and the external URL is its own documented GitHub repository. However, the OTP_FAILURE_HOOK environment variable is flagged as a 'privilegedFeature' that can execute arbitrary shell commands, introducing a potential escalation vector if an attacker can control this hook.
Audited Apr 16, 2026 · audit v1.0
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation i...
Agent verification via ClawX OAuth system. Use when checking agent verification status, embedding verification widgets, or working with agent identity/trust tiers.
Complete Reva wallet management - passwordless authentication, PayID name claiming, multi-chain crypto transfers to PayIDs or wallet addresses, balance track...