bff-entry-points

bff-entry-points is an Auth & identity skill for AI agents, published by citypaul in the .dotfiles repository on GitHub. Skillspace rates bff-entry-points D (64/100) and it passed the safety scan; the rating is based on static analysis only.

Design and protect browser-facing BFF and backend HTTP entry points: an explicit public/protected access classification for every production route, a composition-prepared endpoint registrar that installs session, Origin, Fetch Metadata, CSRF, and content-type policy by construction, provider-free authorization inside the application, protected SSE and WebSocket registration, browser session coordination, and automated enforcement gates. Use when adding or reviewing HTTP endpoints, when a tenant or customer can see another's data through a route or any authorization bug is reported on an endpoint, authentication middleware, session cookies, CSRF or Origin policy, realtime streams, login/logout flows, or auditing which routes are public. For whether to adopt a BFF, granularity, aggregation, and upstream identity mediation use bff-design; for physical BFF route layout use structure-codebase; for REST semantics, pagination, and versioning use api-design; for OAuth/OIDC protocol flows use…

Grade
D
Quality
64 / 100
Safety
Passed
GitHub stars
730

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

View source on GitHubcitypaul/.dotfiles

Our review

Architecture
89 / 100
Maturity
Structured: ships references or scripts
Security scan
Low-risk patterns
License
Not declared. Check the repository before reusing it.

What the scanner flagged

  • mentions secrets in text

Not checked yet

  • Category is a classifier prediction; no model has read this skill yet
  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Auth & identity

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.