Enforces MFA, session visibility, and step-up recovery verification for web and mobile accounts.
npx skills add https://github.com/SylphxAI/flow --skill account-security
Please help me install this Agent Skill. Skill: account-security Source: https://github.com/SylphxAI/flow/tree/main/.claude/skills/account-security Command: npx skills add https://github.com/SylphxAI/flow --skill account-security
Account security is critical for protecting users from unauthorized access, preserving trust, and reducing risk from compromised credentials. This Skill guides you to implement MFA, session visibility, and secure recovery workflows.
Start by enabling MFA for user sign-in and wiring a server-side session store to track device sessions, then implement a recovery flow with step-up verification.
High-intent search queries and answers about installing and using this skill.
MFA requires users to verify their identity through multiple factors—typically a password plus a second method like SMS, authenticator apps, or security keys. Enable MFA at sign-in to prevent unauthorized access even if credentials are compromised. Server-side enforcement ensures the second factor is always checked before granting session access.
Session management tracks active devices and login locations server-side, letting users see and revoke sessions they don't recognize. Log all session events with timestamps and device details for auditability. This visibility helps users spot unauthorized access early and take corrective action.
Account recovery requires step-up verification—additional identity checks beyond standard login—to prevent social engineering attacks. Use out-of-band methods like recovery codes, email verification, or support escalation. Server-enforce and audit all recovery actions to maintain security and compliance records.
Yes. Server-side enforcement is essential for MFA, session revocation, and recovery workflows because it prevents clients from bypassing security checks. Client-side validation alone is insufficient; all sensitive security decisions must be validated and logged server-side for auditability and compliance.
Yes. Account security principles—MFA, session visibility, and recovery safeguards—apply to web and mobile platforms equally. Both must enforce the same server-side security policies and audit standards. The Skill supports multi-platform deployment with consistent authentication and session management.
hung-phanAnalyze authentication designs for password hashing, MFA, and session management.
backbay-labsAutomate security event investigation and threat hunting workflows.
finsilabsImplement brute-force lockouts, TOTP MFA, and secure session management.
shirulotRetrieve verified emails on Android via Credential Manager and OpenID4VP.
