account-security

Name: account-security
Availability: InStock
Author: Sylphx

Enforces MFA, session visibility, and step-up recovery verification for web and mobile accounts.

4|2|Updated Sep 17, 2025

Search Tags:#security #session-management #auditability #MFA #account-recovery #server-enforcement

Ready to run

npx skills add https://github.com/SylphxAI/flow --skill account-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: account-security
Source: https://github.com/SylphxAI/flow/tree/main/.claude/skills/account-security
Command: npx skills add https://github.com/SylphxAI/flow --skill account-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Account security is critical for protecting users from unauthorized access, preserving trust, and reducing risk from compromised credentials. This Skill guides you to implement MFA, session visibility, and secure recovery workflows.

Core Features & Use Cases

MFA enforcement: Require multi-factor authentication to prevent credential abuse.
Session visibility and revocation: Users can see active sessions and revoke suspicious ones.
Account recovery safeguards: Step-up verification to securely recover access after loss or lockout.
Auditability: Server-enforced actions are logged for compliance and incident response.

Quick Start

Start by enabling MFA for user sign-in and wiring a server-side session store to track device sessions, then implement a recovery flow with step-up verification.

Frequently Asked Questions about account-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement MFA to secure user accounts?▼

MFA requires users to verify their identity through multiple factors—typically a password plus a second method like SMS, authenticator apps, or security keys. Enable MFA at sign-in to prevent unauthorized access even if credentials are compromised. Server-side enforcement ensures the second factor is always checked before granting session access.

What's the best way to manage user sessions and detect suspicious activity?▼

Session management tracks active devices and login locations server-side, letting users see and revoke sessions they don't recognize. Log all session events with timestamps and device details for auditability. This visibility helps users spot unauthorized access early and take corrective action.

How should I handle secure account recovery after a lockout or credential loss?▼

Account recovery requires step-up verification—additional identity checks beyond standard login—to prevent social engineering attacks. Use out-of-band methods like recovery codes, email verification, or support escalation. Server-enforce and audit all recovery actions to maintain security and compliance records.

Do I need server-side enforcement for account security controls?▼

Yes. Server-side enforcement is essential for MFA, session revocation, and recovery workflows because it prevents clients from bypassing security checks. Client-side validation alone is insufficient; all sensitive security decisions must be validated and logged server-side for auditability and compliance.

Can I implement account security across both web and mobile platforms?▼

Yes. Account security principles—MFA, session visibility, and recovery safeguards—apply to web and mobile platforms equally. Both must enforce the same server-side security policies and audit standards. The Skill supports multi-platform deployment with consistent authentication and session management.