auth-guard

Enforce canonical credential retrieval order with startup probes and guarded fallbacks.

Updated Apr 14, 2026

Search Tags:#security #credentials #fallback #auth #startup-check #env-var #credentials-file

Ready to run

npx skills add https://github.com/Kitsune-Den/skulk-skills --skill auth-guard

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-guard
Source: https://github.com/Kitsune-Den/skulk-skills/tree/main/skills/auth-guard
Command: npx skills add https://github.com/Kitsune-Den/skulk-skills --skill auth-guard

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bash, curl, python3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Enforce canonical credential retrieval to prevent missing-auth regressions and intermittent 401/403 errors after restarts.

Core Features & Use Cases

Canonical credential order: environment variable first, then credentials file stored under ~/.config/<service>/credentials.json.
Startup/auth-check helper: a reusable script placed in workspace/.pi/ that centralizes auth validation before heartbeats.
Fallback policy and governance: explicit, deterministic fallbacks and safe logging practices to avoid exposing secrets.
Policy alignment: integrates with HEARTBEAT.md and AGENTS.md to ban bypassing helper scripts.

Quick Start

Place a startup helper script in workspace/.pi for your service, configure the env var and credentials file, and run the startup auth probe before beginning heartbeat loops.

Frequently Asked Questions about auth-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent missing API credentials from causing 401 errors after a service restart?▼

Prevent missing-auth regressions by enforcing a canonical credential retrieval order that checks environment variables first, then falls back to a credentials file, ensuring startup probes validate authentication before heartbeats begin.

What is the best way to structure a startup auth check for protected endpoints?▼

Structure startup auth checks by placing a reusable validation script in the workspace directory to centralize credential retrieval, applying deterministic fallback policies, and enforcing safe logging practices to prevent exposing secrets during probes.

How does fallback policy work for credential retrieval in automated workflows?▼

Fallback policy for credential retrieval works by applying a deterministic order: checking environment variables initially, then reading the credentials file, ensuring explicit governance to ban bypassing helper scripts across workflows.

Do I need bash and python3 to run startup auth probes for environment variables?▼

Yes, you need bash, curl, and python3 installed to execute the reusable startup auth probe scripts that validate environment variables and credentials files before initiating heartbeat loops.

Why should I use a canonical credential order instead of direct environment variable checks?▼

Use a canonical credential order to codify deterministic retrieval, prevent intermittent 401/403 errors, and align with governance policies that ban bypassing centralized helper scripts for authentication validation.