hor-cookie-authentication SKILL.md skillA
hor-cookie-authentication from openreachtech/hora-skills-ort-renchan is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add openreachtech/hora-skills-ort-renchan/hor-cookie-authentication@v2026.08.18Pins v2026.08.18 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- openreachtech/hora-skills-ort-renchan
- Path
kit/skills/hor-cookie-authentication/SKILL.md- Versions recorded
- 2
- Latest version
- v2026.08.18, committed Oct 16, 2026
- First version recorded
- Sep 5, 2026
- Size
- 4,921 bytes
- Repository stars
- 32
- License
- Apache-2.0
Password sign-in with cookie-based sessions for a renchan backend, per actor: the credential and token models (password hash, access + rotating refresh tokens with reuse detection), the refresh-token HttpOnly cookie, the signIn / signUp / signOut / renewAccessToken resolvers, and the engine's public-operation policy. Use when adding password auth to an actor/role. Boundary: external identity provider sign-in and other credential routes have their own conventions.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Cookie Authentication (Backend) Use this skill when adding **password sign-in** with cookie-based sessions to a renchan backend: storing an actor's credential and tokens, the sign-in / sign-out / renew operations, the refresh-token cookie, and deciding which operations are public. An authenticated actor (a role such as `user`, `customer`, `admin`, or `tenant`) keeps its password as a hash and authenticates with two tokens: a short-lived **access token** the client sends as a header, and a long-lived **refresh token** kept in the DB and handed to the browser as an **HttpOnly cookie**. `signIn` issues both; `renewAccessToken` reads the cookie, rotates the refresh token (detecting reuse of a retired one), and returns a fresh access token; `signOut` revokes the series and clears the cookie. Only `renewAccessToken` and `signOut` authenticate by the cookie — every other operation authenticates by the access-token header. …
Read the whole file at its exact version.
How to install
mdr add openreachtech/hora-skills-ort-renchan/hor-cookie-authentication@sha256:d237c58a986f26bbThe line at the top of this page pins the label v2026.08.18, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_iw7uwzwdixbw54wh)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, between Sep 5, 2026 and Oct 16, 2026, about one every 40 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v2026.08.18 latest | 2026-10-16 | d4c4aaa | 4,921 B | A | view · diff |
| v2026.08.18 | 2026-09-05 | 5a04969 | 4,462 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4921 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
openreachtech/hora-skills-ort-renchan · 32 stars · license Apache-2.0 · pushed 2026-10-16 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_iw7uwzwdixbw54wh GET https://markdownregistry.com/api/v1/resolve?ref=openreachtech/hora-skills-ort-renchan/hor-cookie-authentication GET https://markdownregistry.com/api/v1/blob/d237c58a986f26bb8918ecab717ee7bf4abd16b8c521ff575c212f225223011a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.