How do I install the Kirby Security And Auth skill?

Run npx skillmds@latest add tomevault-io/kirby-security-and-auth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Kirby Security And Auth safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Kirby Security And Auth?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Kirby Security And Auth free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Kirby Security And Auth?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Kirby Security And Auth by tomevault-io

Name: Kirby Security And Auth
Author: tomevault-io

File contents

Kirby Security and Auth

KB entry points

kirby://kb/scenarios/62-access-restriction-login
kirby://kb/scenarios/43-user-registration-and-login
kirby://kb/scenarios/63-files-firewall-protected-downloads
kirby://kb/scenarios/64-permission-tricks-role-based
kirby://kb/scenarios/67-indieauth-rel-me

Required inputs

Protected pages/data and required roles.
Login/logout flow and redirect rules.
Download protection or route constraints.

Role matrix template

Role	Pages	Actions	Downloads
admin	all	all	all
editor	edit	publish	limited

Default guard pattern

Check $kirby->user() and required role/permission before returning content.
Redirect or return a 403 for unauthorized requests.
Enforce CSRF and validation on auth-related forms.

Login redirect rule

Store intended URL in the session and redirect after successful login.
Fall back to the home page when no intent is stored.

Common pitfalls

Checking access only in templates while routes remain public.
Returning a 404 for unauthorized access instead of a 403 or redirect.

Verification checklist

Test the role matrix across protected pages and downloads.
Verify login/logout flows and session handling.
Confirm CSRF failures render safely.

Workflow

Clarify which pages/data are protected, required roles, and login/logout behavior.
Call kirby:kirby_init and read kirby://roots.
Inspect templates/controllers/blueprints to align with existing patterns:
- kirby:kirby_templates_index
- kirby:kirby_controllers_index
- kirby:kirby_blueprints_index
For protected downloads or auth routes, inspect routes with kirby:kirby_routes_index and kirby://config/routes (install runtime if needed).
Search the KB with kirby:kirby_search (examples: "access restriction login", "user registration and login", "files firewall", "permission tricks", "page on own domain").
Implement least-privilege checks in templates/controllers or routes; enforce CSRF and validation on auth forms.
Verify by rendering protected pages (kirby:kirby_render_page) and manually testing login and download URLs.

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: kirby-security-and-authdescription: Secures Kirby sites with access restriction, user roles, permissions, and protected downloads. Use when implementing login/role-based access, permissions, or file protection. Use when this capability is needed.---# Kirby Security and Auth## KB entry points- `kirby://kb/scenarios/62-access-restriction-login`- `kirby://kb/scenarios/43-user-registration-and-login`- `kirby://kb/scenarios/63-files-firewall-protected-downloads`- `kirby://kb/scenarios/64-permission-tricks-role-based`- `kirby://kb/scenarios/67-indieauth-rel-me`## Required inputs- Protected pages/data and required roles.- Login/logout flow and redirect rules.- Download protection or route constraints.## Role matrix template| Role | Pages | Actions | Downloads || ------ | ----- | ------- | --------- || admin | all | all | all || editor | edit | publish | limited |## Default guard pattern- Check `$kirby->user()` and required role/permission before returning content.- Redirect or return a 403 for unauthorized requests.- Enforce CSRF and validation on auth-related forms.## Login redirect rule- Store intended URL in the session and redirect after successful login.- Fall back to the home page when no intent is stored.## Common pitfalls- Checking access only in templates while routes remain public.- Returning a 404 for unauthorized access instead of a 403 or redirect.## Verification checklist- Test the role matrix across protected pages and downloads.- Verify login/logout flows and session handling.- Confirm CSRF failures render safely.## Workflow1. Clarify which pages/data are protected, required roles, and login/logout behavior.2. Call `kirby:kirby_init` and read `kirby://roots`.3. Inspect templates/controllers/blueprints to align with existing patterns: - `kirby:kirby_templates_index` - `kirby:kirby_controllers_index` - `kirby:kirby_blueprints_index`4. For protected downloads or auth routes, inspect routes with `kirby:kirby_routes_index` and `kirby://config/routes` (install runtime if needed).5. Search the KB with `kirby:kirby_search` (examples: "access restriction login", "user registration and login", "files firewall", "permission tricks", "page on own domain").6. Implement least-privilege checks in templates/controllers or routes; enforce CSRF and validation on auth forms.7. Verify by rendering protected pages (`kirby:kirby_render_page`) and manually testing login and download URLs.---> Converted and distributed by [TomeVault](https://tomevault.io/claim/bnomei) — claim your Tome and manage your conversions.

Frequently asked questions

Kirby Security And Auth