Agent skill · Google

Sign In With Google (Web) skill for Claude Code, Codex and Cursor

Implements and secures Google sign-in buttons and One Tap with Google Identity Services.

Officialname: sign-in-with-google-web★ 22k (repo)pushed 2026-10-23Apache-2.0SKILL.md on GitHubchecked 2026-11-07

What it does, in the publisher's words

Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS / `https://accounts.google.com/gsi/client`) across web architectures.

The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.

Install Sign In With Google (Web)

The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs

npx skills add google/skills --skill sign-in-with-google-web

This repo is a plugin marketplace. Inside Claude Code, add it and install the plugin that holds the skill (alloydb, alloydb-omni, bigquery, bigtable...), or copy only this skill into ~/.claude/skills. docs

/plugin marketplace add google/skills
/plugin install <plugin>@google-plugins

# or only this skill:
npx skills add google/skills --skill sign-in-with-google-web -a claude-code

Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs

git clone --depth 1 https://github.com/google/skills.git /tmp/sign-in-with-google-web-src
cp -r /tmp/sign-in-with-google-web-src/skills/identity/sign-in-with-google-web ./sign-in-with-google-web
zip -r sign-in-with-google-web.zip sign-in-with-google-web

Codex reads skills from .agents/skills in the repo or ~/.agents/skills. Type $ in Codex to use one. docs

npx skills add google/skills --skill sign-in-with-google-web -a codex

gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs

gh skill install google/skills sign-in-with-google-web

Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs

npx skills add google/skills --skill sign-in-with-google-web -a cursor

Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs

gemini skills install https://github.com/google/skills.git --path skills/identity/sign-in-with-google-web

OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs

npx skills add google/skills --skill sign-in-with-google-web -a opencode

Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs

npx skills add google/skills --skill sign-in-with-google-web -a windsurf

Works with

Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.

What's in the SKILL.md

16 sections

1. IETF Architecture Taxonomy & Hierarchy (RECOMMEND BFF / TMB FIRST)
🏆 Pattern A: Backend For Frontend (BFF - IETF § 6.1) — STRONGLY RECOMMENDED
🚀 Pattern B: Token-Mediating Backend via login_uri Redirect (IETF § 6.2) — Server-Rendered & Form POST
Pattern C: Browser-Based OAuth Client — Ephemeral In-Memory (IETF § 6.3) — Fallback for Static SPAs
Pattern D: Browser-Based OAuth Client — WebCrypto Encrypted IndexedDB (IETF § 6.3) — Fallback for Offline PWAs
2. Mandatory Security Directives & Browser Policies
A. Content Security Policy (CSP) Directives
B. Cross-Origin Opener Policy (COOP)
C. Automatic Selection, FedCM, & Sign-Out Lifecycle (disableAutoSelect)
D. Reliable Dynamic Script Loading & Framework Lifecycle (React, Next.js, SPAs)
E. Embedded Iframes & Permissions Policy (identity-credentials-get)
3. Implementation Contracts & Anti-Pattern Bans
A. Strict Ban on Legacy GAPI (gapi.auth2)
4. Implementation Recipes (Progressive Disclosure)
5. Sign-Out & Account Revocation Across All Patterns
6. References & Normative Standards

Bundled files

references/bff_fastapi_verification.md
references/in_memory_spa_nonce.md
references/intermediate_iframe.md
references/offline_pwa_encryption.md
references/tmb_login_uri_redirect.md

Loaded only when the instructions point to them.

Facts

Skill name: sign-in-with-google-web
Publisher: Google (official)
Repo: google/skills
License: Apache-2.0
Version: 1.0.0
SKILL.md size: 1,283 words, 351 lines
Bundled files: 5, 5 docs
Repo stars: 22k (as of 2026-10-24)
SKILL.md checked: 2026-11-07

More skills from google/skills

BigQuery Basics: Runs SQL and manages BigQuery datasets, tables, views and load jobs.
gcloud CLI: Adds safety checks and guardrails when the agent plans or runs gcloud commands on Google Cloud.

Related security & auth skills

Security Best Practices Review · OpenAI
Security Threat Model · OpenAI
Agentic Actions Auditor · Trail of Bits
CodeQL Scan · Trail of Bits
Constant-Time Analysis · Trail of Bits
Differential Security Review · Trail of Bits
Semgrep Rule Creator · Trail of Bits
Sharp Edges · Trail of Bits

FAQ

What does the sign-in-with-google-web skill do?+

Implements and secures Google sign-in buttons and One Tap with Google Identity Services. In its own SKILL.md, Google describes it as: "Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS / `https://accounts.google.com/gsi/client`) across web architectures."

How do I install the sign-in-with-google-web skill?+

Run npx skills add google/skills --skill sign-in-with-google-web and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/sign-in-with-google-web/SKILL.md; in Codex and Cursor in .agents/skills/sign-in-with-google-web/.

Does Sign In With Google (Web) work in Codex, Cursor and Copilot, or only Claude?+

It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.

Who maintains Sign In With Google (Web)?+

Google, the company or project behind it, in the google/skills repo on GitHub, last pushed 2026-10-23. License: Apache-2.0.

Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers