القائمة
Read-only audit of Rico Hunt Jotform and Telegram webhooks. Verify idempotency, signature checks, and command isolation without sending live messages.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | check-rico-webhooks |
| description | Read-only audit of Rico Hunt Jotform and Telegram webhooks. Verify idempotency, signature checks, and command isolation without sending live messages. |
| triggers | ["user","model"] |
| allowed-tools | ["read","grep","exec"] |
Read-only audit of Rico Hunt webhooks. This skill never sends live Telegram messages or calls JotForm APIs. It only inspects code and configuration.
db.register_webhook_event() before processing and db.mark_webhook_event_processed() after.JOTFORM_WEBHOOK_SECRET.# Idempotency
grep -n "register_webhook_event\|mark_webhook_event_processed" src/rico_jotform_webhook.py
# Signature verification
grep -n "JOTFORM_WEBHOOK_SECRET\|signature\|hmac" src/rico_jotform_webhook.py
# Telegram admin vs user separation
grep -n "admin\|send_admin_notification\|TELEGRAM_ADMIN_CHAT_ID\|TELEGRAM_CHAT_ID" src/rico_telegram_webhook.py src/services/notification_router.py
# Webhook routes in FastAPI
grep -n "jotform\|telegram" src/api/routers/rico_chat.py src/api/app.py
src/rico_jotform_webhook.py — Jotform processing and idempotencysrc/rico_telegram_webhook.py — Telegram command processingsrc/services/notification_router.py — audience routing rulessrc/api/routers/rico_chat.py — webhook route registrationAccessibility audit for Rico Hunt. Run contrast checks and review alt text, focus states, ARIA labels, and keyboard navigation in frontend code.
Read-only audit of Rico Hunt AI provider routing. Verify RICO_AI_PROVIDER env var, fallback chain, and provider health without calling live AI APIs.
Verify Rico Hunt authentication rules. Check JWT cookie usage, signup role enforcement, protected route isolation, and no request body user_id.
Verify Rico Hunt chat flow. Inspect public chat session isolation, rate limits, authenticated chat routing, and public session prefixing.
Read-only database health check for Rico Hunt. Verify DATABASE_URL connectivity, key tables, and row counts without exposing user data or mutating anything.
Verify Rico Hunt required environment variables are set without exposing values. Check backend, frontend, and admin/dev env vars.