microsoft/simplechat

broken-access-control-audit

Use when: auditing SimpleChat Python routes, helpers, or plugins for Broken Access Control, IDOR, BOLA, user_id/object-id misuse, or missing ownership/membership checks.

create-github-issue

Use when: creating a GitHub issue for microsoft/simplechat, triaging labels, assigning an owner, setting priority and size, and adding it to the Simple Chat Roadmap prioritized backlog.

csrf-and-state-changing-route-audit

Use when: auditing SimpleChat state-changing Flask routes for CSRF, unsafe HTTP methods, content-type assumptions, same-site/session risks, or mutation endpoints reachable through browser requests.

document-feature-with-screenshots

Use when: documenting a new SimpleChat release feature or capability with browser screenshots, annotations, docs image assets, and related docs updates.

external-browser-assets-and-third-party-js-audit

Use when: auditing SimpleChat browser runtime assets, CDN references, CSP, vendored third-party JavaScript, worker/font/WASM companion assets, or local-only frontend dependency security.

file-upload-and-document-ingestion-security-audit

Use when: auditing SimpleChat file upload, document ingestion, blob storage, parsing, indexing, downloads, citations, generated artifacts, MIME validation, filename handling, or document security.

malicious-pr-and-file-security-review

Use when: reviewing a SimpleChat pull request, commit diff, branch diff, or explicit file set for malicious code, hidden security issues, obfuscation, unauthorized external connections, malware-like behavior, data exfiltration, dependency pinning, or newly…

pinned-python-package-security-audit

Use when: auditing SimpleChat pinned Python requirements, third-party package source or wheels, dependency advisories, transitive dependencies, supply-chain risk, hashes, licenses, or package update safety.

plugin-tool-and-agent-security-audit

Use when: auditing SimpleChat agents, Semantic Kernel plugins, tool calls, actions, workflows, external APIs, prompt/tool injection boundaries, or plugin-scoped authorization.

prepare-for-pull-request

Use when the user says: Prepare for a pull request, PR prep, ready this branch for PR, validate before PR, or create a PR to Development. Runs SimpleChat branch sync and validation workflow before optionally pushing or creating a GitHub pull request.

privacy-logging-and-telemetry-audit

Use when: auditing SimpleChat logs, App Insights telemetry, activity logs, plugin logs, exports, traces, errors, or diagnostics for privacy, PII, prompt/content, token, or secret exposure.

route-authentication-audit

Use when: auditing SimpleChat Flask routes for missing or incorrect @login_required, @user_required, @admin_required, specialized admin decorators, Swagger auth metadata, or decorator order.

settings-and-secrets-exposure-audit

Use when: auditing SimpleChat for settings, secrets, credentials, connection strings, tokens, API keys, or raw configuration exposure in routes, templates, JSON APIs, logs, docs, and tests.

update-latest-features

Use when turning SimpleChat release notes into in-app Latest Features cards for end users and admins. Guides release-tier discovery, card authoring, screenshot placeholders, tests, and tier shifts.

xss-full-audit-and-remediation

Use when: running a full SimpleChat cross-site scripting/XSS audit across all browser rendering surfaces, creating a remediation plan, fixing risky sinks, and validating locally.