audit-fix-authz

Étoiles4

Forks0

Mis à jour11 juin 2026 à 22:00

Remediation patterns for authorization findings. Use after an audit confirms an authz or IDOR issue and the user asks for a fix — policy checks, ownership scoping.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

danygiguere

danygiguere/audit-skills

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	audit-fix-authz
description	Remediation patterns for authorization findings. Use after an audit confirms an authz or IDOR issue and the user asks for a fix — policy checks, ownership scoping.

Read ../audit/references/remediation/authz-patterns.md and apply its patterns to fix the confirmed findings the user referenced. Make the smallest change that restores the invariant, and keep style consistent with the surrounding code.

Plus depuis ce dépôt

même dépôt

audit

danygiguere/audit-skills

Full security, correctness, and operability audit of code. Use when reviewing a diff, endpoint, or feature for vulnerabilities or bugs without a specific topic in mind — security review, audit, code review for safety, "check this for issues".

2026-07-034

audit-token-validation

danygiguere/audit-skills

Inbound token and webhook verification checklist. Use when code verifies JWTs, API keys, signed URLs, or webhook signatures — decode-without-verify, alg confusion, missing exp/aud/iss checks, kid/JWKS handling, HMAC over raw body, replay windows.

2026-07-024

audit-deserialization

danygiguere/audit-skills

Insecure deserialization checklist. Use when untrusted bytes (request bodies, cookies, sessions, cache entries, queue messages, uploaded files) are deserialized — native object deserializers, polymorphic JSON/XML typing, unsafe YAML, or missing type allowlists.

2026-06-214

audit-time-clock

danygiguere/audit-skills

Time, timezone, and clock-correctness checklist. Use when code stores or computes timestamps, durations, timeouts, or expiry — naive vs aware datetimes, server-local now(), wall-clock for elapsed time, DST and calendar math, cross-zone comparisons.

2026-06-214

audit-caching

danygiguere/audit-skills

Caching correctness checklist. Use when reviewing caches — keys missing a user/tenant dimension, stale data after writes, cache stampede, cached errors, or per-user responses landing in a shared or CDN cache.

2026-06-204

audit-numeric-precision

danygiguere/audit-skills

Numeric and money precision checklist. Use when code computes money, totals, taxes, or splits — float used for currency, ad hoc rounding, integer overflow, division remainders, or unit/currency mismatches.

2026-06-204

Exécutez n'importe quel Skill en un clic