audit-token-validation

Étoiles4

Forks0

Mis à jour2 juillet 2026 à 23:05

Inbound token and webhook verification checklist. Use when code verifies JWTs, API keys, signed URLs, or webhook signatures — decode-without-verify, alg confusion, missing exp/aud/iss checks, kid/JWKS handling, HMAC over raw body, replay windows.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

danygiguere

danygiguere/audit-skills

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	audit-token-validation
description	Inbound token and webhook verification checklist. Use when code verifies JWTs, API keys, signed URLs, or webhook signatures — decode-without-verify, alg confusion, missing exp/aud/iss checks, kid/JWKS handling, HMAC over raw body, replay windows.

Read ../audit/references/access-data-security/token-validation.md and apply its checklist to the code the user specified (or the current diff if none was given). Verify each candidate with ../audit/references/methodology/verify.md before reporting. Report findings with severity and file:line references.

Plus depuis ce dépôt

même dépôt

audit

danygiguere/audit-skills

Full security, correctness, and operability audit of code. Use when reviewing a diff, endpoint, or feature for vulnerabilities or bugs without a specific topic in mind — security review, audit, code review for safety, "check this for issues".

2026-07-034

audit-deserialization

danygiguere/audit-skills

Insecure deserialization checklist. Use when untrusted bytes (request bodies, cookies, sessions, cache entries, queue messages, uploaded files) are deserialized — native object deserializers, polymorphic JSON/XML typing, unsafe YAML, or missing type allowlists.

2026-06-214

audit-time-clock

danygiguere/audit-skills

Time, timezone, and clock-correctness checklist. Use when code stores or computes timestamps, durations, timeouts, or expiry — naive vs aware datetimes, server-local now(), wall-clock for elapsed time, DST and calendar math, cross-zone comparisons.

2026-06-214

audit-caching

danygiguere/audit-skills

Caching correctness checklist. Use when reviewing caches — keys missing a user/tenant dimension, stale data after writes, cache stampede, cached errors, or per-user responses landing in a shared or CDN cache.

2026-06-204

audit-numeric-precision

danygiguere/audit-skills

Numeric and money precision checklist. Use when code computes money, totals, taxes, or splits — float used for currency, ad hoc rounding, integer overflow, division remainders, or unit/currency mismatches.

2026-06-204

audit-cardinality

danygiguere/audit-skills

Query cardinality checklist. Use when an UPDATE or DELETE keys on a non-unique column (e.g. WHERE name = ?) and may hit the wrong rows, when findOne/.single()/.first() runs on a non-unique field, or when a column is treated as unique in app code without a database UNIQUE constraint.

2026-06-134

Exécutez n'importe quel Skill en un clic