메뉴
Audits authentication, authorization, and input validation boundaries to verify trust is established once at entry and not re-checked ad hoc throughout business logic. Use when building or reviewing auth, designing middleware, handling user/webhook/third-party input, or performing security-oriented review.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Evaluates and enforces layered middleware architecture for authentication, authorization, and usage enforcement on API routes. Use when building request middleware, enforcing plans or feature access, or attaching request context to downstream handlers.
Selects Cloudflare infrastructure services and LLM providers for a feature set based on dependency chains, storage needs, and settled policy. Use when assigning services (D1, KV, R2, Durable Objects, Queues, Workflows, Workers AI, Hyperdrive), evaluating whether a feature needs Workflows or Durable Objects, choosing between LLM providers, or confirming a build follows the Workers-first topology.
Audits request handling pipelines for explicit data flow, visible transformations, and traceability through logs. Use when designing request handling pipelines, reviewing code for debuggability, tracing production issues, or evaluating whether a new developer could follow the flow.
Audits stateful logic and error handling to verify single sources of truth, boundary-layer error handling, and explicit recovery paths. Use when designing APIs or workflows, refactoring stateful logic, or reviewing retries, fallback behavior, or recovery flows.
Traces feature implementation from UI through handlers, middleware, and storage to identify broken wiring, dead paths, and coverage gaps. Use when reviewing implementation completeness, validating frontend-to-backend wiring, or checking route/handler/middleware/storage consistency.
Designs or builds a page, screen, or component system following the project's strict visual and technical rules. Use when designing a page or screen, building a component system, or reviewing frontend polish and hierarchy.
| name | audit-trust-boundaries |
| description | Audits authentication, authorization, and input validation boundaries to verify trust is established once at entry and not re-checked ad hoc throughout business logic. Use when building or reviewing auth, designing middleware, handling user/webhook/third-party input, or performing security-oriented review. |
Primary roles: architect, tester
Inspects the system's trust architecture to verify that identity is verified once at entry, permissions are checked at capability boundaries, and business logic executes without redundant trust checks. Flags missing validation, scattered re-verification, and mixed concerns.
verifyAuth(), checkPermission(), or equivalent calls inside domain logic.AND user_id = ? to individual queries throughout the codebase.UNTRUSTED (raw request)
|
[Authentication Boundary] — Who are you? (verify once)
|
TRUSTED (verified identity flows through)
|
[Authorization Boundary] — Can you do this? (check at capability boundaries)
|
PERMITTED (business logic executes, assumes permission)
verifyAuth(user) independently — unclear which check is authoritative.AND user_id = ? in every database query instead of middleware enforcing tenant scope.Produce the following: