security-audit

name	security-audit
description	Threat model and hardening — multi-tenancy, auth guards, secrets, data leaks
version	2.0.0
compat	claude-code, codex, cursor, openclaw

Skill: Security Audit (Threat Model and Hardening)

Purpose

Perform a deep, focused analysis of the attack surface of code developed during the cycle. Unlike a general linter, this skill operates under a specific backend threat model, guaranteeing absolute data isolation (Multi-Tenancy) and system key integrity.

---

Critical Inspection Vectors

1. Multi-Tenancy Data Leaks (Client Isolation)

• The Danger: Improper use of database clients with service role or superuser access (service_role, admin_client) bypasses Row-Level Security (RLS).
• Audit Rule: Every query made through a bypass client must include an explicit tenant/company filter in the WHERE clause.
• Invalid Code: db.from('records').select('*') ❌ (Potential mass leak)
• Secure Code: db.from('records').select('*').eq('company_id', current_company) (Isolated)

2. Authentication Verification on Endpoints (Auth Guards)

• Audit Rule: Every file inside API route directories (/api/v1/, /api/routes/) must explicitly verify the requesting user's active session at the method's start, unless documented as a controlled public endpoint.

3. Internal Communication Secrets Validation

• Audit Rule: Endpoints designed for exclusive consumption between microservices, internal middlewares, or external webhooks (e.g., n8n automations, message queue triggers) must mandatorily validate the presence and accuracy of secret keys in the request headers.
• Example: Validation of x-internal-secret or x-webhook-signature.

4. Sensitive Data Exposure in Client Layers (Frontend Leak)

• Audit Rule: Verify that data models returned to the web client don't carry credential columns, refresh tokens, password hashes, or raw third-party integration data. All data serialization to the frontend must be explicitly bounded.

---

Output and Blocking Mechanism

When executed (via CLI or IDE analysis), the skill generates a findings list. Any finding in the Multi-Tenancy or Auth Guards category automatically triggers a CRITICAL FAILURE status, blocking any attempt to execute the close-epic skill.