auth-policy-review

Name: auth-policy-review
Availability: InStock
Author: aaron

Audit authentication and authorization across PANaCEa's API surface.

Updated Nov 16, 2025

Search Tags:#security #api #rls #middleware #rbac #webhooks #auth

Ready to run

npx skills add https://github.com/aaronjullger-lgtm/PANaCEa --skill auth-policy-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: auth-policy-review
Source: https://github.com/aaronjullger-lgtm/PANaCEa/tree/main/.claude/skills/auth-policy-review
Command: npx skills add https://github.com/aaronjullger-lgtm/PANaCEa --skill auth-policy-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audits authentication, authorization, and endpoint security across PANaCEa's API surface to prevent unauthorized access, misconfigurations, and token leaks.

Core Features & Use Cases

Comprehensive auth surface review: verify Clerk integration, token validation, and middleware guards.
RBAC and RLS verification: confirm role-based access and row-level security policies are enforced.
Endpoint protection assessment: identify unprotected routes, inadequate rate limiting, and admin-only exposure.
Webhook and integration safety review: examine Clerk webhook handling, secrets management, and event flows.

Quick Start

Review the API surface to identify missing or misconfigured authentication, RBAC, and rate-limiting controls.

Frequently Asked Questions about auth-policy-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit API authentication and authorization for unprotected routes?▼

To audit API authentication, review the API surface to identify unprotected routes, verify Clerk token validation, and ensure middleware guards enforce robust RBAC and rate limiting across endpoints.

What does row-level security (RLS) verification involve during an endpoint review?▼

Row-level security verification confirms that explicit RLS policies are enforced across the API surface, ensuring role-based access controls prevent unauthorized data retrieval and guide proper remediation.

How do I secure Clerk webhook handling and prevent token leaks?▼

Securing Clerk webhook handling involves examining event flows, validating secrets management, and checking token handling during the auth surface review to prevent misconfigurations and unauthorized integration access.

Can I use this approach to check rate-limiting coverage on admin-only API endpoints?▼

Yes, endpoint protection assessment identifies inadequate rate limiting and admin-only exposure by applying security checks during new endpoint reviews to ensure consistent API access protections.

What is the best way to enforce consistent RBAC policies across an API surface?▼

The best way to enforce consistent RBAC is conducting a comprehensive auth surface review to verify role-based access, validate tokens, and apply explicit security policies for governance and targeted remediation.