skills.rest
ducnm-mimhus
ducnm-mimhusCOMMUNITY
Explore all skills by this author →
GitHub

security-audit

Identify security patterns for authentication, authorization, IDOR, PII, and webhook verification.

Updated Feb 4, 2026
Search Tags:#authorization#security#authentication#audit#idor#webhook-verification#pii-protection
One-click install
npx skills add https://github.com/ducnm-mimhus/Avada-Simple-Sales-Pop --skill security-audit-ducnm-mimhus
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/ducnm-mimhus/Avada-Simple-Sales-Pop/tree/main/.claude/skills/security
Command: npx skills add https://github.com/ducnm-mimhus/Avada-Simple-Sales-Pop --skill security-audit-ducnm-mimhus

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams and developers often struggle with consistent authentication, authorization, and data protection across APIs, portals, and webhooks. This skill provides a structured, pattern-driven approach to identify, document, and mitigate threats like IDOR, data leakage, and insecure webhook handling.

Core Features & Use Cases

  • Authentication and Authorization patterns for Admin API, Storefront API, and webhook endpoints.
  • IDOR prevention, data minimization, and PII protection guidance to enforce least privilege and privacy.
  • HMAC verification, signed requests, and secure webhook validation to prevent tampering and replay attacks.
  • Use Case: When integrating a new shop app, apply these patterns to validate permissions and data access flows.

Quick Start

Conduct a security audit of the current project focusing on authentication, authorization, IDOR, PII handling, and webhook verification.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent IDOR vulnerabilities in my API endpoints?▼

To prevent IDOR, enforce proper authorization scoping and data minimization across API data flows. Apply structured authorization patterns to validate object-level permissions on admin and storefront endpoints.

How does HMAC webhook verification prevent tampering and replay attacks?▼

HMAC webhook verification prevents tampering and replay attacks by validating cryptographic signatures on incoming requests. It enforces secure webhook handling through signature validation checks on payloads.

What is the best way to audit authentication and authorization patterns for a shop app integration?▼

The best way to audit authentication and authorization is applying structured pattern checks to validate permissions across admin, storefront, and webhook endpoints. This enforces proper scoping and secure coding practices during integration.

Do I need PII protection guidance to enforce data minimization across my APIs?▼

PII protection guidance is needed to enforce data minimization and least privilege across API data flows. It provides structured validation rules to limit sensitive data exposure on admin and storefront endpoints.

Can I use security audit patterns for both admin API and storefront API endpoints?▼

Security audit patterns apply to both admin API and storefront API endpoints. They enforce proper authentication, authorization, and data access scoping across distinct API surfaces.

Why does insecure webhook handling cause data leakage in my application?▼

Insecure webhook handling causes data leakage when unverified payloads allow tampering and unauthorized access. Applying HMAC verification and signature validation enforces secure webhook validation to prevent exposure.

Related Skills

Explore More Software Engineering Skills→
luyzkkluyzkk

security

Audit authentication, authorization, cryptography, API defenses, and Supabase hardening.

Community
Advanced
Gdm0714Gdm0714

security-first

Enforce OWASP-aligned security controls across web application lifecycles.

Community
Advanced
abhiunixabhiunix
1

security-audit

Scan codebases for OWASP Top 10, secrets, and dependency vulnerabilities.

Community
Advanced
foutoucourfoutoucour

pentest-web

Simulate web penetration testing to identify security weaknesses in web applications.

Community
Advanced