Identify authorization gaps and enforce ownership isolation in web API queries.
npx skills add https://github.com/fcalell/dotfiles --skill security-audit-fcalell
Please help me install this Agent Skill. Skill: security-audit Source: https://github.com/fcalell/dotfiles/tree/main/dot_claude/skills/security-audit Command: npx skills add https://github.com/fcalell/dotfiles --skill security-audit-fcalell
Web applications often struggle with inconsistent security reviews, leading to authorization gaps and data exposure. This Skill provides repeatable patterns to ensure authenticated access, ownership isolation, and safe data handling during reviews.
Audit a web API against the catalog of patterns and implement fixes in the codebase.
High-intent search queries and answers about installing and using this skill.
To check for authorization gaps in a web API, audit protected endpoints against established patterns to verify authentication, enforce ownership isolation, and ensure correct error handling prevents resource enumeration.
Preventing cross-tenant access during bulk operations requires applying ownership filters and tenant isolation directly within data queries to ensure users only interact with their own resources.
Enforce safe data handling in web services by applying schema validation for incoming inputs and using parameterized queries to prevent injection and ensure secure database interactions.
Yes, these security audit patterns apply to both single-resource access and bulk operations, verifying that proper authentication and ownership filters are enforced across all query types.
Your API exposes data across tenants because of missing ownership isolation filters in data queries, allowing authenticated users to access resources outside their tenant boundary.
Apply ownership isolation patterns during a security review when auditing web APIs and services to fix missing ownership filters and produce an audit-ready checklist for protected endpoints.
pdparchitectIdentify and exploit GraphQL API vulnerabilities including IDOR and broken authorization.
zardusai-cyberIdentify and remediate security vulnerabilities across authentication, input validation, secrets, APIs, and deployments.
wmeintsWrite parameterized database queries with eager loading to prevent SQL injection and N+1 problems.
grivera82Identify GraphQL security gaps like IDOR and authorization bypass.
