danygiguere

danygiguere/audit-skills

Skill Claude CodeCodex

Input validation and API contract checklist. Use when reviewing request validation, DTOs, public endpoints, types, bounds, or unknown-field handling.

danygiguere/audit-skills

Skill Claude CodeCodex

Transactional-integrity checklist. Use when one operation writes to multiple tables, stores, or external systems and partial failure would corrupt state.

danygiguere/audit-skills

Skill Claude CodeCodex

Authentication and session audit checklist. Use when reviewing login, logout, password reset, token issuance, session expiry, or remember-me flows.

danygiguere/audit-skills

Skill Claude CodeCodex

Access-control audit checklist. Use when reviewing endpoints or handlers that gate actions by role, permission, or ownership, or when checking for privilege escalation.

danygiguere/audit-skills

Skill Claude CodeCodex

Background job and queue checklist. Use when reviewing async jobs, scheduled tasks, or consumers — retries, poison messages, ordering, timeouts.

danygiguere/audit-skills

Skill Claude CodeCodex

Blocking I/O in async contexts checklist. Use when reviewing async/await code, event-loop or reactor-based services, coroutines, or worker/thread pools — sync calls in async handlers, CPU work on the event loop, sync-over-async, blocking sleeps, missing timeouts.

danygiguere/audit-skills

Skill Claude CodeCodex

Caching correctness checklist. Use when reviewing caches — keys missing a user/tenant dimension, stale data after writes, cache stampede, cached errors, or per-user responses landing in a shared or CDN cache.

danygiguere/audit-skills

Skill Claude CodeCodex

Query cardinality checklist. Use when an UPDATE or DELETE keys on a non-unique column (e.g. WHERE name = ?) and may hit the wrong rows, when findOne/.single()/.first() runs on a non-unique field, or when a column is treated as unique in app code without a database UNIQUE constraint.

danygiguere/audit-skills

Skill Claude CodeCodex

Insecure-configuration checklist. Use when reviewing app config, CORS, security headers, debug flags, cookies, or environment-specific settings.

danygiguere/audit-skills

Skill Claude CodeCodex

Cryptography and data-protection checklist. Use when code hashes passwords, encrypts data, generates tokens or randomness, or compares secrets.

danygiguere/audit-skills

Skill Claude CodeCodex

Cross-site request forgery checklist. Use when reviewing state-changing endpoints in apps with cookie or session-based authentication — CSRF tokens, SameSite, origin checks. Does not apply to pure token-based APIs.

danygiguere/audit-skills

Skill Claude CodeCodex

Data over-exposure checklist. Use when reviewing API responses, serializers, error messages, or logs for leaked fields, PII, or internal details.

danygiguere/audit-skills

Skill Claude CodeCodex

Insecure deserialization checklist. Use when untrusted bytes (request bodies, cookies, sessions, cache entries, queue messages, uploaded files) are deserialized — native object deserializers, polymorphic JSON/XML typing, unsafe YAML, or missing type allowlists.

danygiguere/audit-skills

Skill Claude CodeCodex

Discarded async work checklist (fire-and-forget). Use when reviewing code that creates promises, futures, tasks, or reactive publishers (Mono/Flux) — results not awaited, returned, or composed; bare subscribe; floating promises; async writes that silently never run.

danygiguere/audit-skills

Skill Claude CodeCodex

Exception and error-handling audit checklist. Use when reviewing try/catch blocks, error propagation, empty or overly broad catches, rethrowing, cleanup/finally paths, async error handling, or whether errors map to the right HTTP status (404 vs 403, 401, 422, 409).

danygiguere/audit-skills

Skill Claude CodeCodex

File upload/download safety checklist. Use when code accepts, stores, processes, or serves files — path traversal, type and size limits, storage location.

danygiguere/audit-skills

Skill Claude CodeCodex

Remediation patterns for correctness findings. Use after a confirmed atomicity, idempotency, or background-work issue — transactions, idempotency keys, outbox.

danygiguere/audit-skills

Skill Claude CodeCodex

Remediation patterns for authorization findings. Use after an audit confirms an authz or IDOR issue and the user asks for a fix — policy checks, ownership scoping.

danygiguere/audit-skills

Skill Claude CodeCodex

Remediation patterns for observability gaps. Use when adding logging, metrics, or tracing after an audit finds blind spots.

danygiguere/audit-skills

Skill Claude CodeCodex

Safe-retry and duplicate-delivery checklist. Use when reviewing payments, webhooks, queue consumers, emails, or any handler that may execute twice.

danygiguere/audit-skills

Skill Claude CodeCodex

Insecure direct object reference checklist. Use when code fetches or mutates a resource using an ID, slug, UUID, or filename taken from the request.

danygiguere/audit-skills

Skill Claude CodeCodex

Injection audit checklist (SQL, NoSQL, command, template, path). Use when queries, shell commands, templates, or paths are built from user input.

danygiguere/audit-skills

Skill Claude CodeCodex

Mass-assignment checklist. Use when request payloads are bound onto models or entities — create/update/fill from the request body, fillable/guarded lists, strong params, DTO binding, or fields like role, isadmin, or ownerid being writable.

danygiguere/audit-skills

Skill Claude CodeCodex

Zero-downtime migration checklist. Use when reviewing database migrations or schema changes — locks, backfills, destructive changes, rollback plans.